Lost laptop -- implications of a weak(er) "in app" Master Password?

andersk
andersk
Community Member
in Families

One of my "family" users has just lost (left on a train) her Mac laptop on which she has 1PW and her 1PW file. We're trying to understand her vulnerability and decide if she needs to do a widespread change of passwords. My main concern is that while I know she has a very strong Master Password for her web account login (I made her pick a strong one) she's 'fessed up to using something quite a bit weaker to access the 1PW app on her laptop. It's not ridiculously weak, and certainly isn't human-guessable, but it would probably fall to a sustained attack -- dictionary or the like -- if it fell into the hands of someone determined.

Unless someone hands it in to lost and found, I think the most likely scenario is probably just that we lose the machine. That's annoying but nothing more. The bad guy will just erase the disk and take it from there. However, I think there are broadly two scenarios involving data compromise, one not too awful but one potentially very bad.

  1. Not-too-awful: this is where the machine gets a chance to go online before anything else happens. In that case, we have set up the various iCloud bits and pieces to let us locate it, and they will also let us lock and even erase it. However, this scenario is unlikely since the machine is locked by her account password and I'm assuming any bad guy won't get past that in order to be able to connect to the internet.
  2. Potentially very bad: this is where the bad guy understands that he's not going to be able to login to the machine, but decides to try to access the disk from another machine. I can't remember if OS X's FileVault is on, so I'll assume it's not. In that case we now have a bad guy with her 1Password file in his sights, protected by a not-too-strong password.

Any suggestions as what we can do here to minimize the risk? We've already deleted her laptop from her Device list in her 1PW family account, although I'm not sure what that achieves, especially if we're in scenario 2.

I'm inclining towards telling her to start changing all her passwords (and then putting her in solitary confinement for a week as punishment for using a weak master password for the app in the first place). Is that overkill (the password changing I mean; she's going in solitary no matter what anyone says!)? Is there anything else we should be considering?

thanks,
Anders

Comments

  • Jacob
    Jacob

    Hi @andersk! My apologies for the late reply. This thread slipped under our radar.

    I'm very sorry to hear your friend's laptop was lost. :( That's never a nice thing to happen. As glenda mentioned, 1Password is locked automatically when the computer goes to sleep, the user is logged out, or the computer is shut down so it's unlikely they have gained access to her data without using her Master Password. In addition, deauthorizing the device from the family account, as you did, makes you enter the account information again to keep using it. That only works when the device is connected to the internet, though, because it needs to hear from the server that things have changed.

    I would recommend not using a different Master Password on her devices than in the account, for the sake of consistency mainly. In the future, when she sets up the apps on her devices she should make sure they are using the same Master Password as her account. The easiest way to do this is sign in to the account from the start. She can always start over with the apps to make this possible:

    How to start over with an empty vault

    As for the passwords stored in her account, this may be a good opportunity to make them stronger, but if she is already using generated passwords for each login, it would be okay to leave things as they are. If it would give her more confidence to change them, by all means do that. But as you mentioned, it's very unlikely that someone got the device and is attempting to crack the Master Password. If FileVault is on and her computer's password is strong, they won't even get the 1Password data. And if they do get the data because FileVault isn't on, it's still encrypted with the Master Password. Even if that is weaker than the main account one, 1Password does some heavy lifting to make sure it can still be secure:

    If your device was lost or stolen, and it has your 1Password data on it

    I hope this helps! Let us know if you have any other questions. :)

This discussion has been closed.