How can I change a standalone vault password that's not my primary vault?

@duetjohn - in an existing setup, you can't change secondary standalone vaults' passwords, because those vaults' keys are "escrowed" in the Primary vault. So you can change the Primary vault's password (which is also the Master Password for your 1Password for Mac setup), but not the secondaries. If you absolutely must change it, you could sync the secondary vault to a folder located on a USB flash drive, install 1Password for Mac on a different Mac, create a new standalone vault there, sync it with the vault on the USB flash drive, (which would make it the Primary vault on that device), then use that Mac's "change Master Password" feature to change the vault password there, sync it back to the USB flash drive, take the USB flash drive back to the first Mac, and perform a sync again -- that should do it. You might have to remove the vault in the first Mac's install and then re-add it from the sync keychain on the USB flash drive...but it should work.

Needless to say, I don't actually recommend doing the above, since it involves quite a bit of manual fiddling...but without testing it, I think that should work.

@1pwuser31547 - sure, you could do that as well.

Hi @1pwuser31547

Also on this topic let me ask/clarify another question. Even though 2* vault master PWs are escrowed into the 1* vault, a remote attacker (that has access to exported data through malware for example) would still need to know the master password(s) for the 2* vaults to access their data.

I'm having trouble with your usage of 2* and 1* which is not terminology or naming I've ever seen so I may be misunderstanding, so I'll reword to try to explain it from my side with names/terminology I understand. Hopefully it'll make sense for you as well.

How you answer this depends on what an attacker has.

If the attacker has copies of the sync files (generally referred to as a sync store, like an OPVault file), they need the Master Password to access the data of that vault.

If the attacker has a copy of the 1Password local data store (this is a SQLite file stored locally and used by the app directly, it is not synced directly anywhere) then the attacker would have access to the second vault by way of the first. The keys necessary to unlock the secondary vault is encrypted by the primary vault, so having access to the first would grant you access to the secondary vaults.

What about the local backups automatically generated and saved on the device (iMAC)? If an attacker had possession of those files, would knowledge of the 1* vault MP give access to the 2* vaults?

Local backups are the same as the second above. On Mac specifically we zip the local data store folder up and that's the backup.

I ask these questions because I would like to create extremely strong 2* vault passwords, (like 256 bit, equal in strength to the cryptographic keys) while still being able to conveniently unlock my 1 PW native client with my 1* MP that I have already well memorized. My 1* vault MP is strong but not 256 bit strong (or 128 bit for that matter).

You could do this, but that's so severely overkill I wouldn't even recommend it. Just create a unique and strong Master Password that you can remember well enough and that's all you need to do. Going beyond even 20 characters (for say a character password, not a dice ware password) is overkill, too.

Hope that helps a little though.

@1pwuser31547

It'll be in ~/Library/Group Containers/2BUA8C4S2C.com.agilebits/Library/Application Support/1Password/Data

Ben