1Password not auto-locking properly
Comments
-
I am currently having a similar issue. 1Password doesn't lock after the timeout. Or at least it doesn't lock and require the master password for access again. It is only requiring my PIN.
I am running 1Password Pro 5.1
iOS 8.0.2
iPhone 5
Security settings are- Lock on Exit
- Auto-lock 2 minutes
- PIN code is on
After looking a bit more at the description, I'm wondering if something changed. With those settings, the description sounds like it will only require the master password after a device restart, or if the PIN is entered incorrectly. It used to require my master password after the 2 minute timeout. Is this not the way it behaves now? If not, it appears the only way to be forced to enter the master is by disabling the PIN. I'd prefer to be able to configure the app to require the master after a certain length of time.
0 -
Hi @TexKlein
I've split this discussion off as it is actually a totally different problem than what the OP was describing. His problem is that his phone won't auto-lock, not that 1Password won't auto-lock.
With those settings, the description sounds like it will only require the master password after a device restart, or if the PIN is entered incorrectly.
Correct.
It used to require my master password after the 2 minute timeout. Is this not the way it behaves now? If not, it appears the only way to be forced to enter the master is by disabling the PIN.
Correct.
I'd prefer to be able to configure the app to require the master after a certain length of time.
Thanks for the feedback!
Ben
0 -
I thought this was a bug. The app does not require Master Password after Autolock timeout expires. Yet per bwoodroff above that is correct behavior.
What is the reason for Autolock time if:- 1P5 requires pin after switching away from the app
- 1P5 still requires only pin after Autolock time
To me this is major change in behavior from 1P4. Essentially the 1P5 is only protected by device pin and 1P5 pin. I typically do not shut down my iPad more then few times a month and I never go to settings in 1P5 to lock the app, so Master Password will be used only seldom.
Please add my vote to require MP after Autolock timeout (similar to 1P4).
I have iPad Mini Retina, iOS 8.0.2, 1P5 5.1
0 -
Correct. But after one incorrect PIN entry, the app will require your Master Password. The auto-lock timer affects how long 1Password can be open without activity before it will lock (e.x. If you set it down and walk away).
Thanks for the feedback though. We'll certainly take it into consideration.
Ben
0 -
Ben,
Let me state it again!
My whole 1P5 database on iOS 8 could be protected only by 4 digit pin code to access my device and another, possibly same, 4 digit pin code accessing 1P5, with no timeout limit.
That is not secure at all, in my opinion, even with only one chance to enter the pin correctly. How is this different from having a password spreadsheet on my device, protected by a pin? Encryption is great, but with possibility of only one 4 digit pin protecting it, not so much.
0 -
Let me add, I have great confidence in AgileBits people to get settings and options right. If I'm missing something obvious, please let me know.
Right now it appears that if someone copies my 4 digit passcode and gets access to my device is all that is needed to have complete access to 1P5 database, with no time limit.
Previously, in 1P4, after time set by user, the database was locked and MP was needed to open it.
0 -
We do appreciate the feedback. :) Thanks.
0 -
@Fairgame This frustrates me also. And I'm assuming from @bwoodruff comments, that it might be something that gets added to the backlog of changes... hopefully. I may for the time being disable the pin and require the master all the time. That seems to be the only way to get level of security we'd prefer. We just lose some convenience.
0 -
I have disabled my PIN on my iPad Air and enter the master password each time I open 1Password. On my iPhone 5s with Touch ID, I'm satisfied with the security provided by requiring my fingerprint. I'm satisfied with this arrangement for now, but I would reactivated the PIN on my iPad if I were once again able to set the interval after which the PIN expires. Typing my master password on my iPad isn't as big a chore as on my iPhone.
0 -
Is there a way to downgrade to 1P4 while running iOS 8? Othewise I will probably not upgrade to iOS 8 on rest of our iPhones and iPads.
If I remember correctly, 1P5 upgrade was automatic via App Store after I downloaded iOS 8. How do you prevent or skip it without having a badge with uninstalled upgrade in App Store?
0 -
It is not possible to downgrade.
