How can i hide password from extension and Manage password only through app

Hi,
I have recently started using 1password5. I just want to know how can i hide password and other editing feature from browser extensions? I just want to manage the password and other features through the app and use extension only to sign in(readonly) as displaying password in browser extension is serious security issue for me.

Thanks'
Champak


1Password Version: 5
Extension Version: Not Provided
OS Version: OSX 10.11.1
Sync Type: Not Provided
Referrer: forum-search:hide password in extension

Comments

  • khadkhad Social Choreographer

    Team Member

    Hi @champakkc,

    Thanks for taking the time to contact us.

    Once 1Password is unlocked, it is possible to edit in the main app and 1Password mini. There is not a way to restrict that. It wouldn't provide any additional security to restrict editing to the main app, since whoever you are concerned about editing the items could just open the main app and edit them there.

    If you are concerned about someone else modifying your data, be sure that your auto-lock settings on the Security preference pane are set appropriately for your expectations.

    1Password for Mac: Security Preferences

    Auto-lock options include:

    • Lock on sleep
    • Lock when screen saver is activated
    • Lock when main window is closed
    • Lock when fast user switching
    • Lock after computer is idle for n minutes

    That way you can be sure that 1Password is always locked when you need it to be.

    I hope that helps. But please let me know some more details about why you were requesting such a feature. Perhaps there is a better solution. :)

  • Hi @khad
    Thanks for the quick response. The problem is i share my device (mainly mac) with my family members and sometime with friends. I don't have a problem sharing my login with them(i.e. its ok if they login to my accounts clicking the login in extension) but i don't want them to know my password. With the 1password extension user can go to each login and reveal the password. I agree with you to Lock it, but that's an extra overhead when i myself is using the extension as i have to type in the main password multiple times to unlock 1password. It will be great if you can add this feature in future update for the browser extension app to hide the password in the extension as a configuration in the app.

    Please let me know if there is a workaround for this.

  • Hi @champakkc,

    There is no workaround you could use I'm afraid and anything we do might cause the user to have a false sense of security which is never good in a security product of any kind. Why do I say this? I have two concerns that would still be wide open even if we altered how 1Password mini worked.

    1. If a person can log into an online account they can change the password to a known value. 1Password would offer to update the Login item and as a 1Password user you may not be aware given you use 1Password to log in.
    2. Almost without exception, all passwords entered into a web page can be read with a small amount of knowledge on how browsers work. This is impossible to defend against and a simple JavaScript snippet found online is all you need. I actually use this to check what data 1Password filled in when dealing with certain tricky sites. I'm also aware of a browser extension that allows you to click a password field to reveal it. Most sites will securely transmit the data but it's not secure when it's just sitting in the web page being displayed by your browser.

    If somebody is inclined they can find the password out. I'm not sure there is an elegant method I'm afraid. One route is to lock 1Password but you're not overly keen on that. Another would be the use of the OS X guest account or separate OS X user accounts but that probably has at least the same extra effort required if not more. I'm not sure we'll be able to come up with a great solution for your needs :(

This discussion has been closed.