1Password Accounts are NOT supported on Android prior to 5.0. That's a bummer!

Hi @D.B.

Jelly Bean is almost 6 years old now and is no longer supported by Google. In general we do not support operating systems that are no longer supported by their vendors. Running an OS that is no longer updated, especially one that is rooted, would not be recommened. In doing some research it appears the HTC One is capable of running a more modern OS, and so the only recommendation I can offer here woud be to update to the latest supported version (which appears to be v5 Lollipop).

Ben

@D.B.: I'll grant it may not matter to you, but it matters in the context of security — and that's the world 1Password lives in. We're grateful that you've supported us in the past, and also if you want to now or in the future; but we're not going to be enablers of bad security hygiene for all 1Password users just because you're our customer and you've chosen this path for yourself.

As far as vulnerabilities, take your pick. There are hardware issues based on ubiquitous Qualcomm chipsets, those targeting browser, OS, and even MMS, over the years since Android 5 was released, and plenty just within the last two years. Google is good about patching the OS, but only for reasonably recent versions; and often the hardware vendors simply never get around to pushing them out to their customers anyway. We both knew what we were signing up for in that regard when we bought into the Android ecosystem: "with great power comes great responsibility", as they say.

So while you're certainly entitled to use whatever device/OS/browser you want to, keep in mind that at the same time you're the one limiting yourself here. 1Password.com depends on security features — especially web technologies — that simply didn't exist in earlier versions of Android, and we're not going to weaken its security just so we can support OSes and hardware that have long since been discontinued both in terms of sales and also vendor support. 1Password.com didn't drop support for outdated hardware/software; it simply can't ever work there. If it did, we'd have built it years sooner.

Ultimately if you want to go it your own way that's fine. But accept that that decision comes with tradeoffs. There's a lot of new stuff that's come since then which you just can't benefit from, not just 1Password. You just can't have it both ways.

ref: KWF-28849-595

@prime: I knew there was a fairly recent big one, but could not think of KRACK off the top of my head. Thank you!

I guess that was just the tail end of last year. It's an interesting example, because a single vulnerable device gives an attacker a way into the network even if everything else is patched. I was glad at how fast both the vendors of devices I was using at the time and my router were patched, but that's not going to be the case with older stuff. :(

Google shipped WebCrypto in the desktop version of Chrome at the end of 2014. Mobile is much father behind, and the browser technologies available to apps are limited by what's built into the OS. So while 1Password for Android itself can work on a JellyBean device, 1Password.com depends on that and other technologies that are simply not available there — much like Google's autofill and fingerprint APIs did not exist there.