Unexpected network connections [was "Disabling Safari extension doesn't work as expected"]
When the Safari extension is disabled, it continues to activate Safari extension helper and initiate uncommanded network access. How can I put an end to this?
1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided
Comments
-
Hi @caribbeachbum! Welcome to the forum!
After disabling the 1Password browser extension in Safari, did you leave the option Always keep 1Password Extension Helper running enabled under 1Password Preferences > Browsers tab?
Note that by doing this, the 1Password extension will not work in any browser, not just Safari.
0 -
Hi ag_ana, thanks for the welcome. Yes, I did indeed go into the prefs and make sure that Always Keep 1Password Extension Helper Running was turned off. I think that was the second thing I did after installing the software. (The first would have been to terminate the menu bar item and associated process.)
0 -
Can you please try quitting 1Password completely (right-click on 1Password mini in the menu bar at the top right of your screen > Quit 1Password Completely), and then relaunch 1Password? Do you still see the same behavior?
0 -
I don't run mini. As I noted in my previous post, getting rid of the menu bar item and associated process were among the first things I did.
I have removed the browser extension and discovered that it is not actually the problem.
The issue is that the 1Password application does not quit as expected. In choosing File/Quit within the application, the expected behavior is that the application will terminate.
The actual behavior is that some process remains active and repeatedly initiates uncommanded network access (via nsurlsessiond). Specially, it's making repeated network connections with 1Password.com and with b5dev.com.
No 1Password or Agile item appears in Activity Monitor
No 1Password or Agile item appears in the process list (ps -Ain terminal)
No 1Password or Agile item appears in the launchd items (launchctl listin terminal)And -- again -- the menu bar item is not running, nor is the extension helper.
0 -
Should I create a new topic for this? The original title doesn't really apply now...
0 -
The issue is that the 1Password application does not quit as expected. In choosing File/Quit within the application, the expected behavior is that the application will terminate.
I see. That is not our expectation. To quit 1Password completely please use
⌘⌥⌃Q(Command Option Control Q). Otherwise it will continue to run in the background (intentionally) so that it can sync your data.Ben
0 -
"it will continue to run in the background "
Are you referring to the 1password extension helper? Because I have that set to not keep running. Likewise the mini application is not allowed to keep running.
0 -
1Password itself continues to run once launched unless quit completely using the keyboard shortcut mentioned above or associated menu item.
Ben
0 -
Under what identity? It does not appear in Activity Monitor, nor in the underlying BSD process list (
PS -Ain terminal app).0 -
1Password 7is what shows up on my system. If you're using grep to look for it, are you capitalizing theP?
Ben
0 -
In speaking with one of my colleagues about this case I was reminded that it is possible to change the keyboard shortcuts to make what you are trying to accomplish easier. I understanding having to remember to quit 1Password completely with a long keyboard shortcut is less than ideal. :) You may want to swap the quit shortcut with the quit completely one, so that ⌘Q works as you're wanting it to.
You can find this setting in System Preferences > Keyboard > Shortcuts > App Shortcuts. From there, click the "+" button to add a new shortcut, and then replicate what you see in the screenshot. If you have any trouble with that please let me know and I'll be happy to help. :)
Ben
0 -
I can confirm that after choosing Quit 1Password from the menu, or typing Cmd+Q, no remnants of 1Password remain running. I suspect that you're referring to a scenario where the MINI part continues to run, but I have disabled that.
I also will note that I have solved the problem I was having. The network activity was a Notification Manager task. Disabling notifications for 1Password put an end to the problem.
0 -
It looks like we may have been writing our replies at the same time. Sorry about that. Thank you for clarifying the situation and outlining what you did to fix it. Hopefully that is helpful to any other customers who might be running into this. I appreciate the update. :)
Ben
0 -
Somehow 1Password is triggering NSURLSession to engage in uncommanded network access on a recurring basis. I cannot figure out how this is happening. I know it's 1Password because of the destination URLs (
1Password.comandB5Dev.com). I thought I knew all the different ways to launch processes, but I seem to be missing at least one. It’s making me crazy … it really is rootkit-like behavior.Here is what I know so far:
• 1Password is not running; nor is the 1Password mini app/menubar item
• I have deleted the 1Password browser extension
• Activity Monitor shows no 1Password or Agile processes running
• No items at all under System Preferences/Users & Groups/[user]/Login Items
•PS -A | grep 1Passreveals no 1Password processes (also grep’d against pass, Pass, and agile and Agile, just in case; also browsed through the list without the pipe-to-grep just to see if I was missing something)
• Usinglaunchctl listin terminal reveals no 1Password/Agile items
• Checkedcrontabfor root and [user], both are blank/do not exist
• Notifications are disabled for 1Password
• Auto-updates are un-checked — not enabled — in 1Password
• No 1Password/Agile items in LaunchAgents, LaunchDaemons, or Startup Items folders in any of the three locations (/Library; /System/Library; /[user]/Library)Also note: I posted this question (worded differently) previously. At first I thought the issue was linked to the browser extension; then I thought it was Notification Manager. Neither seems to be the case. The other discussion is here.
Edit: the forum choked on angle brackets around "user" so I replaced them with square brackets.
1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided0 -
It sounds like you're likely running into this:
Latest installer/update wants to connect to "b5dev" ? [Normal; safe] — 1Password Forum
If so, the connection isn't "coming from" 1Password, but is initiated by macOS itself.
Ben
0 -
No. If this was occurring while I was using the installer, I would have said that. I also would have specified swcd instead of nsurlsessiond.
0 -
Somehow 1Password is triggering NSURLSession to engage in uncommanded network access on a recurring basis. I cannot figure out how this is happening.
Can you please let us know step by step how and where you are seeing this, so we can try to reproduce the behavior? Thank you!
0 -
Starting from a fresh reboot, all is good. Use Firefox, mail, all my software really, and there is no problem. But if I use Safari, the very quickly "something" starts trying to make the previously described network connections via nsurlsessiond. It's very malware-like behavior (though I know the connections are almost certainly OK). It will continue until I reboot.
Edit: This is a quite recent phenomenon. I can't say for certain, since I mostly use Firefox, but I think it's likely that the problem began with the most recent update of 1Password.
0 -
(though I know the connections are almost certainly OK)
Yes, if the connections are to 1Password.com or b5dev.com, they are known and expected connections.
0 -
Well, the "known" part I agree with. They are not expected connections in a scenario where no 1Password processes are running. That is the problem here. I need to understand where these connection attempts are coming from.
0 -
I would like to ask you to generate a diagnostics report from your Mac and email it to us to support+forum@agilebits.com, so we can take a closer look at why this is happening to you.
After you have sent the email, please feel free to post the ticket number you received so we can locate your message and connect it with this forum discussion.
Looking forward to your message!
0
