Updating passwords is far too difficult and error-prone
I've read the instructions, and the problem is that there are too many exceptions to the standard scenario. There are also UI issues with the 1Password interface that should be addressed. I've been spending the evening converting existing passwords to new, 1Password-generated ones, and I think out of 10 or so sites so far, there were perhaps one or two that I managed to get right on the first try; everything else required hunting around for earlier versions of the password in an effort to recover old information. It is simply far too difficult and tricky to get this right, and the UI allows too many mistakes to be made.
(1) In the main 1Password window, when clicking in the editText field containing the password or username (or any field with an associated Copy button), absolutely nothing should ever be copied to the clipboard/pasteboard unless I actually click on the Copy button. Clicking in the text or the bullets should not copy over the existing clipboard.
(2) I have never encountered the 'Update password' dialog which is described in the instructions. I often encounter one which asks me to create a new Login or whatever, but there never seems to be a match between my existing Login entry and the Web site I'm visiting so that it knows to ask me whether I want to Update. Consequently, I'm always having to manually update the password information.
(3) I typically get to the change password page of a particular Web site, and copy (from 1Password) and paste my existing password. I then use the Password Generator from the menu bar to create a new password. I click Fill, which is meant to fill the 'new password' and 'confirm password' fields; supposedly this copies the password to my clipboard as well. I usually click the OK button or whatever equivalent there is on the page; there is almost never a corresponding 'update' dialog from 1Password (see above), though there is sometimes a dialog asking me if I want to create a /new/ login, which I don't, as I am updating an /existing/ login. Having done this, I click in the 1Password main window so that I can paste the password from the clipboard into the editText box. It is at this point that things break down. I don't know whether sometimes I click on the password field without having first clicked the Edit button, or what, but the fact is that most of the time the clipboard password appears to get replaced by the /old/ password, which means I have now lost the new password and have to try to recover it.
The above scenario should not be able to happen; the UI should not permit me to lose a newly-created password which has been used to update the password on a Web site.
(4) When searching for the newly generated password, the history list in the Password Generator popup menu is not particularly helpful. It simply lists multiple items with the Web site name, with no way of distinguishing them. These items should be labelled with timestamps, and it should be possible to actually see the passwords themselves.
Anyway, those are some the observations I've made over the past few hours of trying to make this work reliably. From searching the discussion posts, it seems I'm not the only one who has problems in this area, so I think more work is needed.
1Password Version: 5.3.2 (532001)
Extension Version: 4.4.4
OS Version: 10.10.5
Sync Type: WiFi
Comments
-
Hi @NomadUK,
Let's see if we can do something to help :smile:
- So just to understand correctly, you're viewing the Login item from within the main 1Password window and you enter edit mode. When you do this you're saying that clicking to place focus on say the password field copies the contents of that field to the clipboard? That I haven't experienced but when viewing an item I do know that clicking anywhere on the field will by default copy the contents to the clipboard - we treat the entire field as a button when you interact with the Login item in a read-only mode. So I'd just like to make sure I understand the correct situation so that I'm not saying anything accidentally misleading or confusing while we discuss this :smile:
- Our 1Password Save Login window supports both the creation of new items as well as updating existing ones. I'm going to add a couple of screenshots at the bottom that will highlight this as images in a bullet point don't tend to work too well. I agree with you, I think we can improve matters here and we are working on a new design as the current 1Password Save Login window could benefit from a rethink. You haven't mentioned it, it might not be applicable to your situation but we also know people don't realise they can switch vaults in that window and that's something else we wish to improve. There has also been the discussion in the past over defaulting to updating an existing Login item and creating a new one. I won't say we've got this right but like every aspect of the application we do take views on board with the goal of improving 1Password so your thoughts matter. Hopefully the new dialog will seem like an improvement when it comes along :smile: 2.
- This one seems to tie in quite closely to 1. and 2. so I'm wondering if anything I've written there crosses over here. The one thing I know I haven't mentioned yet are Password items. When you perform any action that suggests you're going to use a generated password i.e. fill or copy, we create a Password item that stores the password - a safety net. The whole point of these passwords is that there is no way you're going to remember them, heck typing them is often an exercise in anger management so we want to make sure that should anything happen there is still a record. If 1Password updates an existing Login we do remove the Password item as there is now a proper record of it but should you ever find that the new generated password isn't in clipboard etc. it should still exist as a Password item. If you were in your browser at the time it should be titled according to the site that was in the visible tab and it will also contain the website field, both to help you remember where this item was created. The Password items are visible in every part of 1Password, not just in the password history from inside the Password Generator. I'm not suggesting there aren't improvements to make but I wonder if this tidbit of information will help you right now.
