Feature request: a separate vault with different access methods within a 1password account.
Hello.
I'm a fan of 1password.
This amazing service changed my digital life, I don't ever need to memorize or go threw password reset cycles all the time thanks to it.
However, having to type my master password and secret key limits my ability to access my 1password items to trusted devices only, since master password and secret key are two top secrets in my digital life.
Because we can't always in front of our trusted devices and sometimes we are forced to use public computers like in work environments, I think it would be a good idea for us to somehow access group of items in our 1password account using alternative password that is completely separate from master password+secret key combination.
Also for creating or updating items in 1password, it would be much better for us to use that alternative password to push new items or update existing items that are flagged to be used with alternative password.
To make it more concise, I'm requesting a feature to access 1password using different credentials that have different permissions, much like AWS access keys where you can generate and use for only specific purpose with restricted set of capabilities.
I think this is also cryptographically possible.
For example, if alice borrows bob's computer to check an email, with current system she have to share her credentials from her phone to bob's computer.
But since all of alice's accounts are locked behind 1password, it would be difficult and time consuming for her.
Further more, if she have to access several accounts and even create a new account on some service, the issue gets more tricky.
But with the new system that I'm suggesting, if alice had made a separate vault with an easy to memorize access key, and put some of her most frequently used credentials in there, she can immediately access her accounts without being interupted or revealing her master password and secret key.
This could be achieved by creating a separate database in alice's account and encrypting copy of items that are specified to be used with that access key, using the access key in question.
Pushing items to main 1password account without master password would be also possible by putting all active access keys in the main account, push items that are encrypted with one of these access keys, and upon receiving an access key encrypted item, the server broadcasts an event to all trusted devices logged in with the same main account to retrieve, decrypt, re-encrypt with the main account master key and push that item to the main account.
This concept is not without downsides however, for example bob can figure out alice's access key and get access to her accounts, but it is much better than the master password and secret key being exposed, and multi factor authentication can come to rescue when such thing happens.
The reason I'm requesting this feature is I'm working in an office and I have to use a lot of my accounts like gmail, github, microsoft etc.
For now, I generate and send password sharing links from my phone to computer, but doing this all of the time is not convenient, and when I use a public computer for the first time because of moving to another office etc, I have to manually type over 16 characters long password that is saved in 1password to the computer.
If I have to create new account, I use a short memorable password and use 1password to change the password of that account once I get back to home.
It can be a slow, insecure process since sometimes I forgot to change passwords.
I would really appreciate if this feature comes to life.
I'm uploading this to 1password for windows forum but this feature can cover entire 1password platform if it gets implemented.
I hope I can securely use 1password truely anywhere.
Thank you in advance.
1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Browser: Not Provided
Comments
-
Hello @sj0123! 👋
Thank you for the request! Are you using 1Password Families? If you are then have you considered creating another "family member" account and using that for work? This would give you a second account that you could use for places that you trust less and don't want to login on your main account. You can learn how to create another family account here: Add and remove family members
The reason I'm requesting this feature is I'm working in an office and I have to use a lot of my accounts like gmail, github, microsoft etc.
All of these websites support passkeys for sign in:
- https://passkeys.directory/details/microsoft-account/
- https://passkeys.directory/details/google/
- https://passkeys.directory/details/git-hub/
One of the cool things about signing in with a passkey saved in 1Password is that you don't need to have 1Password installed on the device that you're signing into. In your example, Alice would borrow Bob's computer and sign in to her Github account by scanning a QR code displayed on Bob's computer screen using her phone which has 1Password installed. 1Password will then sign Alice into Github on Bob's computer without revealing any other information to Bob's computer about her vaults or other items.
It sounds like passkeys might be a good solution to the use case that you've described. Let me know if I misunderstood. 🙂
-Dave
0 -
Hello
Thank you for your answer.
Looks like upgrading to 1password families and creating a secondary account would be the best solution for my case.
If I do so, does 1password make sure other accounts in same family can't be used to gather information about the primary account (even in the event of the secondary account being fully compromised) while allowing items to be shared with all of my accounts?0 -
Hello, I got another question.
Can I perform operations like changing my account type, changing my master password, regenerating my secret key, saving my emergency kit, changing my billing method, etc in the mobile or desktop app instead of possibly less secure web browser?
I believe 1password7 had all this features in apps but it seems to be gone in 1password8.
Any help would be greatly appreciated!
Thank you in advance!0 -
Thanks for the reply, I'll answer below:
If I do so, does 1password make sure other accounts in same family can't be used to gather information about the primary account (even in the event of the secondary account being fully compromised) while allowing items to be shared with all of my accounts?
Each family member in a 1Password account has their own Private vault that only they have access to. Items that a family member stores in their Private vault are only accessible to that family member. Only items stored in a shared vault can be seen by other family members.
Can I perform operations like changing my account type, changing my master password, regenerating my secret key, saving my emergency kit, changing my billing method, etc in the mobile or desktop app instead of possibly less secure web browser?
A lot of these actions have to be performed using the web app and aren't available in the desktop app. You can access the web app by logging in to your 1Password account on 1Password.com (in the browser, not the desktop app)
Are there any specific concerns that you have about using the web app? I would be happy to pass along your feedback to the team. 🙂
-Dave
0 -
Hello Dave!
Thank you for the kind answer.
I wonder if the web app uses the same strong security model as the desktop apps and browser extensions, since web based cryptography libraries are quite limited compared to their native counterparts.
I'm also especially concerned about some javascript stealing data entered in form fields without my knowledge, as the web environment itself doesn't provide a secure sandbox.
And lastly, just out of curiosity, I grabbed up wireshark, decrypted TLS by telling my browser to save the session key and used that to see what packets are traveling over the network.
Among many things, I've spotted something like the address googleapis.com and the word password leak check, just after authentication finished with 1password.
If I remember correctly, there was a client id and client secret field being sent to googleapis.com in the form of JSON.
I truely don't know about this password leak check in chrome, so I'm worried about the possibility that the hash of my master password and secret key being sent to google for comparing against their database of leaked passwords.
If you can clarify these, I would truely appreciate it.
Please forgive me if I mistaken something in my post.
Thank you in advance.0
