How to protect against compromised iPhone passcode
I am wondering about an unlikely scenario. Let's say I am forced to reveal my iPhone passcode and turnover my iPhone. The unlocked iPhone now has access to all my 1Password stored accounts, and my email accountss allowing the criminal(s) to access my entire life. Seems bad.
How would you mitigate against this threat? I thought about a hardware 2FA key, but I don't want to have to use that every time I need to login to a web site.
I could not store key passwords (e.g. financial accounts) in 1Password, but that sort of defeats the purpose of a password manager.
Anyone else concerned about this?
Thanks.
1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Browser:_ Not Provided
Comments
-
I do think about this a lot but there’s not much to be done if you reveal your passcode. Security models generally exclude the scenario of unprotected device access. That said, 1Password will only unlock if given your biometric or the master password, both of which the attacker wouldn’t have with a stolen phone. Not much they can do with your email accounts except receive reset tokens - here is where a hardware key may come in handy but even then many accounts offer the ability to reset if you lose that key. One thing to recognize is that credit cards will often protect you from financial fraud in these situations so as long as you don’t keep a debit card on your phone, that should be remedied. Also you can use Screen Time to restrict access to account, passcode and mail account changes behind a different passcode - I do this. Given that 1Password is not accessible, my hope is that I can get to a computing device fast enough after the theft to deactivate email accounts on the iPhone after it is stolen.
Outside of that, if you’re in a situation where you’re under threat to life, please go ahead and reveal your passcode. Most fraud of this kind can be remediated, and your life is more precious.
0 -
This is a big vulnerability! They don't need to force you at all. Only observe you type in your passcode, and then steal your phone.
With the basic phone passcode they can see all 1Password passwords, as they show up under iOS settings>Passwords!
This defeats the vault password. If anyone knows how to prevent this, please let us know.
0 -
If you don't set up autofill in the settings app, then you can close that hole in security, I think.
0 -
Does anyone know whether a hardware key with apple 2FA prevents reseting Apple ID with just a trusted device?
0 -
Hi all.
Just wanted to address a couple of points in this thread:
Let's say I am forced to reveal my iPhone passcode and turnover my iPhone. The unlocked iPhone now has access to all my 1Password stored accounts
Your iPhone passcode cannot unlock 1Password. You need your account password or biometrics (Face ID or Touch ID) to unlock it. It's worth mentioning, though, that if you're already in a situation where someone has threatened you to make you reveal one secret (your iPhone passcode), it's quite plausible they'll also want a second (your 1Password account password).
By that point, if someone is that determined, there isn't really anything you can do.
With the basic phone passcode they can see all 1Password passwords, as they show up under iOS settings>Passwords!
Your 1Password items shouldn't be appearing here! If you imported your passwords from iCloud Keychain, but didn't delete them from Keychain afterwards, that may explain it, but 1Password does not put anything in that list.
— Grey
0 -
Your iPhone passcode cannot unlock 1Password. You need your account password or biometrics (Face ID or Touch ID) to unlock it.
I did not realize this. I thought failed Face ID would always allow iPhone passcode to bypass. If you can't get in to 1Password without master password or FaceID, I don't think there is an issue.
As to be forced to reveal, really I think the compromised pass code (e.g. by inadvertently being captured on camera), followed by an iPhone theft, is what is more likely (though not very likely at all).
0 -
Your 1Password items shouldn't be appearing here! If you imported your passwords from iCloud Keychain, but didn't delete them from Keychain afterwards, that may explain it, but 1Password does not put anything in that list.
Ok, I'm not so sure. Even recently created 1pw items appear in the iOS settings>passwords list. I never click on "save password" iOS prompt so it's not that
0 -
1Password isn't able to write to that list, so something else must be going on. Send us an email at
support+forum@1password.comand you'll receive an auto-reply from 🤖 BitBot. It will contain a conversation number, which looks like[#ABC-12345-123]– post that here and I'll be able to make sure your message goes to the right team and we can look into that with you. I look forward to hearing from you. :)0 -
Will do - thanks!
I just noticed there is also about 10 items in iOS settings>passwords that all have the website 1password.com, but each item contains a login for various things like instagram, outlook.com etc. all with the website address 1password.com or my.1password.com
0 -
[#NNP-45619-569]
0 -
It's worth mentioning, though, that if you're already in a situation where someone has threatened you to make you reveal one secret (your iPhone passcode), it's quite plausible they'll also want a second (your 1Password account password). By that point, if someone is that determined, there isn't really anything you can do.
I do think there are features 1Password could offer to reduce vulnerability to this kind of attack or impact of it.
