Password masking for shared data

chrisball91

Hi,

I would be interested in rolling out 1password in my business so that staff can access third party services we use. The vault would be shared but my question is this... would it be possible for the staff to only use the 'open and fill' feature and not be able to 'reveal' the true password within the programme?

This would allow us to really keep security tight yet still provide access to the third party services.

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: osx and windows
Sync Type: dropbox

Jasper

Hi @chrisball91,

Thanks for taking the time to contact us!

No, we don't have an option that prevents users from revealing passwords.

Trying to hide the data by not allowing someone to reveal a password using the 1Password app, while still allowing them to fill it in a browser, provides little security. We tend to stay away from features that may make you feel more secure, while not actually doing much to increase security.

If one of your employees really wanted to know what the actual password is, they can still find out. One simple way to do this is filling the login into a webpage, then modifying the input field from type="password" to type="text". This will reveal the password.

Or, while an employee is accessing one of the accounts, they could even change the password (in most cases).

With that said, we never say never, so I can certainly pass the request along to our developers. I can see how some people may still find this feature helpful in some cases... such as making it more difficult for employees to copy the password somewhere else and storing it insecurely.

chrisball91

Thanks for responding Jas and clarifying how the html code can be manipulated to reveal the password anyway., although this would take a particular savvy member of staff to do it.

chrisball91

if you could pass this feature request on to the devs that would be appreciated :)

Ben

Consider it passed along. :)