Work and Personal accounts
There are a few different questions/answers similar to this, but I THINK my request is slightly more specific:
I have a work computer, and of course many personal computers and devices. Ideally, I'd like to have a vault for work passwords and one for personal, with the personal passwords not on the work machine.
HOWEVER: I know that my (government-owned) work machine has keystroke logging, among other nasties. Therefore, it's paramount that none of the authentication material be shared from the personal "vault" (probably account?) to the work one. For instance, I don't want to use the same master password or secret key for the data stored on my work machine, as that effectively compromises my personal data for a whole class of people.
As far as I'm aware, "vaults" don't segregate key material in any way, much less in all ways. I think my options are:
a) have two individual accounts
b) (maybe) get a "family" account, and set up two logins that way.
So my questions are:
1) is there any way to do this with a single account in a way that's completely secure (no shared key material) or even at all secure (some, but not all key material shared)
2) if I do upgrade to a family account, are the (5) logins in the "family" completely segregated as far as secret key and master password, or do they share a secret key?
3) How does vault sharing actually work, from a security standpoint? What key opens one vault but not another?
1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided
Comments
-
@alexw10 - excellent questions! I'm not sure what you mean by "segregate key material," but if your employer is the government and you're certain they place keylogging software on your "work" computer, then yes, I'd never access any of my personal accounts from that machine -- or at the very least, only those about which I truly didn't care, which would be very few. Most of us have at least one personal device (even if only a phone) with us at nearly all times, so unless your job is inside a secure facility where you're also required not to bring personal computing devices, I'd say you could do most if not all of the things you'd want to do from a personal-life standpoint without ever having to think about doing them on your "work" computer.
The other portion of the solution would be, as you suspected, to have two accounts. Does your employer pay for 1Password for you, in the form of a 1Password Teams or 1Password Business account to which you belong? If so, use that one only at work, and sign into only the "personal" one from your other devices. I assume, based on your description of how tight the control is over what you do with work devices and data, that whatever branch of the government you work for would not want you keeping "work" passwords on a home setup, no matter how you kept them (from an unencrypted text file/spreadsheet to 1Password or other password manager).
If your employer does not provide you with a 1Password Teams or 1Password Business membership, and it would be an individual account which you would be paying for personally, just to keep things organized and secure at work, I'd make sure they allow you to do so before subscribing.
If it's just you, I'm not sure what extra benefit a 1Password Families account would do you? Obviously, if there are other family members, then of course it's a great idea (and value!) -- but I don't see the extra benefit if it's just you.
If your employer doesn't provide any secure way for you to store your Passwords, Logins and other sensitive information, I'd recommend urging them to get in contact with us at sales@1password.com.
Hope that helps, but feel free to ask any clarifying questions if I didn't hit all the points you wanted covered.
0 -
To be clear, it's not THAT strict a situation. It's just, knowably insecure from a personal perspective. The reason for sharing is that there's a large class of passwords I'd like to have both places. For instance, the timecard is kept online. Typically that's accessed from the work computer, but sometimes it needs to be accessed from my personal phone or laptop. And then there are things like forum accounts and whatnot that are useful in the course of a professional day, and I'm fine with those low-security things being "compromised" (since, in practical terms, that isn't a threat of any sort).
When I say "segregate key material" what I mean is that a vault is encrypted twice, once by the secret key and once again by my master password. I'm not sure this is precisely how 1pw works, but something along the lines of, secret key lets agilebits control access to authorized parties while the vault is stored on the server, then master password prevents agilebits from being able to view the vault contents despite possessing that data and the secret key.
What I can't have is either of those two bits shared between the "work" data and the "personal" data, since I want to enter neither of them on the work machine.
Two accounts seems like the cleanest way to do this. (But, wait... can two personal accounts share vaults? Or do they HAVE to be in the same "teams" or "family" group?) I proposed a family account since it'd be cheaper and probably more organized.
0 -
Sharing can only happen between two or more accounts within the same membership. It wouldn't be possible for me to share an item from my individual membership to you using your individual membership. Essentially this means that individual memberships don't support sharing at all.
When I say "segregate key material" what I mean is that a vault is encrypted twice, once by the secret key and once again by my master password. I'm not sure this is precisely how 1pw works, but something along the lines of, secret key lets agilebits control access to authorized parties while the vault is stored on the server, then master password prevents agilebits from being able to view the vault contents despite possessing that data and the secret key.
It doesn't work quite like that. If you're interested in the technical details our security design white paper explains:
1Password Security Design White Paper
Two accounts seems like the cleanest way to do this.
I tend to agree, though I'm not sure it is going to enable you to do what you're looking to do.
Ben
0 -
2) if I do upgrade to a family account, are the (5) logins in the "family" completely segregated as far as secret key and master password, or do they share a secret key?
@alexw10: I'm not sure it's what you're looking for, but since I didn't see it mentioned here I thought I'd bring it up: some people use a guest account (as part of a family, team, or business membership) to keep things separated, both logically and cryptographically.
Guests have entirely separate account credentials and access only to a single vault shared with them. So some people use those to keep work stuff both accessible to their main (non-guest) account while also ensuring that using the guest account at work, on company devices, in no way impacts anything else. Something to consider.
0 -
@alexw10: Excellent! In case it helps, 1Password's security is the same, enforced by encryption, regardless of account/member type: whether you're using a "regular" member account or guest account as part of 1Password Families, Teams, Business, etc., you'll only have the encryption keys to vaults that have been shared with your account. It's not obvious because all of this is done behind the scenes as part of the invitation/signup process, but you're essentially giving and receiving public keys as needed under the hood to facilitate all of this. So a "regular" or guest account will be cryptographically separate from the others, and either would work for this purpose. I just suggested a guest because it doesn't take up one of your "regular" slots, and if only a single vault is needed that covers it. Cheers! :)
0 -
You're very welcome! :) :+1:
0
