Enter master password again for revealing passwords [Request added]
Hi,
I recently started using 1Password more and moved all my passwords from Chrome to it.
I would like to have the vault open at all times for convenience... I moved my credit cards to a separate vault for that reason.
I see a big problem though... if the vault is open, then anyone can go and reveal passwords.
In Chrome you couldn't actually do that withouth entering the system password.
Is there currently a possible usage scenario that would allow me to not having to type in a master password when using regular web at all, like I could do before when using Chrome built-in password manager?
Comments
-
Hmm I now see that I haven't even solved my problem with credit cards... because there is some big confusion of how vaults work, maybe even a bug... :((
I set the same master password for Credit Card vault... and when I logged in to the main one, I was logged in to Credit Cards as well... that shouldn't happen but I guessed that maybe because it was the same password... still it shouldn't behave like that.
I then tried to create a third test vault with a new password and actually when I log in to the main vault, I can once again see all the info in this test vault - how is that possible?
Also it seems impossible to change master passwords for non-primary vaults. Also I cannot set security options for each vault separately.
If the requirement to enter master password to reveal passwords would be implemented as well as an option to require master password on credit card info, then separate vaults wouldn't be neccessary for this use case... but they should still be fixed... or maybe they work in some way I don't understand but it doesn't seem logical.
0 -
Hi @davidhq
I'm sorry to hear that you're having trouble with 1Password - I'll do my best to clear things up for you here!
I see a big problem though... if the vault is open, then anyone can go and reveal passwords.
I don't know that I would call this a problem, more of a convenience: if you have the vault unlocked, shouldn't you be able to access your passwords and your data when you need it? I think more users would be frustrated if they had already entered their Master Password to unlock the vault, and then they had to enter it again to view their passwords.
Let's take a step back and explain how multiple vaults on 1Password work.
1Password's new multiple vault feature was designed so that you still only have to remember one password, no matter how many vaults you create. Your primary vault holds the encryption keys for all of your secondary vaults. This means that unlocking your primary vault will give you quick and easy access to all of your data, regardless of which vault it is stored in.
However, you still can unlock a secondary vault on its own. In the main app, use 1Password > Switch Vault menu. (In the 1Password mini, click on the lock image on the lock screen to select the secondary vault.) Please note that when you unlock the secondary vault alone, all other vaults will remain locked. You won't be able to copy items between vaults, and you will need to enter your Master Password to view another vault.
For your situation, if you would like to keep some of your data locked up while accessing some of your less-vital details, I would suggest a bit of a vault re-organization:
- All your personal, high-security items should be stored in your primary vault
- Any lower-security items that you need frequently can be stored in a secondary vault.
With this set-up, you can easily unlock directly to a secondary vault, either using the menu item as described above, or the keyboard shortcut ⌘# ( Command-'vault number' ):
Also it seems impossible to change master passwords for non-primary vaults. Also I cannot set security options for each vault separately.
The ability to change details of a non-primary vault after creation is something that our developers are working on. If you are really keen on changing how your secondary vaults are designed now, there is a bit of a workaround. Please see our Knowledgebase article here: Edit a Vault's details after creation
I hope this helps to explain 1Password's multiple vaults design, but if you have any further questions, we're here to help!
0 -
Hi @Megan
GREAT, thank you... this clarifies a lot... and your proposed strategy also makes sense.
Maybe think about how to imply how this really works from the interface with some notices so there is less confusion.
I now moved my logins to a new vault. However there still seems a little bit of improvement you can do ... at least make it optional setting per vault if master password should be required again when revealing passwords.... because still now I have this Logins vault and I want to keep it mostly open and it's less secure than Chrome's built in system. Everyone can see my passwords if I leave computer unattended for a few minutes. In Chrome when trying to reveal passwords, they would get asked for a system admin password.
For separate settings per vault I will wait until you implement it in the interface.
Just a small bug report: when moving stuff between vaults, the little counters I enabled don't get updated correctly... it is always reproducable.
regards,
david0 -
Hi @davidhq,
I'm so glad to hear that my explanation helped, at least a little bit.
because still now I have this Logins vault and I want to keep it mostly open and it's less secure than Chrome's built in system. Everyone can see my passwords if I leave computer unattended for a few minutes. In Chrome when trying to reveal passwords, they would get asked for a system admin password.