Give us an option to disguise the app icon/name so that it appears as something other than 1Password on the home screen / app list.
Give us a selective sync option for vaults. If this were an option I would put all my most highly sensitive info/passwords (financial accounts / important email accounts) into a vault which I would elect not to sync to my phone.
Give us option to disable secret key access on a per-device basis.
0 -
- Give us an option to disguise the app icon/name so that it appears as something other than 1Password on the home screen / app list.
iOS forbids developers from changing an app's name, so even if the icon was different, you'd still see "1Password" beneath it, especially in the App Library.
- Give us a selective sync option for vaults. If this were an option I would put all my most highly sensitive info/passwords (financial accounts / important email accounts) into a vault which I would elect not to sync to my phone.
Travel Mode might help with this if you're concerned.
- Give us option to disable secret key access on a per-device basis.
Your Secret Key is only used when signing in to a device for the first time, so could you tell me a bit more about what you're suggesting here?
0 -
OK, fair enough.
This doesn't really help as it removes the vault from all my devices. I want access to all my vaults on the devices I only use at home (without having to toggle travel mode every time I leave the house).
Even if I turn on travel mode, someone who has obtained my 1Password password by threat of violence can get to my secret key from stolen mobile device which they can then use to log into 1Password.com and turn off travel mode to access my most sensitive vaults.
What I really want is the ability to control on a per-device basis whether that device has access to specific vaults and whether it has the ability to setup a new device (i.e. whether or not it can reveal the secret key).
0 -
- Give us a selective sync option for vaults. If this were an option I would put all my most highly sensitive info/passwords (financial accounts / important email accounts) into a vault which I would elect not to sync to my phone.
Can the family feature offer help here? Keep sensitive stuff in a Private vault, and login on the phone with a Shared Vault.
This is going off-topic by the way as the OP was about iPhone passcode exploits
0 -
@Rene123 Yes, using up two accounts from a family plan is an option. But I'd really prefer to see selective sync and selective secret key access as an option within individual accounts.
Regarding the original topic (presumably related to recent WSJ article) - when it comes to iOS devices (and Android for that matter) I'm not sure there's anything to say beyond what others have already said. If a thief has obtained your device and device passcode they can access your device but not 1Password. To access 1Password they would also need your 1Password master password or ability to dupe the device biometrics.
However, I think there is an issue on Windows (I don't know about Mac). Turning on ability to unlock 1Password on Windows using biometrics (Windows Hello) seems to bring with it the ability to unlock 1Password with the computer Pin/Passcode/Password. As far as I can tell if you want access via biometrics it doesn't seem possible to exclude access via Windows pin/passcode/password.
0 -
If a thief has my passcode and would have my locked out of all my other devices. Couldn't he just reset face-id on my iPhone, add his on face to face-id and the open my 1Password vault, as I have previously enabled login with face-id in 1Password?
If this is the case, is the only option to prevent it to disable face-id?
0 -
If a thief steals your iPhone's passcode and adds an alternate appearance to Face ID on your iPhone, Face ID will be automatically disabled for 1Password and you will be required to enter your account password to re-enable Face ID the next time that you try to unlock the app. You can read more about this here: About Face ID security in 1Password for iOS
I can see how it would be useful to be able to selectively add or remove vaults from certain devices and I have added your feature request to our internal tracker so our product team can consider it as they are considering new features to add to future versions of 1Password.
At the moment the only way to restrict a vault to only certain devices would be to create a separate "family member" account for yourself in a 1Password Families membership which would only contain that vault and then only add that account to selected devices. It's not an elegant workaround but I'm sharing it in case it helps. 🙂
-Dave
ref: PB-31392749
ref: PB-313927590 -
Thank you for the feedback. 🙂
-Dave
0 -
This is a big vulnerability! ... With the basic phone passcode they can see all 1Password passwords, as they show up under iOS settings>Passwords! ... This defeats the vault password. If anyone knows how to prevent this, please let us know.
I need to issue a correction. # This is no longer a vulnerability, or never was. I deleted all passwords from iOS settings > passwords and they are gone and don't reappear. Staff confirmed that this should never happen as 1pw doesn't write to iOS Settings > passwords.
So even if a thief has my passcode, he still has to break into 1password app, in order to access my passwords.
Thanks for the assistance.
0 -
That's correct. iOS Settings > Passwords is where you'll see passwords that you're storing in iCloud Keychain, not 1Password. 1Password does not, and never has, used iCloud Keychain to store your passwords and other items.
If anyone else sees passwords in that location then I recommend migrating them to 1Password and then removing them from iCloud Keychain: Move your iCloud Passwords from Safari to 1Password
-Dave
0
