Entry "Last Used" Behavior and Possible Bug?

Dan_Aykroyd

Hi there,

I've been wondering for several months now the exact behavior of the last used audit stamp on the macOS client.

I have several, random entries, updating to "Today at " every once in a while; without me doing nothing with them. I assume that the stamp should update when autocompleting from a browser or copying a field; and that's mostly how it goes, but I can't see the exact update happening after carrying one of those actions. I assume you update it after a while, so I've tried to quitting the app completely, reopening and, then, I'll probably see the updates.

What baffles me the most, and makes the field unusable, is the random update I mentioned at the beginning. I don't know why it happens, if it is because I focused on a certain entry for to long (without copying or completing) or why.

Since I'm quite OCD, and I want to have the entries as clean as possible (and truly reflect the time when I really used them last), I'm tiring of duplicating all my entries and deleting the old ones; in order to throw away that stamp (along with all the items history).

Could you please clarify why the entries randomly update? Also, is this timestamp a local-only stored flag or does it sync across clients too? Because I don't see it neither on the web nor mobile (iOS). Just in case, asume that I'm only using the macOS client; i.e., it's not that I copied/autocompleted the entry on iOS and that's where the timestamp is being updated.

Thanks for any clarification you can provide. Best.

---

1Password Version: 7.8
Extension Version: Not Provided
OS Version: macOS Catalina
Sync Type: 1Password Account

ag_ana

Hi @Dan_Aykroyd!

You can find a list of actions that update item timestamps in this post. Let me know if you have any questions!

Dan_Aykroyd

Thanks @ag_ana for your promptly reply. I assume that the closest possible action I could have taken on those entries that randomly updated the last access field was going into edit mode, in order to view some web form details that aren't available on read mode.

I have then only a couple of questions left:

• When is the update on the last used field actually displayed? Because if you do any of those actions you posted, on an entry, and take a look afterwards, it still displays the old "last used" value. Do you update it after reopening the app?
• Do these last used timestamps exist on the server or are only kept locally on each machine? Do they actually sync across clients? Because I haven't seen that field neither on web or iOS available.

Thanks again.

ag_ana

@Dan_Aykroyd:

When is the update on the last used field actually displayed?

It's used in the "Recently used " view list in the favorites tab, for example. It's also displayed in the item details in 1Password for Mac.

Do these last used timestamps exist on the server or are only kept locally on each machine? Do they actually sync across clients?

Yes, they are part of the items, so they are synced. It depends then on the actual 1Password client what to do with them. For example, 1Password for Mac and 1Password for iOS use this: if you autofill an item in 1Password for iOS, and you have 1Password for Mac set to show you items by last used, this item will show up at the top of the list in 1Password for Mac too :+1:

Dan_Aykroyd

Thanks @ag_ana.

Could you please confirm with the team that the last used timestamp really lives on the server too and that it sync across devices? The Last Used field doesn't show up for iOS entries and I just made a test, copied/autofilled something on mobile, waited 10 minutes and quitted 1Password on mac (just in case) and the timestamp there hasn't updated; it still as being last used yesterday.

Thanks.

ag_ana

@Dan_Aykroyd:

Yes, I got confirmation from a developer before I posted my reply :+1:

Dan_Aykroyd

Great!

Then, would you please let me know where can I see the Last Used timestamp on mobile, as you mentioned before that it's there, and why doesn't the timestamp update on macOS (the only place I have that field) after autofilling/copying/editing/etc. on iOS?

ag_ana

@Dan_Aykroyd:

Then, would you please let me know where can I see the Last Used timestamp on mobile, as you mentioned before that it's there,

I don't believe you can see this field in iOS. What I mentioned above is that the field is used to sort items, for example, but I don't believe it's visible there.

why doesn't the timestamp update on macOS (the only place I have that field) after autofilling/copying/editing/etc. on iOS?

Absolutely, I have sent your question to the developers :+1:

mulva

@ag_ana, I have had this same question. Randomly updated "last used" stamps on logins I haven't touched at all (have checked against the list yous showed: https://1password.community/discussion/comment/589697/#Comment_589697). Makes me worried someone has access or something. One login I definitely know I haven't accessed since last year.

ag_ana

@mulva:

You can check the list of authorized devices in your account settings if you suspect your credentials might have been compromised. If you don't see any unknown device there, is it possible you launched the Print dialog once, and forgot about it?

mulva

Hi ag_ana. No... didn't print and just checked devices (all ok). It's random accounts like American Airlines, then an account that I had set up last year with an attorney that I never used afterwards. Can't figure it out and has occasionally happened here and there for I want to say the past couple of years. I haven't bothered to think anything of it because I've never had any issues with my accounts being compromised. I'm only noticing more because I now order the list of logins by "last visited." Do apps or sites that leave cookies affect "last visited" by checking my account or updating cookie information?

ag_ana

@mulva:

Do apps or sites that leave cookies affect "last visited" by checking my account or updating cookie information?

Cookies would not have an effect on 1Password since they are stored in the browser, but using the browser extension while you are on those websites could have an effect (since it lists Logins for a website).

mulva

Hmm, thanks @ag_ana. Okay. For now, I'm just going to keep an eye on things. Change passwords if it happens again. Will check back if this occurs again. Have a good one.

ag_ana

Sounds good @mulva, thank you! :+1:

mulva

ag_ana, so it's still happening. I view 1Password via "All Items" sorted by "Date Last Used." There are logins that are updating as being used recently when I didn't touch or visit them whether on my iPhone or MacBook. There must be something triggering this? Does 1Password comb through to check logins or something? And this is after I changed my Master Password.

ag_ana

@mulva:

The only thing I could think of is Watchtower checks, but it should not be updating the timestamps as far as I know. Can you confirm what sync method you are using?

mulva

Hi ag_ana. So, in case I never mentioned this, the listing of "last used" is different between my iPhone and MacBook. Both show randoms that I never accessed recently.

For Watchtower on the MB, I have all options selected. Once in a blue moon when I go into settings I will manually update Watchtower (that won't be the trigger). Obviously, in iOS you can't even mess with Watchtower as far as I can see.

ag_ana

@mulva:

Perhaps the logs will give us some more information. I would like to ask you to generate a diagnostics report from your Mac and one from your iOS device and email it to us to support+forum@agilebits.com, so we can take a closer look at why this is happening to you.

After you have sent the email, please feel free to post the ticket number you received so we can locate your message and connect it with this forum discussion.

Looking forward to your message!

mulva

Morning @ag_ana I sent both reports in. Got one response. Ticket is #DDB-52728-392.

Thanks!

ag_ana

@mulva:

Thank you! I confirm that I have managed to locate your diagnostics report in our system :+1: I see that my colleagues have replied to you over there already, so I will let you continue the conversation via email.

ref: DDB-52728-392