Watchtower suggestion: check last modified date.[We do check for last time you change your password]
Hey there, just a quick suggestion for Watchtower (Great feature!):
The Watchtower DB should have a date inside it which indicates when the vulnerability was fixed. I've already changed a few of my passwords recently, but made sure that I did the change after the heartbleed vulnerability was fixed and the SSL certificate was changed. If the "Last Modified" date in the 1Password vault is after that date, it shouldn't prompt me for a change.....
Comments
-
I was just going to post the very same thing. Many websites have already been updated, so 1Password should certainly check when the password field was last modified for each entry.
In the meantime, is there a way to flag these as already fixed? A contextual menu to remove the alert perhaps? I didn't see anything yet, just came across this a few moments ago.
0 -
My work around for this has been to edit the password that I already changed by appending a few asterisks at the end, saving, then changing the password back. That takes it off the Watchtower list. I know that is inelegant, but for now, it works to keep me from having to decide each time I look at the list whether there is a real problem or not.
In actuality, given that this approach actually works, I have assumed that the Watchtower feature is, in fact, monitoring the date the password was last changed. I have confirmed that it won't drop off the list if I edit any other field besides the password.
0 -
Hi guys,
As hawkmoth already correctly pointed out, 1Password does check the last modified date for the password field. The way it works is that if the last modified password change was set after the vulnerability date that we have for that specific site in the Watchtower database (often when the certificate was updated), we remove it off the list. If not, then it remains on the list until you change the password.
If you click on Learn More.. in the vulnerability alert for the item, you can get more details as to what's going on, as shown here:
Clicking on it takes you to our watchtower sites which will run an extensive test and returns you the data we have:
The issue is made difficult when many sites were not vulnerable and didn't update the certificate, which meant it stays on the list until we get a chance to update the database manually with a link confirming they were not vulnerable. Many of this process is still a manual process but we are working on automating more of our checks based on the information we're getting.
0