I just want to clarify a bit further here. The option to conceal/reveal passwords is meant to provide security from shoulder-surfers, people who would peek around the corner to get a glimpse of your password just sitting on the screen. If you are in a public place and concerned about the security of your data, you should really lock 1Password when you step away from your computer. Think about it this way: whether your passwords are in plain-text or concealed, the copy option is still available, as is the fill option. If someone were to get access to your computer when 1Password is unlocked, they don't need to see the passwords, they could copy and paste your passwords into a text document, or simply use 1Password's filling to log into your sites. Having users enter the Master Password before revealing passwords would be an annoyance to users that would not provide any additional security.
When 1Password is unlocked, your data is accessible. To prevent your data from being accessed, you will need to lock 1Password. Simple as that. :)
We do have a handy keyboard shortcut that can lock 1Password when you are stepping away from your desk: ⌘⌥⌃L ( Command-Option-Control-L ). I've heard from several users who take advantage of the 'Lock when screensaver is activated' setting in Preferences > Security, and enable the OS's hot corner to activate the screensaver whenever leaving their computers.
Please let me know if you have any further questions!
0 -
Actually I don't agree. Let me explain.
I don't want to think when to lock my stuff and when not... it takes my brain cycles.
The option to copy a password should of course also be behind a password.
And remember this would be optional and it takes very little effort to implement.. just an additional option which is not selected by default... but me and probably many others would use it.
And there is a difference in being able to log into my sites from my computer and getting hold of my actual passwords.
So your explanation doesn't solve my usage scenario... now I really will have to think about locking my vault every time I get up from the computer for 30s in a coworking space... of course I understand that in such cases I should probably log off etc. but I think the risk-trouble ratio is not enough... I don't care if people see some of my random emails, but I do care if they see my passwords.
I hope my writing makes sense.
If nobody else has written you about such option, then maybe forget it for now but remember it when someone else mentions a similar use case.
thank you
david
0 -
Hi @davidhq,
Thanks again for the detailed feedback!
I'm just curious: are you suggesting a secondary password to reveal/copy your passwords? Or would your Master Password be required? Either scenario becomes a bit problematic: either you need to remember a second password to fully access your data, or you need to enter you Master Password ... which would be the same requirement as if you had locked your database.
I apologize if I'm misunderstanding what you've suggested here - you have been explaining things quite clearly. :)
0 -
It could be Master Password... the difference is that my logins would still work (because the vault is unlocked), but if I wanted to actually see passwords, I would have to enter master password again. In this way I could leave the vault "functional" without too much worrying. If I wanted people to really not be able to login to my sites (I would probably just lock my comp though), I could lock the vault.
0 -
Hi @davidhq,
Thanks for clarifying! Again, I think that your suggestion complicates things for the average user: why should the Master Password need to be entered multiple times to fully unlock the database?
Regardless, we really appreciate your feedback here - it's great to know how people are using 1Password, and where our user-interface could be improved. :)
0 -
Yes but you don't have an answer for me why I now have to have less security than before... with more convenience, but actually less because I have to keep locking my vault if I don't want my passwords to be really visible to anyone with potential access to my computer while unlocked...
And my suggestion doesn't complicate things for the average user because that would be an option somewhere in advanced settings and off by default.
So do you have answer for me how to have automatic logins without having to type master password and without revealing my passwords to anyone that comes to my computer?
Today I uninstalled Webroot because I lost 50 open tabs to an issue I was telling them to fix for a few months... There I also suggested an option to completelly opt out of forceful browser extension installs... There the feeling was that they just won't listen.
Here with 1Password it's nowhere close, but still you haven't given me a logical answer how can I achieve this basic requirement .. that would make your product better for others too, I'm sure. Also I paid you 50€ + 20€ I think... I mean before one of the products became free... Doesn't mean anything, just that it seemed really solid and I believed it to be perfect before trying or reading too much about it. Now it feels strange that and obvious thing is missing, at least for power users that like to configure things exactly to their preference.
