How to prepare for lost password

Welcome to the forum, @matbb! Good for you, for thinking proactively about your own data security. "Data Security" doesn't just mean having good encryption (we take care of those details in 1Password itself), or even choosing a good Master Password. It means those things, but it also very definitely means thinking about potential ways loss could occur other than hacking/theft.

The best way to make sure your data will always be available to you, even in a worst-case situation, is a 1password.com membership/account. Up until we launched 1Password accounts, the way to use 1Password was what we refer to now as "standalone": you purchase a license for the app, and you create your own data locally, on your own device. But what -- as you said -- if that device is stolen (or perhaps you make an ill-advised dive into the pool without remembering it's in your pocket)? If your 1Password data resides only on your phone, you're in trouble. Same if you forget your Master Password: we never have the encryption keys to decrypt your data, nor the secret (your Master Password) with which to derive those keys. So if you forget your Master Password, your data is unrecoverable -- and that could be anywhere from inconvenient to a true disaster for many users.

If you have multiple users in a household (or even business) who use 1Password, you can open a 1Password Families account or 1Password Business account (depending on what's appropriate), and then, if any member of the account forgets his/her Master Password, an Administrator (or Family Organizer) can recover their account -- all without having to disclose your data or your Master Password. And because 1password.com account data is stored on our servers in encrypted form, if you lose the local copy in your device to fire or theft or whatever, it's not a problem: as soon as you get a new device, just sign in with your Master Password and Secret Key, and your data appears (nearly) instantly.

In 1Password accounts, we also provide the user something called an Emergency Kit -- which is a way to save or print the details of your sign-in (including a space to write your Master Password), so you can make sure you're never without your sign-in credentials. Keep it in a floor-safe or a safety deposit box or with a trusted attorney.

And would it be un-secure to write my master password on a secure note inside 1password? so I can unlock it with face ID to find it?

Not at all. Or at least, no less secure than 1Password usually is -- which is very secure. If you write your Master Password in a Secure Note for example, someone would need to access your data in order to get to it -- which would mean they'd already have all your other data by that point, if they were able to do that, so finding a Secure Note with your Master Password wouldn't provide them any meaningful additional benefit.

If you decide you don't want to go the 1Password account route, I'd strongly recommend a multi-layered backup approach, so you never lose your data. The 1Password for Mac app itself makes daily backups (presuming it's opened at least once a day), in your Library folder on your Mac -- but these will be lost if your Mac is lost/stolen. I'd recommend making local Time Machine or other bootable backups of your hard drive, as well as perhaps looking into an offsite backup solution such as Backblaze or Crashplan or similar. With a 1Password account, this is taken care of for you, but with standalone 1Password, you're on your own to make sure backups are available in multiple locations.

the help pages tell you to make a backup from your phone as long as face ID still works on the phone. I tried, but I have not been able to find the backup anywhere.

It's not designed to be available through iOS' file system, but it's there. If you visit Settings > Advanced and tap "Create Backup," a backup of the current state of your data will be created, and unless you delete 1Password for iOS entirely, it will be able to be restored-from. But if you want it available elsewhere besides your iOS device, you'll need to make a device backup using iTunes (or Finder, in the upcoming macOS 10.15 ("Catalina")).

@matbb

I'd argue that an Emergency Kit is not all that you're getting. :) There are a ton of benefits:

About 1Password membership

so you are saying that with the backup of my 1password file and my master password, I should be able to open this backup? in any computer? if I buy a new computer, place there the backup file from 1password, and open it with my masterpassword, it would work?

It is really tough to make sweeping statements about the certainty of what will be possible in the future, especially when it comes to rapidly evolving technology. There are a lot of variables involved. But I would say, generally, yes: that should work. Where you might run into difficulty is in a scenario (e.g.) where both of these statements are true:

1. We release a new version of 1Password that uses a different format for backups, and cannot read the older backups
2. Your new computer is using a new version of macOS that isn't capable of running the version of 1Password that created the backup file that you have

or we've completely disappeared off the face of the planet, and you have no way of obtaining a copy of 1Password.

Fortunately, even in such an event, it would be possible to read the backup, it might just take a fair amount of work. Our data formats are public knowledge, so anyone can write software to read them. We don't ever recommend entering your Master Password into anything that isn't 1Password, but in the scenario outlined above you may have to resort to such measures.

You have secrets; we don’t, why our data format is public

I'm talking worst case scenario here. Again, generally, I would not imagine this would be a problem. I just don't want to run into a situation where due to unforeseen circumstances this doesn't go exactly as expected, and we didn't mention that would be a possibility. Does that make sense?

Ben

@matbb - no. If your parents are careless with their credentials (Secret Key and Master Password) for their own 1Password account(s), then their accounts might be vulnerable. But yours would not be, directly. In order to be able to affect your account, your parent(s) - or an attacker who'd discovered their 1Password credentials - would have to be set up as a Family Organizer.

Family Organizers in a 1Password Families account are like Administrators: they can remove other people from the account, even delete the entire account or stop billing/payment. But regular family members can't do these things, so even if one of your parents' accounts were to be compromised due to poor security practices such as leaving credentials lying around in plain view, though their own account would be vulnerable, yours wouldn't be.

If your parents are "notoriously not very secure," the first thing I would do is urge them to try being a bit more secure by committing their Master Password to memory and keeping any written-down or printed-out copies of the Master Password in a safe place such as with a trusted attorney or in a safety deposit box. In fact, that's what the Emergency Kit of a 1Password is for: a place for you to keep a "hard copy" of your Secret Key, and a space to write down your Master Password. All of you in your 1Password Families account should save your Emergency Kits individually and securely.

I'd also make sure not to make either of your parents Family Organizers until/unless the time comes when you've got greater confidence in their security practices. If there's another user whose security you have more confidence is, I'd consider making that person a Family Organizer instead.

On behalf of Ben and Lars, you are very welcome @matbb!

If you have any other questions, please feel free to reach out anytime.

Have a wonderful day :)

Hi @matbb

Is your intention to use 1Password Families, or Dropbox?

Ben

Both Dropbox and 1Password Families are ways in which your 1Password data can be synced. They are mutually exclusive (i.e. you can't use them both). If you want to use 1Password Families then sign into your 1Password membership using the instructions on this page:

Get the 1Password apps

(you can skip the bits about downloading / installing 1Password if you've already done that)

Once you've signed in, if all of your data is visible to you in the Personal vault, delete all other vaults:
https://support.1password.com/migrate-1password-account/#set-up-your-other-devices
(Primary must be the last one deleted)

I hope that helps. Should you have any other questions or concerns, please feel free to ask.

Ben

@matbb - on behalf of Ben and myself, you're quite welcome. Glad you got everything working. :)

@matbb:

How do I use my family now to keep my secrete key? Do I go to the shared vault and keep my secrete key inside a note there?

Yes, you could put a copy of your Emergency Kit in your Shared vault, if you don't have a safe place to store the printed copy of the document.

Because from what I understand, I would have to remember the Authy password for sure, or I may risk not been able to get back into my account?

Yes, if you decide to activate Two-Factor Authentication for your 1Password account, you need to make sure you are able to generate your access codes, or else you won't be able to login to new devices. We can help you with this (after a verification process) should you lose your authenticator, but it's much quicker if you always have access to it.