How to handle security while traveling (and potentially losing devices)
Comments
-
I'm new to 1Password after many years of LastPass. The polish and quality of the 1PW apps are far superior to LastPass and it's a real joy to use them (I especially like the TouchID support in OSX :) ). While switching over and getting used to the 1PW model vs. LP and as someone who has had to consider disaster recovery scenarios for traveling, I also became concerned with the Security Key requirement (thus searching and finding this thread!).
I certainly understand and appreciate the extra cryptographic protection provided by the security key--especially for casual users of 1PW. However, I'm wondering if there might be some option for more technically savvy users who are already using and managing cyrptographically strong master passwords to disable the Security Key and only rely on a master password (you could even require one to allow disabling)? That way, for those with complex or high risk DR scenarios who are able and willing to memorize strong master passwords can use and recover 1PW without external support. By all means, still allow other factors such as TOTP apps and YubiKey if the user desires, but these should all be optional (ala LastPass), including the Security Key.
0 -
@redrockcity I really like that idea. My institution has a requirement that your password be changed every XX number of days, unless you set a password with sufficient entropy...this is basically what you're describing.
0 -
Hi folks,
Thank you for taking the time to chime in with your thoughts.
We do not have any plans at this time to make the Secret Key optional. If we were to decide today that were something we were going to do, it would take months of work to make it happen. As such I'd recommend planning around needing the Secret Key in order to authorize a new device (and as such having access to your Secret Key if you think you might find yourself in such a scenario).
One thing that hasn't been suggested yet in this thread is the possibility of storing your Secret Key on an encrypted thumb drive or in a Yubikey (or similar device). I've also seen it suggested to print out the Secret Key, laminate it, and store it in the bottom of your shoe. Hey, I guess it could work. I can't say what the best possible solution might be for each individual. For me personally I tend to travel with multiple devices. Each of these devices holds my Secret Keys. I'm very careful with my devices. They are incredibly valuable, not only from a monetary perspective but also from a practicality standpoint, and so I've never lost a device. I've also been fortunate enough to never have had one stolen. The chances of something happening to all of them feels very slim. If it were to happen I've got a printed copy of my Emergency Kit in a safe location. I'd either go to that location myself and retrieve it or contact a trusted individual to do so for me.
There certainly may be other approaches that work for other people. But again I'd recommend planning on needing your Secret Key to authorize 1Password on a new device for the foreseeable future. I'm happy to make suggestions as to how you might do that, but which will work best for you is up to you.
Ben
0 -
I guess the search for what my first tattoo should be is over... :lol:
Kidding aside, thanks for the update.
0 -
I guess the search for what my first tattoo should be is over... :lol:
Ha! :tongue:
Kidding aside, thanks for the update.
You're very welcome. :+1:
Ben
0 -
@Ben, @brenty, based on what you shard in this thread, it seems like AgileBits does not understand its customers. You are suggesting we rely on access to others to re-gain access to your service. Our ability to access our vaults clinches on that whether we can reach our emergency contact to get our Secret Key.
That's not acceptable for some customers for reasons detailed in this thread many times over and instead of acknowledging it and the challenges your product design presents, you stand firm behind these design decisions and repeatedly tell your paying customers that there are no options and just keep re-iterating a solution that does not resolve our situation. Instead of giving consideration to this issue or any indication that might consider accommodating the way your customers use your products in the real world, you tell us that we need to get with your program and conform to your expectations. I understand how that can necessary to protect the integrity of your customer's data and your reputation as an organization, but this approach is short-sighted. Yes, theft is rare in most cases, but it does happen. When it does, the results will be devastating for some of your customer(s). Some of our clients travel all over the world and in some of those destinations making a phone call overseas back to North America is an unreasonable expectation. Based on your responses in this thread, I do not think that you understand your customers and how they are at risk of losing access to their Secret Key.
I'm glad that you tell customers to take their Emergency Kits, back them up to cloud storage that does not use a random password only stored in 1Password, print them out, leave copies with trusted friends/family. But many customers will not and if you're being honest with yourselves you know that. You can write about how customers should do this and that, but they wont. Most people are not tech people and that's why we loved your product so much. It is the most polished and easy to use across Mac and iOS based on our experience. However, this 1Password.com service appears to be the opposite...
When the iPhone 4 came out and users encountered issues with the "death-grip," Steve Jobs told iPhone 4 customers "don't hold it that way" and "Calm down." "Relax, it's just a phone." Apple eventually lost that PR battle and had to supply free bumper cases to every iPhone 4 customer.
Your responses to this issue really comes off the same way cold, un-empathetic, dismissive and somewhat snarky and it really disappoints me as a paying customer that used to promote your products. I am not asking you to make a specific design change or to remove the Secret Key. I was really was hoping that you would just acknowledge these issues and give them due consideration as you consider improvements to your service. However, at this point, that does not seem to be the case and because of that I am left frustrated because this feedback seems to be falling on deaf ears.
0 -
I agree with @wavesound. While I appreciate the responsiveness of 1password staff on this matter, the vibe I get from the responses is "Our system is perfect, the problem must be with you"
0 -
@KnnNike: I think you should read it again then. That's not what anyone is saying. This discussion is about something that's going to vary from person to person, and isn't specific to 1Password at all: having a contingency plan. We can only share our own perspectives as we make decisions for ourselves. By that same token, you'll need to decide for yourself which measures are appropriate for you.
0 -
@wavesound: Likewise, you're free to make whatever arrangements you feel are right for you. This discussion is a good way to brainstorm. But ultimately it's up to you what you choose to do. There is no one-size-fits all solution for emergency planning. This isn't a problem that an app can solve for you and everyone else, because there are different considerations for each of us. I'm sorry if you came here expecting something like that. :blush:
0 -
This content has been removed.
-
I'm sorry, I don't really understand what you wrote. We use software to solve problems and pay good money for it when its valuable. In this case, we use password managers to create unique and secure passwords for our online accounts. Other password management products recognize the problems that we have discussed and have made accommodations for their customers' "different considerations" in their apps.
"We can only share our own perspectives as we make decisions for ourselves."
Yes, and that's the problem here. Our feedback appears to be falling on deaf ears.
However, there is something you can do, you can listen to us take this feedback to your development team led by product architect @jpgoldberg. That's all I'm asking for here, simply to acknowledge that this an important concern for a number of your customers and pass it up the chain as you would for any user feedback so that it can be considered as you plan changes/improvements to your service. I would really appreciate that.
0 -
@wavesound: We have been listening to your feedback, along with everyone else, and have acknowledged throughout this and other discussions like it which you have also participated in that it's an area of interest and something we'd like to find a solution for, but also that we do not currently have one that would not sacrifice the security that both we and our customers expect of 1Password. You seem to be overlooking that first part -- the dialogue we're having here -- and focusing only on that last part -- that we cannot give you what you are asking for at this time. 1Password, like any technology, is not and does not pretend to be a solution to all of life's problems, especially fundamentally social ones like how each of us plan for emergencies or succession. And I think you're missing the forest for the trees if you think of this only as "an important concern for a number of your customers", as it's an important concern for us as well, as human beings, and users of 1Password ourselves. So it's not as if we're withholding something from you; a solution would benefit us as well. Perhaps in the future there will be a viable technological solution that we can offer, but until then there isn't any more to discuss if you're going to equate us not giving you what you want when you want it with us "not listening". Just because you demand something doesn't mean that anyone listening should -- or even can -- respond affirmatively. Sorry. :blush:
0