- The current 1Password beta improves on this. You're not the first to suggest that the title there is redundant while a timestamp might prove more useful. I can't say when this will make it into a stable but the improvement seems to be solid enough so it would seem very unlikely that all of our users won't be benefiting from this improvement at some point. There isn't a way to view the password from the password history menu but you will be able to tell when they were created and you can already copy the password of the selected item using the keyboard shortcut
⇧⌘C. To view more detail on any Password item you would want to view all Password items from the Password category menu option or from within the main 1Password window.
So I believe we might have good news on two fronts and we've opened discussion on the others as I look to make sure I fully understand. Hopefully that's a reasonable start :smile:
0 -
Hi. Thanks for the response. Here's mine:
- > So just to understand correctly, you're viewing the Login item from within the main 1Password window and you enter edit mode. When you do this you're saying that clicking to place focus on say the password field copies the contents of that field to the clipboard?
No, this happens when I'm not in Edit mode. When the mouse hovers over the password item, the Copy button appears. But clicking anywhere in the password field, accidentally, will copy the password to the clipboard. The UI is misleading at this point: copying to the clipboard should only happen if the Copy button is clicked. There are any number of times I accidentally clicked on the password when the item was not in Edit mode, and that wipes out the password in the clipboard.
Sounds like you're working on improvements, so it'll be interesting to see them when they arrive.
Yes, I discovered the Password items after I'd written, and they are helpful. Still seems unfortunate to arrive at a point where one has to resort to using these, but it's good that they're there!
Again, sounds like worthwhile improvements are on the way.
So, really, at the moment, the unresolved issue is (1).
0 -
Hi @NomadUK,
I can certainly present your case regarding the button. I don't know which way it will go though as this has been quite intentional behaviour, aimed at making it easier to copy the data and it's why a dotted border surrounds the field and button when the mouse hovers over it. We don't always get things right though and any decision should be questioned to see if we made the right one. I think many of our users find this useful though. I hope I didn't come across as too negative as that isn't my intention, it's just this particular point isn't as clear as some others where hands up, we could do better and should.
0 -
Sounds good. I think that, from a UI standpoint, if a control is presented then the control should be the affordance for the task; anything else is confusing. So if one wants to indicate that clicking on the text copies it, then just having a label nearby that says 'copy' would suffice. (I could go on at length about how the whole 'mouse over something to see if it does anything' school of UI that's developed over the past several years has destroyed any semblance of useful design, but that's a whole other story.)
The important thing is that it shouldn't be possible for the user to so easily destroy what's in the clipboard (with the result that recovering what was there becomes a difficult operation) simply by accidentally clicking on the text. Using the button as the copy control guarantees this; making it supposedly 'easy' for the user by incorporating the copy action into an action that should simply select an item (clicking on it) breaks this and leads to problems.
0 -
Hi @NomadUK,
How would you feel about your alternative, the removal of the button but keep the click on field to copy action? We have some visually impaired users so I'm not a big fan of that button anyway, I would quite happily see it removed for something else as VoiceOver can't see it despite the fact that it's a standard OS X UI element. Dave reminds me every so often though that VoiceOver is one of the better options out there so I try to minimise the ranting.
Regarding your school of UI comment, we (the entire industry) do go through phases don't we. Some of those phases are... questionable. Hopefully we slowly do make our way to something that is better though even if there are blips.
ref: OPM-3328
0 -
Personally, I would prefer a hard button that stayed visible all the time, which would indicate precisely what the UI is expected to do. I'm not really comfortable with the idea that clicking on a piece of text is going to copy an item into the clipboard and overwrite the existing data; there's simply no precedent for that kind of behaviour in any human interface standard I'm familiar with, and I've been doing UI for a very long time.
I think clicking on the password text should select it. Command-C or choosing Copy from the Edit menu copies the password to the clipboard. If the button is to be dispensed with, then a right/control-click could bring up a contextual menu with Copy and Reveal. This would at least follow standard Mac behaviour, even though it hides the command from the user until they right/control-click. The Copy and Reveal commands would, of course, also be available from the menu bar in the app; the contextual menu would make it usable from the floating window.
Really, destroying data when the user is not expecting it — especially in a situation in which the data are not trivially recoverable — is a bad idea.
0 -
Hello @NomadUK,
I shall pass on all of your thoughts and I wish I could make promises but I can't. While I haven't fallen foul of this feature the way you have (I confess I find it useful), I do understand the frustration if a UI decision hinders your ability to work which I mostly see when I have delved into VoiceOver queries as I mentioned before.
0 -
Sounds good. Thanks!