If I remember correctly, 1P5 upgrade was automatic via App Store after I downloaded iOS 8. How do you prevent or skip it without having a badge with uninstalled upgrade in App Store?
Without having a badge? I don't think that is possible.
0 -
My wife is having this same problem on her iPad. The AutoLock feature seems useless given the way it works ver 5.
Here is how it should work...if you create a PIN and set the timeout to 2 minutes, then do any of the following
- Leave 1 Password open for 2 minutes,
- Switch to another app for 2 minutes, or
- Close 1 Password
1Password should now require the full password. Right now both scenario 2 and 3 only require a 4 digit PIN. This is very insecure! It almost totally eliminates the need to use the full password.
On the other hand if you switch to another app and return to 1 Password in 1 min, it should require only the PIN.
While I'm thinking about PINs...we should be allowed to enter longer PINs.
Clark
0 -
One upside to this is that if you enter the pin incorrectly it will then require the full password. One try and that's it. After using this version for a while I've gotten a bit more comfortable with this aspect of it. But I'd still prefer the option to full lock after a specified period of time.
0 -
Thanks for the suggestions. Honestly, because a 4-digit PIN is so insecure, it isn't something we want to promote or make additional concessions to. However, you can use 1Password Settings > Advanced > Security > Require Master Password to set an interval in addition to your normal lock settings. I hope this helps! :)
0 -
@brenty, I don't see this setting on version 5.3 for IOS.
To me the PIN feature is useless. On IOS it almost never reverts to the full PW. We can leave the app for days and when we come back to it we still only need to enter the PIN. OTHO, it is a massive nuisance to have to enter the full PW every time we leave the app to go to another app. I don't think you can leave this in the broken way it is now. And I don't think we can stop using the PIN.
0 -
To me the PIN feature is useless. On IOS it almost never reverts to the full PW.
@csann: Unfortunately it isn't possible to have it both ways. If you prefer not to use the PIN, you can disable it under 1Password Settings > Security, and then you will be prompted to enter your Master Password based on your Auto-Lock setting. Alternately, you can continue to use the PIN feature, however then it will be used to unlock 1Password instead of your Master Password.
Keep in mind that you can use a PIN for 1Password, but then use a more complex password to unlock the phone itself (or vice versa), with different lock settings for both. Ultimately, just use whichever combination makes the most sense for you, since you'll have the best sense of the risks you face day-to-day with regard to your device's security.
0 -
@brenty, When I said the PIN feature is useless, I meant it is useless the way it works in 5.3. It used to be a good feature. Now it isn't.
As I said the AutoLock setting appears to be broken. For example, if I have PIN enabled, and I set AutoLock to 2 minutes. Then I switch to another app and use it for an hour or two. I'm pretty sure I can come back to 1PW and it is still asking for the PIN. It should have timed out after 2 minutes, requiring me to enter the long PW. This is why the PIN feature is useless. Its because the AutoLock setting doesn't seem to do anything and that makes the PIN feature especially insecure.
So my option is to turn off the PIN feature. That is not a very good option either. Then if I switch to another app and come back to 1PW in 10 seconds, I have to enter my long password again. I was only away for 10 seconds and I have to enter it again? Can you see how this is a major inconvenience? Why doesn't the PIN work like it used to?
With respect to a 4 digit PIN being insecure, yes it is. But it is still needed to save us from having to enter the long password every time we leave the 1PW app for a minute or two.
Isn't all this because the AutoLock timer doesn't work when the app is not in the foreground? I think it used to be able to timeout when the app was in the background and other customers have said the same thing. What happened to break it?
0 -
Not an answer, but a possible work-around. When you know you are leaving 1PW for a long time, switch and switch back and enter the WRONG PIN. I believe this will force you to enter the master password when you next come back.
0 -
Hi @csann,
I've gone back through a couple of the different versions we've had and the change you seem to be referring to was in version 5.1. Now what I know is the way we had the security settings in version 5.0.1 caused significant confusion for many of our customers. We were fielding a lot of calls and we knew we had to change something.
