New login UI for 1Password web

TobiasAT

It seems you have changed your login mask for the web login of 1Password families. In times of phishing and other attacks it's unusual to change the login screen without a previous notification. Today morning I was unsure whether the login is really from 1Password. I'm still not sure. Did you changed the login UI?

Regards
Tobias

---

1Password Version: Web 406
Extension Version: Not Provided
OS Version: Windows 10
Sync Type: 1Password Family

Lars

Hey @TobiasAT -- yep! Thanks for checking in with us, we did indeed change the appearance (and to some degree, functionality) of the login screen for 1password.com accounts. But it's still us. :) Part of how you can tell that is a) you're using the same URL you did previously, and b) it's an extended validation (EV) HTTPS cert -- you can tell that by the green bar in your browser. The combination of those two things would make it VERY difficult for an adversary to phish from. However, we're always glad to see users take a skeptical eye towards anything that looks "off" about their security environment. How do you like the new sign in page look? :)

TobiasAT

Thanks for the confirmation @Lars. For me the new sign-in looks fine, it's more structured like before.

Lars

@TobiasAT - glad you like it! Stay safe out there and have a great rest of your week. :)

learning_1pw

Just a note. My browser, Firefox, shows the green EV designation with the company name when I go to 1Password.com. It does not show it when I go to https://family_name.1password.com. It just shows the lock icon without the company name.

I don't know enough about EV certificate handling in Firefox to know if this is the expected behavior. Just curious.

AGAlumB

@learning_1pw: This is expected, and should be the same for any browser. The EV certification guidelines do not allow issuance of wildcard EV certificates (e.g. our EV cert covers "1password.com", not "family_name.1password.com", et al). EV certification is valuable for the top level domain because it verifies ownership and control. And because we own and control 1password.com, we also control all the subdomains, which are in turn using our SSL certificate:

You raise a good point, but it's helpful to keep in mind that you or anyone else who is aware of this limitation can always verify the certificate and root. Cheers! :)

learning_1pw

Thanks Brenty. I understand better, now.

AGAlumB

Glad that helped! We're here if you have any other questions. :)