Cannot use 1PasswordAnywhere from Dropbox folder [browser restricts, must use through Dropbox site]

ddokoto

As a new 1password 5 user, I tried syncing with dropbox so I can get passwords on my work windows PC.

It works within the firefox browser.

It fails within the desktop windows 8 file explorer folder.

Given they should be looking at the same set of files, why does it not work on the desktop dropbox folder? It is missing .js files and fails to run. I contacted dropbox and they refuse to answer the direct question why their dropbox folder does not show the same file list on the windows desktop. They keep on saying 1password is not our app, talk to them. But if the same files show up in the folder as within the browser, then should it not work? If the file list is not the same, then it is all dropbox, not 1password. Do you know something about why it doesn't work that I can't get out of dropbox support? Syncing is what they do for a living and they don't seem to get it right with the 1password folder.

ddokoto

I have a mac running yosemite at home with the installed 1password app.

AGAlumB

@ddokoto: The problem isn't Dropbox or 1Password; it's the browser. They do not allow local file access nowadays in most cases, so you need to make sure you access 1PasswordAnywhere through the Dropbox website.

If you see file:// in the address bar, it probably won't work because of the browser's access policy. I know Chrome and Firefox do this. I hope this helps! :)

ddokoto

In the latest analysis and comparison of my dropbox files, all the files are there, created on the mac and viewable on windows. I specifically can load the .js files in windows and even the .js file it complains about as missing by manually loading it with file:// in the browser. So there seems to be no firefox browser prohibition to accessing and loading the .js file. Yet 1password.html on windows seems to find it missing. I thought that was a valid test of browser access. There was no issue with using file:// in the browser.

So are you saying 1password.html was NEVER designed to run out of the desktop dropbox application? Or is it just a person's access permissions for java that allow or not allow it? I don't understand the technical limitation.

This forces me to log into dropbox a second time via the browser although my desktop dropbox icon is already connected.

And rather than simply navigating to the desktop and starting it from the file explorer window, I need to do it within the browser after first logging into dropbox within firefox.

RichardPayne

I assume you can't install 1Password for Windows on your work machine?

Anyway, what @brenty was trying to say is that browsers typically block execution of local code files. When access a js file directly you are just viewing it. This is safe and so the browser allows it. When the same js file is included in the 1Password.html file the browser loads it for eexecution which it considers unsafe for local files.

The other way around this, other than accessing it Dropbox, is to use a small local web server.
I've tested 1Password Anywhere using Mongoose at it works fine:
https://code.google.com/p/mongoose/

AGAlumB

@ddokoto: Firefox does block local file access by default these days, but I know there is a preference for that somewhere. You may have been grandfathered in from running an earlier version.

Look at it this way: in most cases you really don't want a webpage accessing arbitrary data from your local filesystem. I appreciate why they have this restriction for security reasons. In this particular case it just happens to get in the user's way, when you're expressly trying to access the local filesystem.

For 1PasswordAnywhere, this isn't even a risk, since your data is encrypted. But the browser doesn't know that it's secure. ;)

ddokoto

ok. So given I can load the file via the URL field in the browser - Missing does not really mean missing. Missing means can't access. I don't see any restriction for java local files but this is windows 8 so it must be buried somewhere (even outside of the browser). This is why I love my home mac. I can understand it. Windows, well its Windows. I have to use it at work and am not inclined to put software I paid for on it. mongoose was a bit out of the box thinking. Didn't see that coming.

thanks for the feedback.

MikeT

Hi @ddokoto,

Missing means can't access.

Correct, it is because we can't run any kind of code to know if we're blocked or not. However, we can improve the default message for this. We'll look into that in the future.

I don't see any restriction for java local files but this is windows 8 so it must be buried somewhere (even outside of the browser).

There is no way to whitelist this in Firefox as far as I'm aware.

This is why I love my home mac. I can understand it. Windows, well its Windows

Technically, you can't do this on Mac either.

thanks for the feedback.

On behalf of the guys here, you're welcome.