Confused about Password History

lucasd

I am trying to use Password History to assess the potential risk from a compromised password. I have done some experiments, and it seems that the specific entries in "Password History" sometimes show the date a password was created, and sometimes show the date a password was replaced, without any way of distinguishing between the two. In other words, for a given entry in Password History, it is hard to know whether the date refers to the creation date or the replacement date. It is very confusing. How is it supposed to work? And is there any way to see the underlying data so as to be clear about what the date is referring to?

(Same goes for iOS.)

Thanks in advance.

---

1Password Version: 8.10
Extension Version: 2.8.1
OS Version: Windows 11 22H2
Browser:_ Firefox

lucasd

Actually, it seems that the entries must be referring to the date when the password was replaced. I had done an experiment where the creation date was shown [e.g., the password next to the date was the password that was created at that time], but now the entry seems to have updated itself and seems to consistently be showing the date of replacement [e.g., the password show is that password that was replaced at that time]. Is that correct?

MrC

@lucasd

The Password field has no time stamps, by itself. Only the record has a created and modified date.

But, there is a passwordHistory list, which does store the previous passwords and timestamps. This list is empty when you create a record. When you change a password, the record's modification time is recorded along with the old password. When you do this again, the same thing happens.

The only time when this is not possible, is for the first entry added to the history list, which always gets the date of modification. This image showing the data structures for an initial Login entry, along with two subsequent changes, should help:

lucasd

Thank you MrC for this very enlightening response! Makes perfect sense. (Did you generate those images via a 1PUX JSON export?)

MrC

@lucasd

You're very welcome.

And that is quite astute of you to detect how I captured the data. I use a tool I wrote for this to help me with my converter work (I called it 1pux_tool).

But you can rename a 1PUX export, changing the suffix to .zip and then unzipping. Inside you'll see a text file named export.data. That is the formatted JSON that you see above. My tool just does this automatically, and shows some additional data in a way that is useful to me.

lucasd

Very cool. It is great to know that if I ever really wanted to, I could generate this data in a readable form (although of course it would have to be promptly deleted.) Thanks again.

MrC

@lucasd

One more method for you - if you enable Settings > Advanced > Show debugging tools, you can right click an item, and select Copy item JSON. That's the same JSON essentially that you see above, but even more readable for the createdAt and updatedAt timestamps:

{
  "overview": {
    "title": "Login",
    "ainfo": "user",
    "ps": 8
  },
  "details": {
    "fields": [
      {
        "value": "user",
        "id": "",
        "name": "username",
        "type": "T",
        "designation": "username"
      },
      {
        "value": "pass3",
        "id": "",
        "name": "password",
        "type": "P",
        "designation": "password"
      }
    ],
    "passwordHistory": [
      {
        "value": "pass1",
        "time": 1677802370
      },
      {
        "value": "pass2",
        "time": 1677802641
      }
    ]
  },
  "createdAt": "2023-03-03T00:10:02Z",
  "updatedAt": "2023-03-03T00:17:21Z",
  "faveIndex": 0,
  "trashed": "N",
  "templateUuid": "001",
  "uuid": "aykopr47us6uw3gl4jhrfr6mte"
}

lucasd

Awesome. I had no idea. This is super helpful.