Feature request: PIN option even on devices that support Touch ID

MiriamNZ

Touch ID worked fine on my 5S for a month, and has been impossible since. I've cleared and reset my fingers multiple times and it only works for about a day, so I have given up on it.

1Password has been irritating me for ages by always asking for the master password, and now I have researched it I realise its because the pin has now gone, and with touchId off, the master password is the only choice.

So It seems the only thing I can do is to make my masterwork simpler (aka less secure) to compensate for the lack of a PIN and dodgy touchID.
Anyone else got any other suggestions?

Pain in the neck. Do agilebits staff always have the latest and greatest? I wonder how many in the world are like them in that respect.

I would love it if TouchID would work, but having to reset it every 2 days is altogether too painful.

I say bring back the choice of a pin. How hard can that be? Better than making us use simper master passwords that is for sure.

Miriam

---

1Password Version: 5.5
Extension Version: Not Provided
OS Version: iOS 8.2
Sync Type: Not Provided
Referrer: kb-search:ipassword pin, kb:android-pin-code-prompt, kb-search:ipassword pin, kb-search:ipassword pin ios, kb:touch-id-faq

reck

Hi,

TouchID has been the standard way to secure data on iOS for a few years now. When apps ask me to enter a pin or a password instead of using my fingerprint it reminds how much better things are now we have good fingerprint readers and I hope these apps drop the password requirements. .

TouchID is an important part of your phone and if there's an issue why don't you take it into the Apple Store? Wouldn't using your fingerprint be a better solution than asking the Devs to go back to the old way of doing things?

Ben

Hi folks,

I would have to agree with @reck here. It seems getting Touch ID fixed on your device would be the best of both worlds: allowing you to continue to use a secure Master Password, while also allowing quick convenient access to your data.

We do not have any plans to bring back PIN codes for Touch ID enabled devices. Devices that are not Touch ID enabled do still have that option.

Thanks.

Ben

BSPass

Hi Ben

I would like to add a request that your team enable an option of using a pin for OnePassword, even on Touch ID enabled devices.

I am concerned
1 - that if anybody gets my pin, they can add a Touch ID and basically get into my one password. There are many iOS pin hacking programs I've read about and people can see my pin frequently in public if they try
2 - that my fingerprint could be lifted from elsewhere

Whether these are critical security issues I will never know but as a user I would truly appreciate if you were to enable the option for me to choose, even if my device is using Touch ID

My preference: Touch ID for iOS login but pin for my one password. Can't do both at this time as I understand it.

Thanks for your consideration for future versions! It would make me happier with your great program

AGAlumB

@BSPass: It's certainly something we can consider for a future version, but keep in mind that...

1 - that if anybody gets my pin, they can add a Touch ID and basically get into my one password. There are many iOS pin hacking programs I've read about and people can see my pin frequently in public if they try

..allowing 1Password to use a PIN on Touch ID devices would actually enable the issue you're describing. Without the option for a PIN in the first place, it wouldn't be possible for anyone to unlock 1Password with the PIN in lieu of Touch ID.

2 - that my fingerprint could be lifted from elsewhere

This has been proven to be possible, but only using very difficult, expensive methods. Essentially someone has to get a functional copy of your finger — not your fingerprint, your finger. And if they are in a position to do that, they probably have other means of getting what they want from you.

BSPass

Thanks. Glad to hear issue two is not as big of a risk
I should clarify my concern on the first point. (1) use Touch ID for one password, (2) somebody gets my iOS pin, (3) they use it to add their fingerprint as Touch ID, (4) they now have access to my OnePassword via Touch ID.
I would find a pin in one password better and more secure as I would use a different pin for one password than in my iOS
Hope you can enable the feature. With iOS allowing any fingerprint in Touch ID to access things on the device, using Touch ID is basically as secure as the iOS pin
Thanks

AGAlumB

I should clarify my concern on the first point. (1) use Touch ID for one password, (2) somebody gets my iOS pin, (3) they use it to add their fingerprint as Touch ID, (4) they now have access to my OnePassword via Touch ID.

@BSPass: :scream:

In all seriousness, don't use a PIN if you think that is a possibility. Use an alphanumeric device passcode. 1Password can't protect you from using a weak Master Password protected by Touch ID protected by a weak device passcode — or using strong ones that you've given away.

Having a PIN in 1Password wouldn't be more secure. It would just mean that you're locking 1Password itself behind a weak password. After all, the whole point of Touch ID is that it empowers you to use a truly awesome device passcode and Master Password without having to enter them all the time.

jpwynn

Gloves. What good is touch ID when you wear gloves? I assume you folks in Canada wear gloves sometimes too.

PIN would work (if offered as an option), whereas touch ID useless.

So please offer PIN option even on devices with touch ID rather than presume touch Id always works

(The original poster's mention of flaky touch ID 4 months ago ought to have been reason enough, IMO.)

AGAlumB

What good is touch ID when you wear gloves? [...] So please offer PIN option even on devices with touch ID rather than presume touch Id always works

@jpwynn: Wow. We've had Touch ID in 1Password for years, and as far as I know this hasn't come up before. You make a good point!

The main concern is that it will always be the weakest link that can be exploited, so unless you're using a really bad Master Password, using a short PIN code will effectively lower your security, since anyone can just bypass Touch ID for the PIN instead. I'm personally not willing to use a PIN or weak password to protect my most sensitive data. It can be a hassle, but it's a 'sacrifice' I'm willing to make to keep my vault secure.

However, if you mean using a PIN instead of Touch ID, that's something we can certainly consider. Otherwise, if you'd like to simply use Touch ID most of the time, sans gloves, you can always cancel the Touch ID prompt and enter your Master Password. Granted, a good pair of fitted capacitive gloves are crucial to be able to do anything

(The original poster's mention of flaky touch ID 4 months ago ought to have been reason enough, IMO.)

While frustrating, I'm not sure that it's reasonable to throw Touch ID under the bus simply because of one person's struggles with it. It's a really great feature that works well for a lot of people, keeping them much more secure by using a strong password they wouldn't be willing to type every time. But we'll see if we can add some additional flexibility here. Thanks for the feedback! :)

ref: OPI-1919

hawkmoth

Regarding gloves - You cant enter a PIN on a touch screen while wearing gloves either.

jpwynn

FWIW I love using Touch ID.

But having a "touch now OR enter PIN" option that can be enabled (for devices with Touch) still gives a bad guy only one guess since you then require the master password after a single failed attempt.

Ben

@hawkmoth unless you have special gloves. :)

@jpwynn A fair point. I'll pass the feedback along to our development team.