Possibility to reveal master password when typing

finwe

I would very much like to have an option to reveal master password when I type it into both main 1Password window and browser extension - my master password is strong and long as it should be, but it is frustrating having to type it whole again when I make a typo a few characters back but I don't know where exactly.

Is there a possibility to implement such feature, or has it been rejected in the past?

MikeT

Hi @finwe,

I do understand the frustrations you're feeling, it happens 3-4 times a day for me when I'm typing super fast, just to unlock that one item and be done with 1Password for a while.

We do not plan to implement it, we've considered it in the past and determined it wasn't worth the risk. Your master password must be hidden and discarded at all costs. After all, it unlocks the entire database of your data, and shoulder surfing is a big risk as well (people looking behind you). I know in private homes, it's not a risk at all but adding an option makes it available for everyone and complicates the matter.

I'd suggest the following:

1. If you're seeing it too often, extend the auto-lock timer to the length you're comfortable with.
2. If you're booting up the PC, unlock the main program first, not the browser because if you do this, the extension will be automatically unlocked.
3. If your extension and programs are not in sync with the lock/unlock status, be sure to enable this option When unlocking the application, also unlock 1Password in the browser in the main 1Password program's Preferences > Browsers.
4. If your master password is randomized rather than diceware type, you might want to consider switching to the diceware model that's easier to type but just as strong. You also do not need to include upper or lower case characters to try to make it stronger, an extra character is stronger than the upper/case method, this enormously reduced my mistakes because I no longer have to press the shift key, which I always mistimed when typing fast.

finwe

Hi @MikeT,

thanks for your swift and extensive reply. I was worried that this feature would be also a security concern, however I entirely understand its drawbacks.

I am completely content with my 1Password settings and I also cannot use any of your password-related suggestions, so I guess I would have to learn to type better :)

Thanks again for your reply.

MikeT

You're welcome.

Who knows, maybe in the future, Windows Hello might be enough to unlock 1Password without typing assuming it is secure enough to meet our requirements.

RichardPayne

@MikeT have you considered a slightly more useful but slightly less secure option of having the last character or two of the MP remain visible for a half second as you're typing? It's a common scheme on password entry fields.

MikeT

Hi @RichardPayne,

We have but I don't recall the details as why we declined against it, it was a while ago. I do remember that the OS needs to supply an option for this and not all do or require a more complex coding that is not worth it. Let me ping Goldberg to see what he recalls and I'll follow up for you.