Feature Request: Touch ID / Face ID - Option for SHORTER period to require account password

YellowVista
YellowVista
Community Member
in iOS

Goal
Basically, what I want is that any time 1Password is not in the foreground, opening 1Password would require either (1) the account password, or (2) Touch ID / Face ID / PIN if it had been recently unlocked and was within the Require Password timeout period.

That is, any time 1Password is not currently active in the foreground, I want either Touch ID / Face ID / PIN or my account password to be required to open 1Password. However, I don't want anyone to be able able to open 1Password and access my data using Touch ID / Face ID / PIN (except during a very short time period after I recently entered my account password), but I also don't want my account password to be required every time I close 1Password and it is running in the background for a few min (e.g., when switching between 1Password and some other application where I need to enter some details from 1Password). (There are plenty of situations where data from 1Password is needed but the Safari extension can't be used.)

Desired User Experience
What I would like is:

  1. I open the 1Password app
  2. It prompts me to enter my account password and then unlocks after I type the password
  3. I close 1Password
  4. If I open 1Password again before the end of the Require Password timeout period, 1Password would require Touch ID / Face ID / PIN before allowing me to use 1Password (because I would have Auto-Lock on Exit set to "Immediately"). If I open 1Password again after the end of the Require Password timeout period, 1Password would require the account password to unlock and could not be unlocked with Touch ID / Face ID / PIN.

Simple Implementation
The easiest way to get to get this functionality would be to simply allow people to pick a period of time shorter than 2 weeks to require the account password when using Touch ID / Face ID / PIN (ideally any period of time between 5 minutes and 2 weeks, plus the existing 30 days and Never options).

The Auto-Lock on Exit option currently displays 9 options: https://imgur.com/a/GGIpawb. I'd like a similar number of options, including a short 5 min option, for the Require Password option when using biometrics (or a PIN). That seems like it should be easy to implement and would be a consistent UI/UX experience for users.

I could then combine a "Require Password" setting of "5 min." with an Auto-Lock on Exit setting of "Immediately", which would mean that any time I close 1Password and re-open it, I would be required to authenticate via Touch ID / Face ID / PIN (or account password). If more than 5 min. had passed since I entered my account password, I would be required to enter my account password again instead of biometrics / PIN.

I'm not sure how 1Password currently handles multiple failed unlocks via Touch ID / Face ID / PIN, but if it isn't already a feature, then I would also like a feature added to require the account password again after multiple (5? 10?) failed unlock attempts via Touch ID / Face ID / PIN. I wouldn't want someone to be able to attempt an unlimited number of unlocks via those alternate methods.

1Password Version: 8.9.7
Extension Version: Not Provided
OS Version: iOS 16.3
Browser:_ Not Provided

Comments

  • Dave_1P
    Dave_1P

    Hello @YellowVista! 👋

    Thank you for the detailed suggestion! I've filed your feedback internally with the product team so that they can consider adding shorter term durations to the "Require password" setting in the future.

    I'm not sure how 1Password currently handles multiple failed unlocks via Touch ID / Face ID / PIN, but if it isn't already a feature, then I would also like a feature added to require the account password again after multiple (5? 10?) failed unlock attempts via Touch ID / Face ID / PIN. I wouldn't want someone to be able to attempt an unlimited number of unlocks via those alternate methods.

    If you're interested, we've published articles that go into the security of Face ID / Touch ID here:

    Biometric unlock on iOS stores an obfuscated secret (equivalent to your account password) in the iOS Keychain which is used to unlock 1Password when your face or fingerprint is recognized. This secret is removed from the iOS Keychain, and biometric unlock for the 1Password app is disabled, when your face/fingerprint isn’t recognized five times in a row.

    I hope that helps! 🙂

    -Dave

    ref: PB-30870328

  • YellowVista
    YellowVista
    Community Member

    @Dave_1P: This secret is removed from the iOS Keychain, and biometric unlock for the 1Password app is disabled, when your face/fingerprint isn’t recognized five times in a row.

    Thanks. I assumed something like that was the case but didn't see that info in the app.

    The About Touch ID security in 1Password for iOS article says that the obfuscated secret is stored in the iOS Keychain in such a way that (1) the secret cannot be restored to a different device, and (2) the secret is not included in iCloud backups. Does that also mean that the secret is not included in backups via iTunes when a backup password is set?

  • Dave_1P
    Dave_1P

    @YellowVista

    Thank you for the reply. The stored secret uses Apple's kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly attribute which you can read about here: kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly | Apple Developer Documentation

    The most relevant information:

    Items with this attribute never migrate to a new device. After a backup is restored to a new device, these items are missing.

    I hope that helps! 🙂

    -Dave

  • YellowVista
    YellowVista
    Community Member

    Thanks @Dave_1P 😀

  • Dave_1P
    Dave_1P

    It's my pleasure. 😊

    -Dave

This discussion has been closed.