Vulnerability alerts with Watchtower disabled [Known issue, to be fixed in future update]

mmarston

I suddenly have many vulnerability alerts for my log ins whats going on?

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided
Referrer: forum-search:I suddenly have many vulnerability alerts for my log ins whats going on?

Vee_AG

Hi @mmarston,

Can you give a bit more information about the alerts you are seeing? If I had to guess, I'd say it sounds like you may have inadvertently enabled Watchtower, our built-in security service that advises you when to change passwords for websites that may be vulnerable to attack.

To disable Watchtower, go to 1Password > Preferences from the menu bar, select the Watchtower pane, and uncheck the box.

If this is not what you're asking about after all, please provide a bit more detail, and/or a screenshot of what you're seeing (omitting any sensitive data, as this is a public forum), and we'll be happy to take a look. Thanks!

brianhogg

Likewise, I've just started to get these alerts. What's odd is I'm getting them for online banking accounts, where one will have the alert and the other will not. I have business and personal accounts separate and usually check both at the same time and only the one had an alert. Other accounts I haven't used in a while are getting them too.

So how are these alerts being triggered? They didn't appear until recently and the 'Watchtower' service is disabled and has never been enabled - I didn't know it existed until now.

OSX 10.10.4, 1Password 5.3.2.

Thanks!

Drew_AG

Hi @brianhogg,

Can you please elaborate on what sort of alerts you're seeing? What do the alerts say, and where are you seeing them? You said you don't have Watchtower enabled, but please take a look at this page of the user guide just to confirm whether or not that's what you're seeing: 1Password Watchtower

If the alerts you're seeing are something very different, they might not be coming from 1Password. If possible, it would be great to see a screenshot of one of those alerts (just make sure you edit out any personal data from the screenshot). To include it in your reply, simply click the document button in the top of the comment field, and select the file you wish to share:

Thanks in advance!

brianhogg

The alerts were appearing above the popup that appears when you hover over a login in the Chrome extension. I've already changed the passwords so the alerts disappeared but they are not the Watchtower ones you referred to in the link.

See attached on where the alerts were coming in, can't remember the exact wording but something like "Vulnerability Detected, ..." from the site and recommending to change password. But no detail on why the vulnerability was thought to have happened.

Drew_AG

Hi @brianhogg,

Thank you for the screenshot & description! It looks/sounds like you're describing exactly what a Watchtower alert looks like in 1Password mini / Chrome extension. In fact, the user guide article from my previous response has screenshots of a Watchtower alert that look very much like your screenshot. The only differences are that your screenshot doesn't actually include the "Vulnerability Alert", and the user guide is showing the main 1Password app instead of 1Password mini / Chrome extension (but the item details and Watchtower alert look almost identical in both places).

From the main 1Password app, go to the menu for 1Password > Preferences, then select the Watchtower tab. Is the Watchtower option there enabled (i.e. with a check mark)?

brianhogg

Apparently I didn't scroll down enough in the article you linked to :) Yes, it does look like that's the same vulnerability alert I saw.

No, I don't have Watchtower enabled, so the alerts are probably some kind of bug where they shouldn't actually be displaying? I've never enabled it.

Drew_AG

Hi @brianhogg,

Thanks for checking that! It looks like you have the AgileBits Store version of 1Password installed. Is there any chance you also have the Mac App Store version installed? It would be a separate app with separate preferences, so that might explain it. The AgileBits Store version (i.e. from your screenshots) would be named 1Password 5.app (and hopefully in the Applications folder). The Mac App Store version would be named 1Password.app.

brianhogg

I don't believe the app store version is installed. Searching for 1Password within the app store shows it available for purchase (vs. already installed), and searching the mac only shows the version in the Applications folder:

littlebobbytables

Greetings @brianhogg,

There is a bug that we've fixed in the latest betas that would account for what you're seeing. The bug is we mistakingly check for an update to the Watchtower database when we shouldn't (because the option is disabled) and that triggers the alerts to show even though the option is disabled. When the next stable version of 1Password is released it should contain this fix and 1Password should behave properly.

Now the way that entire feature works is we add sites when we have reliable knowledge that passwords have been placed at risk and that includes a timestamp. If you change a password after this point then the old password can't be used against you and we don't show the banner. So that might be one possible reason why one Login item shows a banner and another wouldn't. Another possibility is dependent on the URLs stored in these two items. The risk might be only for a particular subdomain and even though they might both be for the same bank some banks keep very separate and distinct sites going. Those could both be reasons why one shows and another doesn't.

If you have any follow up questions please do ask :smile:

ref: OPM-2996

mmarston

I started this thread and forgot to get back to it.
Mac OSX 10.9.5 1Password 4.4.3 Here's a screenshot with one vulnerable login left. When this first occurred there were maybe 30-40 of them which I spent a great deal of time updating. So what's the story with watchtower ( It was on when this happened. Should I leave it off? If so what's the point? I haven't installed Yosemite yet as I hate installing a new OS and all the little things that have to be fixed after the upgrade. Do I really need to upgrade so I can use the latest 1Password?

littlebobbytables

Greetings @mmarston,

Personally I would recommend leaving Watchtower on. If a site has had a security breach and a password change is a good idea I would want to know as you can't always rely on a site being prompt in informing its customers (sadly). Even the possibility of false positives would be acceptable to me if it meant sites requiring a change were addressed. That's just my personal opinion of course. I would hope if you were to update that last password that you wouldn't have anything listed in Watchtower and all would be good. It's annoying when you can't easily change a password though - I have one site where I need to write a physical letter requesting a change of password would you believe - how's that for an efficient local council?

