New Solution to People Wanting Log-In Info On Their Various Other Entries

@paranoyd

In any case, the real point is here is...we wake up one day and find out that we aren't nearly as protected as we all thought we were...

And round and round we go! ;)

I don't mean that to sound flip; it's merely accurate: attackers work continually to open exploitable holes in everything from our chip architecture to our compilers to anything else they can hack, and defenders work to plug holes, slow attacks and patch issues. Perhaps I lack imagination, but I find it difficult to imagine a future in which some version of this is not still going on. Short of the 'War Games' observation that the only winning move is not to play, it's like many other things: you do what you can, and hope the absolute worst doesn't come your way.

That's not to say that security measures we each take aren't worthwhile, only acknowledging that there's no such thing as perfect security forever, or even at any given moment. Each of us has to draw the line at how paranoid - excuse me: paranoyd, LOL - we want to be. What may seem like prudent measures to me may seem like a ridiculous amount of unnecessary work to someone else, while simultaneously striking a different person as not NEARLY enough. With 1Password, we try to provide, in our own lane, proven tools which - used properly - heighten users' online security and increase convenience without sacrificing one for the other.

:dizzy:

No, of course not. But the cloud is another vector for an attack. So instead one vector with a local file there are now two vectors.

@paranoyd: Well, I guess for an attacker that isn't very bright that would be true...but given that our servers never receive either the Secret Key or Master Password, both of which are needed to decrypt a user's data, they'd really be better off going after you than us: one-stop shopping.

Right - this is not a cloud flaw per se. But, getting into the weeds, there really is no "cloud". It's a mental construct. There are just computers sitting someplace else that hold all my data. And it appears that a massive vulnerability has just been discovered that will affect those computers.

Also, your computers (and mine), which are arguably easier to get to than AWS...

As for all the encryption being done client-side, then could now an exploit be written that grabs my data on my computer as it is being shunted around RAM in preparation for being uploaded? If so, sure, that could happen I suppose to my regular non-uploaded data. But as I've said before...that's one vector. Now we have two.

That really sounds like one to me, since an attacker with access to your computer's RAM should probably just grab your account credentials while they're in there! It sucks, but we're really the weakest link in our own security. With great power — being in control of our data and incredibly advanced devices — comes great responsibility.

I also view these things as the out-run-the-bear story....

That pretty much sums it up for me! :lol:

Hi @paranoyd

Yes, what you're describing is certainly possible, through 1Password Families. Each person within a 1Password membership gets their own unique "Personal" vault which nobody else has access to or visibility of. Beyond that any number of shared vaults can be created and shared with whichever people within your membership that you choose. We have two guides that should help you get there:

Move your existing 1Password data to a 1Password account

and

Share passwords in 1Password Families

Please let me know if you have any questions along the way. :)

Ben

@paranoyd:

But I can't seem to find the "Invite People" option. Is that perhaps because I signed up for an individual account through the Mac App Store?

This is the reason. We will be happy to help you with this. To avoid sharing your account information here, can you send us an email to support+forum@agilebits.com from your account's registered email address so we can continue the conversation there?

After you have sent the email, please feel free to post the ticket number you received so we can locate your message and connect it with this forum discussion.

Looking forward to your message!

Please send from the email address associated with your 1Password account (the one you enter at https://my.1password.com to sign in), which may or may not be the same as your Apple ID email address. :)

Ben