Displayed Password != Copied Password

m33x

Hi,

I have reported this issue before here.

Today, I encountered it again. It is related to "old" entries (this is an entry from 2014).

1. Password A is displayed when pressing "Reveal"
2. A different Password B is copied when pressing "Copy"

This is imho, an extremely concerning bug and causes some serious trust issues for me.

{
  "overview": {
    "pbe": 164.8307647705078,
    "ps": 100,
    "title": "TimeMachine encryption PW",
    "pgrng": true,
    "ainfo": "2014-03-04 05:30 PM"
  },
  "details": {
    "password": "Password A", <-- This is shown
    "passwordHistory": [
      {
        "value": "Password C",
        "time": 1399194882
      },
      {
        "value": "Password C",
        "time": 1399360237
      },
      {
        "value": "Password B", <-- This is copied
        "time": 1530522821
      }
    ],
    "notesPlain": "",
    "fields": [
      {
        "value": "Password B", <-- This is copied
        "name": "password",
        "designation": "password",
        "type": "P",
        "id": ""
      }
    ],
    "sections": [
      {
        "title": "Related Items",
        "name": "linked items"
      },
      {
        "title": "",
        "name": "Section_94525332CEE242FAB38FFA7B4CA2BD12",
        "fields": [
          {
            "k": "string",
            "n": "4B4C3552F8EB4550820E89261D714533",
            "v": "Mac OS Extended (Case-sensitive, Journaled)",
            "t": ""
          },
          {
            "k": "string",
            "n": "2187BBBB43FB40CF8C568187FDEE3B4A",
            "v": "Backups.backupdb -> iMac",
            "t": "Encrypted Sparsebundle"
          }
        ]
      }
    ]
  },
  "createdAt": "2014-03-04T16:30:33Z",
  "updatedAt": "2023-11-22T13:07:18Z",
  "faveIndex": 0,
  "trashed": "N",
  "templateUuid": "005",
  "uuid": "oq6e6q4x3dkm6hnvmvdo5fc5yi"
}

---

1Password Version: 8.10.20
Extension Version: 2.18.0
OS Version: macOS 14.1.1
Browser: Chrome 119

Dave_1P

Hello @m33x! 👋

Thank you for following up and for reporting the issue. I've imported the item JSON that you provided and, using your item, I was able to reproduce the issue on my end as well. The issue can be reproduced even if all of the entries in "password history" are removed from the item so my hunch is that the value of the "Auto-Saved Web Details" password field is being copied to the clipboard because the item's JSON is malformed in some way:

That being said, I'm unable to create a new item with this same issue. So that I can better understand the situation can you please tell me the following:

1. Are you able to tell me which specific version of 1Password you used to create the item?
2. Did you manually edit the "Auto-Saved Web Details" at some point? Or was this saved automatically by an extension in the past? Do you remember when this field was saved?
3. What version of 1Password did you use to change the password?
4. How many items do you have that are affected by this issue?

I look forward to hearing from you.

-Dave

m33x

Hi Dave,

the only two items in my 716 items vault are the following:

1) No I'm not able, in the past I used 1Password for Mac, Windows, iPhone, and iPad. As TimeMachine and iTunes refers to Apple, I would assume that I initially created them on macOS.
2) It's passwords, not "Logins" so no Auto-Saved Web Details
3) No idea
4) 2 items, both "Password" entries

Dave_1P

@m33x

Thank you for those additional details. While I can reproduce the issue using the item JSON that you provided, I haven't been able to create a new item with the same behaviour. I'm also not seeing any other reports of this specific behaviour from other customers.

That being said, I agree that this is something that 1Password should handle differently either by rendering the item correctly or showing an error message letting you know that the item is malformed in some way. I've filed an internal issue with our development team so that they can investigate further.

For the time being, since I'm not sure when or if a fix will be implemented, I recommend that you replace the malformed items. Create a new Login item and manually enter the right information into that item before saving it. Then, once you've verified that the new item has the information needed, delete the old item.

Let me know if you have any questions.

-Dave

ref: dev/core/core#26723

m33x

Thanks for filing this. I also assume this to be a rare bug caused by some very old version of 1Password for Mac that no longer exists. Anyhow, thanks 😊

Dave_1P

Thank you again for reporting the issue. 🙂

-Dave