1Password 7 losing focus, accidentally typing Master password into browser window

KaosCoder

This has happened to me several times since upgrading to 1Pass 7. I'm using Firefox and Chrome on Windows 10. I'm often sharing my screen on conference calls at work, and my biggest fear is typing my master password as plain text into the browser for all my co-workers to see.

Is there a fix for this? On the previous version I used Secure Desktop to type in the password, and that was a pretty robust solution, but I don't see that option in 1Pass 7. Is it hidden somewhere?

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided

Greg

Hi @KaosCoder,

I am really sorry for these serious troubles with 1Password 7!

We are investigating this issue at the moment, but it is really hard to reproduce this intermittent issue. Am I right to understand that this issue happens when you invoke 1Password extension/mini on your PC? Are you able to reproduce this issue reliably?

Additionally, please provide more information about your computer, is it a laptop? Also, do you have any other extensions installed in the browser? I apologize for the inconvenience with the questions. It may take a little troubleshooting back and forth to help us diagnose the issue.

Thank you in advance!

Cheers,
Greg

ref: OPW-#1298

KaosCoder

It's happening with the browser extension/mini piece of 1Password 7. And yes, it is intermittent and really hard to reproduce, unfortunately. Seems to happen when I'm in a hurry, so maybe I'm typing before mini has fully rendered? I've had this happen on both a PC and a laptop. I am using the uBlock Origin extension on both. One time the password started entering into the URL field of the browser, the other time it was the text box on a search engine page.

I use the numeric keypad for the beginning part of my password, maybe it has something to do with that? Maybe it's a numlock issue? I'll try my best to reproduce. It hasn't happened at all this past week, and I use 1Password very frequently. Thanks for responding.

KaosCoder

After playing around with it a bit, I can easily re-produce the problem. In general, the 1Password mini window is displayed even when it lacks focus, so it's very easy to type your master password into the browser window by mistake. I also have a Mac and the behavior there is for 1Password to immediately hide itself if it's not the focus (ie, you click anywhere in Safari). This behavior is inconsistent in Windows with Firefox/Chrome.

Here's a screenshot where I'm typing into a text box in the browser even though it looks like 1Password is the frontmost app and is asking for my password. The solution for now is to always make sure I click on the 1Password box before typing anything.

Psycho_Bunny

I also had this problem and I'm glad you reported it already.
I'm also using Chrome with the 1Password extension on Windows 10 and I've also installed uBlock Origin.

Let's hope you're able to fix it soon.

AGAlumB

Seems to happen when I'm in a hurry, so maybe I'm typing before mini has fully rendered?

@KaosCoder: That's what others have suggested too, but that hasn't helped us reproduce it, even though it sounds like it makes sense. :(

After playing around with it a bit, I can easily re-produce the problem.

What are the steps involved?

I've had this happen on both a PC and a laptop. I am using the uBlock Origin extension on both.

If you disable that, are you still able to reproduce the problem?

AGAlumB

@Psycho_Bunny: Unfortunately individual apps don't have any control over focus; that's all handled by the OS. If we could control it, we'd have fixed this already. I appreciate you chiming in here though and mentioning that you're also using that extension. Let's see what steps KaosCoder has come up with. Perhaps you'll be able to do it as well.

Mark_D

This has been happening to me as well, ever since the 1Password 7 update. I've already had to change my master password once because I inadvertently typed it into the login form of a website I was trying to open 1Password for. Really irritating.

AGAlumB

@Mark_D: I'm sorry to hear that, but we haven't changed anything in this area since 1Password 6. It's a Windows issue, as the OS is responsible for cursor focus, and the only potential solution we've hit on is...rewriting a bunch of stuff — again — using different Windows frameworks. Not even sure that would resolve it fully, and it's not something we have the bandwidth to do right now anyway. It's best to make sure you're typing where you think you are in Windows before entering sensitive information in general, but certainly the same applies in this case as well.

Mark_D

Fair enough. It never seems to occur on macOS, so I'll just have to get used to double-checking the focus before I type.

MikeT

Hi @Mark_D,

Are you able to reproduce this consistently or is it random?

Mark_D

It seems to be random, but it could just be related to how quickly I begin typing after hitting the Chrome extension button.

MikeT

Hi @Mark_D,

That could be Chrome stealing the focus if you start typing before 1Password mini is rendered, we can't ask for the focus before the view is rendered as per Windows' limitations. If you try waiting until you see 1Password mini, do you see it happening less often?