Now just to warn you I'm going to delete that image just as a security precaution as you may not want your email address visible.

Sadly 1Password 5 does rely on certain features in Yosemite so to run 1Password 5 you would need to update to the latest version of OS X first. I don't know if it makes any difference but I found Yosemite was a fairly painless upgrade but of course the experiences of one person may not be the norm.

If you have any other queries or you feel I haven't answered those in enough detail please do let us know :smile:

The Doctor

Hi Guys...

I'm assuming this still has not been addressed in the MAS version since it was last updated in April. Can you confirm that and give an idea of when the MAS version will be updated.

Thanks!!

The Doctor

Oh...and once it is updated...will I need to toggle Watchtower on and off...will will the messages simply no longer show since I currently have watchtower set to off?

The Doctor

Hi Guys,

I started a new thread because when i re-read the other on a similar topic, it seemed to be referring to 1P 4.x rather than 5.3, so wanted to make sure I was getting the right information. Feel free to merge if you feel appropriate.

I assume this has been happening for a while, but I just now noticed it on some of my logins. I've included a screen cap of a rather ironic one :-)

In any event, I assume this message should not be showing with my Watchtower set to off, correct. Is this a bug in MAS 5.3? If not, how can I get these messages to not display all the time since there are some for which I have good reasons to not want to change, but hate seeing these blazing warning messages all the time.

Much thanks!!

take care,
rwr

---

1Password Version: 5.3
Extension Version: Not Provided
OS Version: 10.10.5
Sync Type: Dropbox

Megan

Hi @The Doctor ,

It's been a while - great to see you in the forums again! :)

First of all, I did merge your two posts, just to keep this discussion in one place. I've also renamed the thread's title to make the issue a bit more clear.

I'm assuming this still has not been addressed in the MAS version since it was last updated in April. Can you confirm that and give an idea of when the MAS version will be updated.

Unfortunately, we are still waiting for the beta version with the Watchtower fix to be released as stable, and I can't say when that might happen. There are a few factors beyond our control here affecting this release, but we will do what we can to get it out just as soon as possible.

will I need to toggle Watchtower on and off...will will the messages simply no longer show since I currently have watchtower set to off?

I've spoken with the developer responsible for squashing this one, and the advice is that you may need to toggle Watchtower to get those notifications to go away ... but once they're gone, they should stay gone!

If not, how can I get these messages to not display all the time since there are some for which I have good reasons to not want to change, but hate seeing these blazing warning messages all the time.

I've got a few items like that as well. I don't have the authority to change the password, so I'm stuck with unfriendly warning labels. But there is a trick to get rid of them if they're driving you batty. It's a bit of a cheat, but if you edit the entry and change the password, that warning will go away. (Of course, you can change it right back afterwards.)

I hope this helps while we work on getting the fix release ready!

The Doctor

Hi Megan...

Great to see you too...I figured I might solicit a response from the resident Whovian :-)

Three things:

First...Things beyond your control? Sounds very "Dangerous Liaisons" ... can you provide any more info on what those things might be or even how they will ever get resolved?

Second...what's the best way for a MAS user to know when you guys have submitted a new version to the store?

Third...how does one Toggle the Watchtower...can it just be checked and then immediately unchecked, or does it require allowing some kind of server process to initiate and finish. I'm hoping the former...so please say it's just a check and uncheck :-)

pax,
rwr

Megan

Hi @The Doctor,

I'm sure there's more than one Whovian around here, but I'm glad to get to chat with you.

First...Things beyond your control? Sounds very "Dangerous Liaisons" ... can you provide any more info on what those things might be or even how they will ever get resolved?

Well, in very general terms, one of the big fixes in this update is tied to a change that is pending in the OS. So, we can't release our update until the appropriate change is made in the operating system. It's not related to El Capitan, in case you're wondering ... but I can't say much more. We know that the change will happen, but we just don't know then. This is the excitement of software development some days. ;)

Second...what's the best way for a MAS user to know when you guys have submitted a new version to the store?

Stay tuned to our blog, or follow us on Twitter (@1Password) and Facebook. We'll announce in all those places when the update is ready.

Third...how does one Toggle the Watchtower...can it just be checked and then immediately unchecked, or does it require allowing some kind of server process to initiate and finish. I'm hoping the former...so please say it's just a check and uncheck :-)

You should be good to just check and uncheck. Of course, if that doesn't work, you know where to find us and we'll figure out how to get you sorted out! :)

The Doctor

Hiya...is this update even close to being on the horizon :-)

Drew_AG

Hi @The Doctor,

I'm pretty sure the update is "close to being on the horizon" although I really don't have a more specific timeframe I can give you at this point. Sorry, I know that probably doesn't help much. Hopefully the wait won't be too long though! :)