Discovered a shared folder inside of Dropbox - how did this happen?

chrisheuer

1 Password has been crashing a lot lately and I am not sure why.

More concerning is that last night I received a notification that a folder on dropbox was shared. It was a folder inside 1Password and I certainly didn't share it, does the app do this itself? Or are all of my passwords vulnerable now?

It created a subfolder called "A" and shared it. I just went in and deleted it as I couldn't 'unshare' it.

Is this normal behaviour or is this a hack?

littlebobbytables

Hi @chrisheuer,

A .agilekeychain is what we can a special bundle. It's actually a folder but OS X treats it as a file in many regards. Anyway, if you were to create a new vault and sync it, the contents of that .agilekeychain would consist of a 1Password.html file (for 1PasswordAnywhere) and a folder called data. Inside the data folder would be another folder titled default and all of your items are stored in there.

The subfolder a doesn't need to be created until you first add an attachment to an item. Now the first time you add an attachment the subfolder a will be created automatically by 1Password but we wouldn't share it. The way Dropbox works is if you share folder alpha then everything inside that folder is shared too. So I can only assume you're sharing the folder that the .agilekeychain resides in and as a result of inheritance the sub folder a is also shared as a result.

The easiest way to view what is being shared (and with whom) is to log into Dropbox and view the Sharing tab. 1Password though will never do this, sharing of a folder between users is something we leave specifically up to the users to do.

Once you've reviewed what is being shared with whom you'll be in a much better position to know if something wrong is going on. Do keep us informed as to what you find.

chrisheuer

Awesome = thanks for the quick reply - I am not aware of anything I did to add an attachment to an item though, so maybe one of the logins did it and I didn't notice.

Drew_AG

Hi @chrisheuer,

I'm glad @littlebobbytables' information was helpful! As for attachments, if you don't think you ever added an attachment to any items in 1Password, do you happen to be using the web store version of 1Password 4 or 5? If so, when you added your license file to 1Password, it may have created a Software License item for 1Password with your license file as an attachment. As far as I know, that's the only time 1Password would automatically add an attachment to an item.

At any rate, the more important issue here is that a folder in Dropbox was being shared, and you don't remember sharing it. As littlebobbytables explained, the folder containing your .agilekeychain might be shared, and you can check that in your Dropbox.com account. If it is, please keep in mind that's not something 1Password has the ability to do - it's up to the user to set up sharing in Dropbox.

I do hope that helps, but please let us know if you have more questions. Thanks!