How safe is the safari extension?

Beloany
Beloany
Community Member
in 1Password in the Browser

Allowing the extension in Safari to use all websites says this is not safe. This setting would allow the extension to read/write/view total all browser history
"Allowing other websites permits this extension to read and alter every webpage you visit, and see all your browsing history."

Im not sure I want to agree to this however I want the 1Password to work on all websites.
Is there any other way to autofill websites?

Also the instructions to get the extension version is outdated and does not work in Safari 16.1

1Password Version: 8
Extension Version: ?
OS Version: Mac OS 12.6.1
Browser:_ Safari
Referrer: forum-search:How safe is the safari extension allow all websites

Comments

  • Joy_1P
    Joy_1P
    1Password Alumni

    Hey @Beloany,

    Since 1Password for Safari is a "web extension", it need user permissions to be able to function within the browser. Our requirement to "allow access to all sites" achieves two things:

    • The ability to scan (read) the page HTML to determine if it's fillable. This also tells us where/when to inject the inline menu.

    • The ability to autofill (write) to the site. While performing an autofill, it effectively changes the HTML. When you submit the autofill, it will allow you to authenticate it properly.

    Providing permission for 1Password to do these things is not bad at all. In fact, without these permissions, the 1Password for Safari would not work.

    The new 1Password for Safari extension is built to be a standalone tool, making it quite different from the old companion extension in Safari which was dependent on the app. That said, the old built in extension in Safari also required the same exact permissions to save and fill. It just had a different way of displaying and asking for those permissions: https://share.cleanshot.com/XLBgsc.

    As far as security goes, I do want to emphasize that we are unable to access your passwords or anything else you have saved in 1Password. All your data is encrypted and we do not have the keys to decrypt it. I'll link some important articles about our security model and browser permissions below:

    About 1Password's Security Model: https://support.1password.com/1password-security/

    About 1Password Browser Permissions: https://support.1password.com/browser-permissions/

    I strongly recommend giving 1Password for Safari the necessary permissions to save and fill on your sites. Let us know if you have any other questions.

This discussion has been closed.