Mark_D

Thanks, I'll give it a go.

MikeT

Thanks!

Mark_D

Nope, looks like it's not time-dependent. I just tested on a banking login page (no addon bar) with a right-click -> 1Password. Even though the cursor is blinking in the 1Password pop-up window, the background Chrome page has focus.

I'm sympathetic that this is a bug in Windows and not 1Password, but this is going to end up with someone dropping their master password somewhere it really shouldn't be, and it's only a matter of time until that ends up with a lost vault.

AGAlumB

@Mark_D: Oh absolutely. It sucks. But it isn't something we have control over, and it's difficult to even find a workaround (if one exists) given that we cannot reproduce it. :( But it's important to note that someone dumping their Master Password into a search box, while obviously not something any of us wants, is not going to magically give an attacker their data. And of course the Master Password can be changed if necessary. So it really doesn't have to be the end of the world.

anotherfrustrated

Sad to see this very serious issue has been reported by multiple people some time ago. And even more sad to see the last response from a 1Password team member basically seeming to say, 'yeah, it's not a big deal, we don't care'.
I experience frequent 'buggy' behaviour with 1Password on windows 10... but this particular issue is a significant enough concern for me to stop using 1Password.

AGAlumB

@anotherfrustrated: Don't put words into my mouth, buddy. I can speak for myself. :tongue:

As mentioned previously, Windows controls window focus. Sorry. Certainly we'll work around it if we can, but so far we haven't found a reliable way to do that, as it's something Windows is specifically designed not to allow in order to prevent apps from annoying users by stealing focus. I hate when website popups and nagware tries to do that when I'm in the middle of doing something else, and that's become much less of a problem on Windows over time because of this. So far, we can't have it both ways.

At the end of the day, while I am sorry for the inconvenience, you do have control over when and where you type a password. That applies no matter what software you choose to use. But certainly if you prefer something else we'd rather you be happy using that. And no matter what we'll continue improving 1Password is any way we can for those who use it. Take care.

nm81099

This could absolutely be improved.

First off, are you unable to detect the lack of focus? The cursor blinks even when focus is lost. I don't see this behavior with the text controls on any other forms when they are unfocused. Is this a bug in Chrome's extensions? If it is, it should be reported and fixed.

I have seen this behavior many times myself. It's hard to reproduce but it happens often enough that it's a real problem. When it does happen, I can actually click between form elements on a page and the extension overlay and watch the overlay "lose focus" while the master password box continues to have the cursor blink like it's still focused. But in normal circumstances, clicking back on the page will hide the overlay entirely. Something is not right in Chrome or the extension; the behavior doesn't strike me as a Windows problem.

If you could fix the blinking cursor that'd be a positive step. Further you could do more to call out whether the overlay is focused, like brightly highlighting the borders to the text box. This may serve to stop more users from typing when focus is lost.

bundtkate

@nm81099: I've seen this outside of 1Password and Chrome myself. I've ended up typing in a Firefox window when I had just clicked in Slack to reply to a message or in an Edge window when the main 1Password app had updated and I was trying to unlock. Like with mini, it's not every time and I usually can't make it happen when I want to, but it's definitely not a 1Password-specific issue. Mini is a window we often summon and type into, likely more than most any other app on our PCs, plus it's one of the few places we type something we guard as closely as our Master Password, so of course we see it more often there, but it's not limited to mini by any means.

Now, that certainly doesn't mean we're incapable of improving it. We're working on it all the time and have made more changes than I can count in hopes of making a difference. Given how difficult it is to reproduce reliably, there's even a chance they have helped and I just don't know it. Of course, we'll continue plugging away at this and implement new changes as we think of them, but regardless the one thing that is guaranteed to help is a reliable method to reproduce the problem every time. If we get that, we'll have the solution. Until then, we'll keep seeing what sticks.

nm81099

This could be a little heavy-handed, but if the user opens the browser action, are you able to trigger some JS on the active page? You could just capture key events and discard them.

AGAlumB

I agree. That seems heavy-handed. :lol: And based on what I've seen, I don't believe that solves the fundamental problem, or really offers a way around it (even if it's pretty clever). We thought we had a workaround this in the beta...but we quickly found that not to be the case in early testing. Maybe someday. :blush: