1Password unnecessarily prompts me to create a new or update an existing login

Options
jerryplotnick
jerryplotnick
Community Member

Since upgrading 1Password, I have been encountering a problem I never had before. I often use iCloud Keychain to authenticate on the web because it's faster just to position my cursor in the field and accept iCloud Keychain's suggestion. After I do so, however, I am on some sites (not all) prompted by 1 Password to save the login even though I already have a login for the site with exactly the same username and password as on my Keychain.

Here is the sequence of prompts.

If I need to sign into 1Password I get this:

https://drive.google.com/file/d/1Od77U06F-jaPgvfgZf6MMgv0Gpy8Y2vo/view?usp=sharing

("Unlock 1password to save this login")

After entering my 1Password password, I am asked whether I'd like to save the username and password for this site in 1Password. I can create a new or update an existing login.

https://drive.google.com/file/d/179lNfb6JIJCv8Cuj-bovZAgxw-Unjtfa/view?usp=sharing

But I shouldn't be getting any such prompts since there is no need to create a new or update an existing login. 1Password simply needs to stay uninvolved in this kind of situation. It's all very confusing for the user.

Is there anything I can do to stop this kind of unnecessary intrusion? Otherwise, could 1Password please find a programming solution?


1Password Version: 7.2.4
Extension Version: 7.2.4
OS Version: OS X 10.14.2
Sync Type: Dropbox

Comments

  • Lars
    Lars
    1Password Alumni
    Options

    @jerryplotnick - sorry for the trouble. We don't recommend people use browser-based password managers in conjunction with 1Password. In fact, it's one of the steps we recommend after installing 1Password -- turning off your built-in browser password managers, for exactly these reasons. I can't say what may have been going on in your specific situation, but since this isn't a recommended use for 1Password, I don't think we'll be spending any time trying to come up with a code-based solution for it.

  • jerryplotnick
    jerryplotnick
    Community Member
    Options

    Thanks for the prompt response, but let me add that this actually is not about mutually incompatible and potentially conflicting password managers. If I enter the user name and password for the site manually with no intervention from Keychain Access, 1Password will interrupt what should be a straightforward login with the same intrusive and unnecessary prompts. Surely, it isn't a challenging programming problem for AgileBits to recognize that a user has tried to key in the username and password currently stored in 1Password and accordingly not interrupt the user's workflow with suggestions that have no added value to the user—no gain, only pain.

    I should add that I paid a significant premium to upgrade from the last version of 1Password to the current, and the this new glitch decidedly makes for a degraded experience. Longstanding and loyal users deserve a better experience and more of an effort from the 1Password team. This isn't the responsiveness that I remember from 1Password several years ago when I encountered some issues as a new user.

    Finally, I should point out that Apple has been very accommodating in allowing users to take advantage of more than one password manager, at least in iOS. What is wrong with users relying sometimes on Keychain and sometimes on 1Password—whatever is easiest and fastest? I have been doing this for years and hope to be able to continue to do so. The only apparent conflict that I have ever had is the one I just reported. And, again, it isn't really a conflict at all. Keychain simply fills in the fields, and then I log in. The problem would still be occurring if I disabled Keychain altogether.

    Why not work for the best and most flexible experience for your users rather that saying to them use us and nobody else or don't use us at all? Faced with such an ultimatum, some users might end up opting for Keychain, especially as it improves.This would be too bad all around, both for you and your users. In short, I hope you will reconsider. At the very least, please run this thread by your colleagues, and see what they think.

  • AGAlumB
    AGAlumB
    1Password Alumni
    Options

    Thanks for the prompt response, but let me add that this actually is not about mutually incompatible and potentially conflicting password managers. If I enter the user name and password for the site manually with no intervention from Keychain Access, 1Password will interrupt what should be a straightforward login with the same intrusive and unnecessary prompts. Surely, it isn't a challenging programming problem for AgileBits to recognize that a user has tried to key in the username and password currently stored in 1Password and accordingly not interrupt the user's workflow with suggestions that have no added value to the user—no gain, only pain.

    @jerryplotnick: If 1Password is locked, your data is encrypted, and it may not be able to determine if you already have those login credentials saved in it. If you are having the issue when you have unlocked 1Password first, let me know a specific example, including the URL and browser version involved. I'll be happy to look into it.

    I should add that I paid a significant premium to upgrade from the last version of 1Password to the current, and the this new glitch decidedly makes for a degraded experience. Longstanding and loyal users deserve a better experience and more of an effort from the 1Password team. This isn't the responsiveness that I remember from 1Password several years ago when I encountered some issues as a new user.