So I'll be checking other solutions, maybe one of them is closer to what I need, but it's a shame because 1Password is nearly there, it feels really solid and professional, but .....
Regarding webroot, I found one user's comment today which confirms I'm not the only one with this feeling:
A few weeks ago WSA installed a browser add-on without any warning, without notifying me, without asking me, and without explaining what the add-on is or what it does. I have paid numerous security companies over the years to protect my pcs, but I will say this about WSA, they sure have some balls. They do whatever they want without asking, and if you don't like it, they could not care less. Either you accept it, or go elsewhere. No apologies, no explanation, and no contact.
So don't become Webroot! ;)
PS: you don't have to respond to me now, maybe in a few weeks... If you could kindly take some time discussing this with others... I'm sure that if my proposition is rational, you can find a way to incorporate it.. if I'm wrong for some reason, then I'd like to know how. Until soon and thank you very much!
0 -
Hi @davidhq,
@Megan let me know of your request and I thought I'd take a moment to weigh in.
Your request will be considered by the developers, however, we here on the forums cannot promise anything. What we can do is give you practical advice on how to use 1Password as it is currently designed.
Reading over your use case, I honestly think the best approach for you is to take advantage of the security timeouts. For instance, here is how I have mine set up.
This setup allows me to unlock 1Password and continue to use it unhindered while I am using my Mac. It will stay unlocked as long as I am doing something on my Mac. However, as soon as I step away, it will lock 1Password 60 seconds later, because the computer will be idle, meaning no keyboard or mouse input.
Also, if I sleep the screen (quickly tap the power key on a MacBook, or set up a Hot Corner in System Preferences) it will lock. I prefer to sleep the screen anyway when I get up for more than a quick moment, as I have my Mac set to require the system password, too, so the whole computer + 1Password is locked down.
I hope this practical tip helps you for now. As I said, your request will be considered by development, but we here in the forums cannot promise it will be implemented. Have an awesome rest of the week. :smile:
0 -
Thank you for commenting... yes, all good but doesn't help at all :) But I'm glad you will consider my use case and hopefully this helps others as well.
0 -
Hi @davidhq Here's the one issue that I see, what are your thoughts on it?
If a password can be submitted to a web page then it can viewed. All you need is a small snippet of javascript. Using Safari as an example I have the option of saving it as a bookmark (worked straight out of the box) or I could replace the url but that required Allow Javascript from Smart Search Field in the Develop menu (which has to be enabled). More convoluted than say pressing the alt key but still, there's a way to retrieve a submitted password. Locking your vault of course would defeat this as the password couldn't be submitted.
My concern at that point would be, would such a preference create a false sense of security for any percentage of our users? would they walk away with 1Password unlocked for long enough periods for this to be abused?
0 -
Hi, I think this question popped up in my mind but the answer is that this would shield me mostly against the likes of curious (girl)friends etc. If I suspected someone with more tech knowledge has some serious intentions (or even when I'm in a coworking space / coffee shop), then of course I would lock my entire computer and/or vault.
So if you know what you are doing (and you can have a special notice somewhere), this really comes handy... most of the times I wouldn't have to think about locking my computer...
Because now my close friends or significant others could learn about a curious app 1password I'm using and then feel inclined to snoop around in it when I'm not looking, you know, just because.... if they can get passwords easily, then this is BAD. And I don't want to lock my computer or vault at home everytime I leave the desk. Plus a big problem with current setup is that even if I have autolocking of vaults, even 1 minute can be enough for my family or friends to gather passwords... and they would have no idea or time to get into passwords protected by additional entry of master code as you are describing. I forgot to emphasize this previously... but really even with autolocking, there is room for bad things... and that's why I don't want autolocking but additional security... and when I need top security, I will lock my computer. This way I can have all the niceties and comfort with minimal amount of potential bad things.
0 -
Power to the users! We know best ;D
0 -
Thanks for the added context of the situation, @davidhq. That will help a lot in determining whether or not to implement such a feature.
Since it sounds like we have covered the bases a couple times now, I am going to close off this thread. If any other issues or requests come up, feel free to start a new discussion.
0
