My 1Password Key accidently sent in unsecure email

jbeckplano
jbeckplano
Community Member
edited October 1 in Lounge

For some reason I got an email sent to gmail (@gmail.com) from my apple email (@icloud.com) that contained my 1password key. I assume the email was not encrypted. I don't know what caused this email to be sent or how my 1Password key was found. The email says with key characters replaced by #'s:

"onepassword://team-account/add?email=jbeckplano%40gmail.com&key=##-#####-######-#####-#####-#####-#####&server=https%3A%2F%2Fmy.1password.com%2F&account-name=Jeffrey+Beck"

Sent from my iPhone to my gmail.com mail account.

Is my 1password key compromised? What should I do?

1Password Version: 8.10.46.26
Extension Version: Not Provided
OS Version: Windows 11
Browser: Edge

Comments

  • Dave_1P
    Dave_1P
    edited September 26

    Hello @jbeckplano! 👋

    Thank you for reaching out. At 1Password, we value your privacy and security. Because of that, your 1Password account password and Secret Key are tools to decrypt your information and are only stored on your device. They are never transmitted to us and we do not have the ability to send them to you in an email.

    It sounds like you used the "Set Up Another Device" feature on a mobile device to send yourself a link to allow you to add your account to another 1Password app. You can find the feature here:

    1. Open and unlock 1Password on a mobile device
    2. Tap the icon for your account or collection at the top left and choose Set Up Another Device.
    3. Look under "Send yourself a link to sign in".

    Do you remember opening that section of the app?

    -Dave

  • jbeckplano
    jbeckplano
    Community Member

    Hi Dave,

    I don't remember setting up another device recently. I have had my iPhone with 1password for some time. My iPad has it as well. I don't remember when I installed it on my iPad. Maybe I just did install it on the iPad and forgot. The date on the email is 9/22/2024. In any event, do I need to worry? What should I do? Should I delete the email so that the key is no longer stored in my email? Anything else?

    Best regards,
    Jeff

    P.S. It seems like this would not be an uncommon occurrence for users. Maybe it's a potential issue/flaw in the method for adding a 1password account to another device.

  • Dave_1P
    Dave_1P

    @jbeckplano

    Since I don't have access to your account information here on the public forum, I recommend sending an email to support+forum@1Password.com so that our support team can look into further. After emailing in, you'll receive a reply from BitBot, our friendly robot assistant with a Support ID that looks something like [#ABC-12345-678]. Post that here, and I'll be able to locate your message and make sure it's gotten to the right place. 🙂

    -Dave

  • jbeckplano
    jbeckplano
    Community Member

    Dave,
    OK. Thank you. I sent an email about the problem to: " support+forum@1Password.com "
    -Jeff

  • Dave_1P
    Dave_1P

    @jbeckplano

    Thank you! I see that my colleague has already sent you a reply. Please continue the conversation there.

    To prevent duplication of efforts, I'll close this thread.

    -Dave

    ref: IZR-57219-895

This discussion has been closed.