    Lars responded to you within a matter of a few hours. Certainly we'd all prefer even quicker service, and we'll continue to strive to improve, but I'm not sure I can agree with your assessment in this case.

    Finally, I should point out that Apple has been very accommodating in allowing users to take advantage of more than one password manager, at least in iOS. What is wrong with users relying sometimes on Keychain and sometimes on 1Password—whatever is easiest and fastest? I have been doing this for years and hope to be able to continue to do so. The only apparent conflict that I have ever had is the one I just reported. And, again, it isn't really a conflict at all. Keychain simply fills in the fields, and then I log in. The problem would still be occurring if I disabled Keychain altogether.

    You may be right, but that isn't clear or evident from your comments, and our experience has proven otherwise, at least in the vast majority of cases. :)

    iCloud Keychain is great, but I'll tell you what's wrong with it in this context. While Apple has continued to improve it for those that use it, they're generally (understandably) not designing it to accommodate other password managers. It's also not cross-platform friendly, incredibly difficult to get data out of (there is no export facility), and it is incredibly challenging for many users to figure out where they have what saved -- in iCloud, 1Password, their browser, etc. Not to mention technical glitches that can happen when more than one are competing. So we do recommend disabling things other than 1Password. You don't have to, but generally that can help avoid issues. I'm guessing you've never tried to get data out of iCloud Keychain. Now that is pain! :lol:

    Why not work for the best and most flexible experience for your users rather that saying to them use us and nobody else or don't use us at all? Faced with such an ultimatum, some users might end up opting for Keychain, especially as it improves.This would be too bad all around, both for you and your users. In short, I hope you will reconsider. At the very least, please run this thread by your colleagues, and see what they think.

    Please see above for an explanation, and no ultimatums. You mentioned having "pain" though, and this is a recommendation that helps many people avoid that. That's all. :)

  • jerryplotnick
    jerryplotnick
    Community Member
    Options

    @jerryplotnick: If 1Password is locked, your data is encrypted, and it may not be able to determine if you already have those login credentials saved in it. If you are having the issue when you have unlocked 1Password first, let me know a specific example, including the URL and browser version involved. I'll be happy to look into it.

    Thanks for the explanation. This helps me understand better why the problem is occurring, but it also suggests what I believe to be a decent solution, and I hope you agree.

    Here's what happens now. When 1Password sees me enter credentials on a website, it now wants to see if this is a new set of credentials and to add or update those credentials if they are new or if they differ from the current credentials stored in 1Password. If I haven't yet unlocked 1Password, it can't determine that right off. So it asks me to unlock. Fair enough. But the problem is that after I have unlocked, 1Password should be able to determine if I already have those login credentials saved and not prompt me if indeed there is no change. Right now it is prompting me despite the fact that the credentials I typed into the browser are identical to those stored in 1Password.

    So this looks to be a problem in the programming logic, and if so, the problem should be quite solvable. Just get the code to check—of course after I have authenticated—whether what I keyed in is the same as what 1Password has stored. If so, don't prompt me to update login credentials or create a new login. Though I don't know the lower level implementation details around encryption, it seems clear to me that 1Password must have access to the credentials I typed in before I unlocked 1Password, or it wouldn't be able to update my credentials or create a new login.

    Let me know if there's an error in my reasoning.

    Another approach to the problem would be to keep 1Password out of the picture entirely unless I deliberately invoke it. I believe that is what 1Password did before the last major upgrade. In any event, the problem I am reporting seems to me entirely new to the latest upgrade. I would vote for this latter approach—don't involve 1Password unless the user expressly invokes it. At the same time, I can see that there is something to be said for having 1Password always check for new credentials when someone logs into a website. So if you can solve the problem of 1Password's unnecessarily asking whether you want to create a new login or update an existing one—and I believe you can— I wouldn't terribly mind being prompted to unlock 1Password when I first log into any website even without having invoked 1Password.

    What I do hope you and your colleagues recognize is that to be asked to create or change a login on 1Password is extremely confusing for users after one has just typed in what one believes to be the correct credentials. One inevitably thinks: Did I make a mistake in the credentials I just used? But then why did I get logged in? Did 1Password lose some of my data? And one loses time for no good reason. This kind of persistent glitch isn't what one would expect from as sophisticated and polished a program as 1Password.

    Lars responded to you within a matter of a few hours. Certainly we'd all prefer even quicker service, and we'll continue to strive to improve, but I'm not sure I can agree with your assessment in this case.