Auto-Lock still behaves exactly as it used to. I know it might sound like a bit of a confrontational statement but please hear me out. In version 5.0.1 and even 4.5.3 you could set an Auto-Lock (previously titled Request After) for both the Master Password and the PIN. After the specified amount of time you would be required to supply that level of verification. So even in 4.5.3 or 5.0.1, I could disable Lock on Exit and set the PIN to only be requested after 30 minutes (for example). With those settings my vault would be unlocked and always accessible for those 30 minutes.
Now if you keep Lock on Exit enabled and set Auto-Lock for 1 minute then either 1 minute of inactivity or switching away from 1Password would require the PIN. What I think you're remembering is the second Auto-Lock for the Master Password. You could set this to another value, say 2 minutes and after two minutes it would require your Master Password instead. In that configuration, it would be
Leave idling in 1Password
- 0-1min: free access
- 1-2min: PIN
- 2+min: Master Password
Leave 1Password (send it into the background)
- 0-2min: PIN
- 2+min: Master Password
As I said at the start though, these two timers were causing huge amounts of confusion for too many of our users. So we were compelled to change things. I'm not saying we got it perfect, it's a trial and error process while we work out the best way to offer certain options so they can't be misconfigured and leave people vulnerable through confusion.
At the moment, in version 5.3, we've brought back the idea of a separate timer for the Master Password but moved it with the intention/hope it will be discovered by power users. You can have your PIN set so that it mimics the behaviour of 4.5.3 or 5.0.1 using the Auto-Lock and Lock on Exit and then set the additional timer for the Master Password in Settings > Advanced > Security > Require Master Password. Now this option is only available if you currently have either Touch ID or a PIN enabled, otherwise it's hidden as the first Auto-Lock would already apply to the Master Password. If you can't see this option, which is below the Backup options but above the Allow Custom Keyboards option in the Advanced section then try disabling the PIN or Touch ID temporarily before re-enabling it, see if that makes it visible.
Does that help at all? If I've misunderstood anything please do let me know.
0 -
I stumbled on that setting yesterday and wondered if it was new? Apparently it is. That is closer to the functionality that I would prefer. I am now getting promoted for my master after an hour. I'd prefer a more configurable duration (15 min increments?), but I'll be satisfied with an hour.
Thanks for following up. As a software dev myself I know it's hard sometimes to meet expectations. Especially given the diverse user community you most likely have.
0 -
@littlebobbytables, Thank you for taking the time to provide such a complete explanation. The two timers do meet my needs. I also think others will appreciate the two timers. The only change I would like to see is shorter time intervals on the hidden password. Right now the shortest password, is 1 hour. I would appreciate timers down to a minute or two.
Also, it took me a while to find how to get to the Advanced menu. It doesn't show on my iPad...I had to slide the menu up and then it appeared at the bottom of the page. I didn't at first understand it was even possible to slide the menu up to see the Advanced sub menu.
Thanks again for your help.
0 -
So what you're looking for are more options. Maybe something like how you set a Timer in iOS' Clock app? Given the options you both request I'd say the only way we can meet both and have something cope with up to a month is something like two selectors in the wheel concept, the first is a number and the other is the units. So if the units is minutes it can be set between 1 and 60, if it's hours 1-24 and so on?
@csann, following your comment on the Advanced menu I went back and tried to look at it from the perspective of a fresh pair of eyes and you're right, I can see how you could miss that there is something worth scrolling for. It's more obvious on an iPhone where if something is full screen you might try scrolling but when you're on an iPad using a window like view that doesn't use the full screen. Oh and I'm glad the explanation helped :smile:
I'll submit reports for both and update this post when I've done so.
ref: OPI-2579
ref: OPI-25800 -
@littlebobbytables I'm not sure why the times need to go as long as they do on the Advanced tab. I'd be happy with times like on the AutoLock setting - 1 min to 1 hour. I think that is what @TexKlein is suggesting also...something less than an hour.
0 -
@csann @littlebobbytables Yes that is what I'm suggesting.
0 -
Thanks for the suggestions! :) I'll definitely mention to our developers that more granularity is desired here.
0