0 -
Echoing this as I bought 1Password 4 for Windows a couple days ago and am having similar issues with updating my old passwords to randomly generated ones stored in the manager. Main pain points are:
1) When I go to change the password to a new one, I'm prompted to create a new login, but if I accept, it generally saves both the old and new password and then uses the old password by mistake (along with the wrong URL - the change password page instead of the login). I'm not sure how to fix this short of deleting the new login entry entirely and then saving after I log in with the new details - simply deleting the entry for the old password seems to leave the login with no password at all.
2) Passwords I generate via the extension rarely show up in the Passwords list. I've generated a bunch and there are only two there right now. This has led to a few incidents where I've updated my password to a new generated one, gone to log out and in again to save the new password, then found that the login didn't save, the generated password is nowhere to be found, and my clipboard has already been cleared, meaning that I have to reset my password via the site. I feel like I can't trust the Passwords section to actually remember the passwords I generate, so I've taken to temporarily pasting them into a Notepad window until I'm certain they've been correctly stored. But as you can imagine, this is less than ideal.
Anyway, I'm sure things will be much smoother once all my passwords have been converted over, but the process of doing so has been a little frustrating for these reasons.
0 -
Hi @Xythar,
Sorry for the lengthy delay in responding. The forums are all sorts of busy right now and we're making our way through them as best we can.
- In the 1Password Save Login window there are two options and we default to Save new Login. There is the option to Update existing Login though. I'll add some screenshots at the bottom of the page as there isn't an elegant way to add them to a bullet point. I certainly don't know for sure but it sounds like maybe you're creating a new Login item where updating an existing one would only alter the password which is what you want. We'll see what you think based on this and the screenshots below.
- The Password Generator should always create a Password item when you click Fill or copy the password. If this isn't happening I would be very concerned for all the normal reasons why this would be horrible. I haven't seen this myself though. I am wondering if a piece of subsequent behaviour may be what you're seeing? As I say, a Password item should always be created at the time of the user performing any sort of action that would indicate the password is being used. After this, if you create or update a Login item and the new password is the same as the one stored in a Password item we either convert or remove that Password item in the belief that the purpose of the Password item has been served. The logic is the Password item is redundant if you have a Login item as it's more functional when it comes to filling a login page.
Does any of that help explain your observations or would you say you're seeing and reporting something else?
Here are the screenshots for the current 1Password Save Login window. We're actually redesigning this window as we think it could be better.
So if you change the option from the default of saving a new one to updating an existing one it changes the lower field to one where you select the item to change from a list. This should only alter the password field and no other fields in the Login item.
0 -
Thanks for the reply. I don't remember exactly what circumstances I was having the former issue under but I think it was when the initial login wasn't saved for whatever reason (maybe I was already logged into the site when I visited it) and creating a login on the change password page (with no existing login to update) resulted in saving with the old password. In any case, it's something I can work around by just logging out and into the site first, so no big deal.
For the second one, I think I've narrowed down what the issue is - if I use the extension (in Firefox, by the way) to generate a password and then click Copy, it ends up on my clipboard but is not saved to Passwords unless I click "OK" to close the dialog. Doing anything else (including simply clicking outside of the dialog window) closes the dialog, leaving the password on the clipboard but not saving it in Passwords:
So what I think I did originally was:
- opened the password generator via the extension
- generated a password and copied it to clipboard
- tried to leave the dialog open in case I needed it again by simply clicking on the webpage without pressing OK or Cancel
- this inadvertently closed the dialog without saving the password but leaving it on the clipboard
- without noticing this, I proceeded to change my password to what was on the clipboard, which then got automatically wiped by the default clipboard-clearing settings
The password generator in the 1Password app itself doesn't have this same issue because the Generate Password dialog is modal and doesn't let you leave without clicking either OK or Cancel (and it seems reasonable enough that Cancel would not save the generated password).
In any case, now I know to always click OK after generating a password (even if I don't intend to autofill) but I think the Windows app in general isn't operating as intended - it should really save the password as soon as the Copy button is clicked, without waiting for you to click OK. Might be worth looking at for a future version, anyway.
Thanks for looking into it, and thanks for writing the application!
0 -
Hi @Xythar,
I apologise, I'm a total idiot and I missed the very first line where you said 1Password for Windows. What's the point in me showing you a bunch of screenshots from 1Password on a completely different platform. That is not my finest moment.
So it seems the Password Generator behaves differently between the two platforms. I'm not completely surprised after all there will be numerous differences to have each version fit in with the operating system that it's aimed at. It's possibly because I'm so used to Mac now that I think the Password Generator in 1Password for Mac is better. I agree with you, I think copying a password should create a Password item as the OK button fills which you may not want it to do (for whatever reason). I've created a report for this based on your post.
The next time you need to update a password I will be interested if the 1Password Auto-Save window pops up and what happens if you change it from the default setting of Create new Login to Replace XXXXX I'm hoping that results in the kind of behaviour you expect :smile:
ref: OPW-512
0