    Sorry if I was unclear. I wasn't talking about how long it took Lars to respond. I began my message as follows: "Thanks for the prompt response," and I meant that un-ironically. By unresponsive, I meant an apparent unwillingness on the part of Lars to see things from the perspective of a frustrated user and to take the time to think abut possible solutions. I did feel that his response was dismissive: if you use another password manager in conjunction with ours, you can expect to have problems. In fact, as I have explained, the assumption that the other password manager was causing the problem was erroneous. I do believe that the problem here is with 1Password's implementation. Lars should, I think, have taken the time to at least consider the possibility that 1Password could address the problem to everybody's satisfaction without compromising its feature set.

    iCloud Keychain is great, but I'll tell you what's wrong with it in this context. While Apple has continued to improve it for those that use it, they're generally (understandably) not designing it to accommodate other password managers. It's also not cross-platform friendly, incredibly difficult to get data out of (there is no export facility), and it is incredibly challenging for many users to figure out where they have what saved -- in iCloud, 1Password, their browser, etc. Not to mention technical glitches that can happen when more than one are competing. So we do recommend disabling things other than 1Password. You don't have to, but generally that can help avoid issues. I'm guessing you've never tried to get data out of iCloud Keychain. Now that is pain!

    You don't have to convince me that there are problems with iCloud Keychain and that 1Password is far superior. I agree! And you may be right that there are compatibility issues. I just haven't noticed them myself. When I do, and if the issues are serious, I will be open to the idea of disabling Keychain—but only within Safari. There are some cases in which I simply cannot do without Keychain—e.g., connecting to a server in finder and then authenticating with that server. But the fact is that in small ways, Keychain is simply faster and more convenient, and I would like to take advantage of those small shortcuts when I can. I know you aren't asking me to stop doing that (I'm a free agent, after all), but Lars came very close. In any case, I think it would be better if both platforms tried to work toward the goal of compatibility. It may be that Apple has done the opposite on OS. I don't think the same can be said anymore about iOS, but then again, you will have a much wider perspective as a developer than I possibly could as a user.

  • Lars
    Lars
    1Password Alumni
    edited January 2019
    Options

    @jerryplotnick - I'm sorry my answer seemed dismissive. You're definitely right that 1Password should, once unlocked, be able to distinguish between new information that it needs to offer to save and existing information that it can (and should) let pass because it matches an item already in the database. And in every case we're aware of but this specific one, that's precisely how 1Password does behave. As it turns out, there is a bug filed for this already, which I wasn't aware of. I'd also never experienced this issue myself because I just don't ever open my Mac and begin using it without unlocking 1Password pretty early in that process (more on that in a moment). That's why I recommended (and why we mention in our formal documentation) that users disable browser-based password managers: because there frequently are conflicts and/or user confusion about what is saved where or by which mechanism, etc.

    Anyway, it's something we're looking to address. So even though it was already on our radar screen, thanks for bringing it to our attention -- we appreciate when users notice something they think isn't quite right about 1Password -- sometimes, we haven't discovered it yet.

    In this particular case, though, this issue happens only under very specific conditions, namely:

    1. 1Password must be running, but never have been unlocked at all since being launched.
    2. User must employ a means other than 1Password (either manual entry or another password manager) to enter data into a login page on the web.

    In such a case, 1Password does indeed perform as you described -- and it shouldn't. As I said above, this item is on our developers' radar screen currently, but I don't have any information to share with you regarding when a fix might be forthcoming, and it's important to explain why that is: first, because the only way for a user to even discover this is by launching 1Password at startup or login to their Mac user account, but not unlocking 1Password, and then manually entering login credentials into a login page. Then (and only then), this will happen a single time until the end of that "session" (either when the user quits 1Password 7 Completely by typing ^⌥⌘Q (or just holding down the Control and Option keys as they choose Quit from the 1Password menu -- simply closing the main window or using ⌘Q will not do it), or when (s)he signs out completely or restarts the Mac). Under every other condition - including unlocking 1Password even once - the conditions for this bug are not present and thus the user won't experience it. If you leave your Mac long enough to trigger a 1Password auto-lock but are still signed into your user account on your Mac, you won't see this when you return, for example.

    Obviously, if you've noticed it, then the subset of our users who are affected by this isn't zero...but it's sufficiently uncommon that I wasn't even aware of it, and it's also sufficiently easily worked around that higher-priority items are taking precedence for our developers' time currently, which is why I say we don't have anything to announce regarding this issue at present. My suggestions until we're able to address this more systematically would be:

    1. Turn off Safari's built-in password manager
    2. Unlock 1Password when you start your Mac or sign into your user account.
    3. If this should inadvertently happen anyway, click "Cancel." Once you've unlocked 1Password, you won't see this again until you've quit entirely or signed out of your user account.

    Sorry for the confusion, and thanks for mentioning it to us. :)

    ref: apple-2538

This discussion has been closed.