Powers of Family Organizers / Multiple "Private" vaults

rlh

They can, currently. Users can create their own vaults, and share them with other non-Family Organizer users. Just wanted to make it clear this is already possible.

Okay, what am I missing here? I am the Family Organizer. I see that I can create vaults in both 1Password 7.2.4 Mac and on 1password.com. However, my wife is NOT a Family Organizer and I don't see ANY way for her to create a vault via either method.

AGAlumB

@rlh: When did you create the account? It may be that you did so long ago, before it was possible.

rlh

@brenty, I subscribed to Families when it first came out in 2016 but didn't like it at the time so didn't pay to stay active. Then I reactivated and paid about 9 months ago. When did this feature become available?

AGAlumB

@rlh: Dang it. It's been a long time since it's come up, but I want to say it was late 2016 or something. It's account-dependant, as the key exchange (which allows for the access permissions to manage vaults) is done during signup. So it definitely wouldn't work with accounts made at launch. Mine is in this category, though it doesn't matter for my purposes. You would need to setup a new account and migrate your family and their data to it in order for it to be possible for everyone to create new shared vaults. Some people don't want this, of course, but a large majority did so it's something we changed long ago. I'm sorry for the confusion (and, potentially, hassle). If you have any questions or need help making the transition, I'll be happy to assist.

rlh

@brenty, I would appreciate the help with the migration. I may have some questions first. Should we take this out of the forum?

AGAlumB

@rlh: I'd say either a new thread or email would be best, so we can focus on your setup. If you prefer the latter, just send it to support@1password.com and post the Support ID here so we can connect the dots and go from there. :)

rlh

@brenty, I re-read this entire thread, and another I participated in, Multiple personal vaults. What I have always wanted was the ability for family members to create multiple personal/private vaults as discussed in these comments:

@EarthAura: I would also love to see multiple personal vaults...

@rlh: Add me the the "multiple personal vaults" list.

I was very confused by recent posts on this thread that implied what I wanted was possible because the answer was always a variation on "We don't have anything to announce at this time, but it's something we'll continue to evaluate", which is fine. I understand development priorities. Thus, I asked for help to make this possible for my account.

While I don't know what happens behind the scenes regarding the need for migration, your careful choice of words finally broke through my brain cloud

Mine is in this category, though it doesn't matter for my purposes. You would need to setup a new account and migrate your family and their data to it in order for it to be possible for everyone to create new shared vaults (emphasis added).

Up until this point I was reading "shared vaults" and my brain was thinking "private vaults".

So my bottom line is I still would like the ability to have multiple private vaults. But if the only workaround is to make them shared vaults with limited permissions, then I can make the vault for my wife faster than I can show her how to make her own. :) AND save both of us the trouble of new account creation and migration.

I appreciate the great support I always receive on this forum. If my needs ever change to the point of wanting to do such a migration I'll definitely call support.

AGAlumB

So my bottom line is I still would like the ability to have multiple private vaults. But if the only workaround is to make them shared vaults with limited permissions, then I can make the vault for my wife faster than I can show her how to make her own. :) AND save both of us the trouble of new account creation and migration.

@rlh: Aha! I was going to re-confirm your goal before proceeding with a whole migrate-to-a-new-account thing. I don't think I can take the credit for the breakthrough, but I'm glad if some of my comments helped you get there: I do agree that it sounds like, for your purposes, not having shared (non-Personal/Private) vaults able to be created by other family members is actually a win for you. Just as a final note though, any Organizers would still be able to create them, or change their permissions. But if you are the only one then it sounds like you're good to go. Thanks for the kind words. We're here if you need anything else! :)

rlh

I do agree that it sounds like, for your purposes, not having shared (non-Personal/Private) vaults able to be created by other family members is actually a win for you

Maybe a little bit, I'm sure my wife could create another vault (either figuring it out herself or me quickly pointing her to what to do) but given the result would be a shared vault that would require the additional step to verify the permissions were correct (which they may be by default but one should still understand the permissions concept to know not to change things to an inappropriate state). So I reiterate my hope for multiple private vaults in the future.

Another problem I see (and wonder if it has frustrated others) of the current status quo: all additional vaults are shared but anyone can create vaults. For my workflow, I have a second vault (shared obviously, but only I can see it) named Defunct where I throw all my old stuff that I'm just cautious enough to not delete outright. My wife would like to do the same. (Assuming my account had the ability) I'm going to guess with your current architecture, she wouldn't be able to create a vault named Defunct for herself, she'd need it to be Archive or some such. (How does 1Password tell her about name collision given she's not even aware that Defunct exists?) Multiply that by 5 Family members and you start running out of obvious, convenient names. Or has that not popped up as a problem? I can imagine lots of Family members are out there that would want vaults named Work or School of their own...

AGAlumB

Maybe a little bit, I'm sure my wife could create another vault (either figuring it out herself or me quickly pointing her to what to do) but given the result would be a shared vault that would require the additional step to verify the permissions were correct (which they may be by default but one should still understand the permissions concept to know not to change things to an inappropriate state). So I reiterate my hope for multiple private vaults in the future.

@rlh: Just to clarify, no one but an Organizer would be able to create additional vaults in an account made before it was possible for "regular family members" to do that. But perhaps we'll be able to make it possible for users to have more than one Personal/Private vault in the future.

Another problem I see (and wonder if it has frustrated others) of the current status quo: all additional vaults are shared but anyone can create vaults.

To be clear, only Organizers can manage permissions on created vaults (i.e. those other than Personal/Private). We did have some feedback at first that some people did not want their (non-Organizer) family members to be able to create vaults, but overall there have been many more people glad to have that capability since then.

For my workflow, I have a second vault (shared obviously, but only I can see it) named Defunct where I throw all my old stuff that I'm just cautious enough to not delete outright. My wife would like to do the same. (Assuming my account had the ability) I'm going to guess with your current architecture, she wouldn't be able to create a vault named Defunct for herself, she'd need it to be Archive or some such. (How does 1Password tell her about name collision given she's not even aware that Defunct exists?) Multiply that by 5 Family members and you start running out of obvious, convenient names. Or has that not popped up as a problem? I can imagine lots of Family members are out there that would want vaults named Work or School of their own...

Try it. There's nothing stopping you from creating multiple vaults with the same name. It's just super confusing. You could differentiate them with unique icons, and of course give them different permissions. The important thing is to keep in mind that in your case (with an old account) only an Organizer can create and manage them. Either way, I doubt you'll run out of names unless you're making a new vault for every item, as thy can be quite diverse. ;) We've got large companies using 1Password Business though, and it comes up a bit more in that case, mainly due to UI constraints.

rlh

Try it. There's nothing stopping you from creating multiple vaults with the same name. It's just super confusing.

Oh, I guess I just assumed. :blush: I guess I'll need to balance out the convenience vs. confusion factor. Thanks for letting me know.

AGAlumB

You're very welcome! Now to go organize my vaults... :lol:

D4niel

Seems to be a hot topic :)
I am certainly surprised that one can't have more than one personal vault, I think that would be a very low hanging fruit: the creator of a vault can keep it private or make it available for share. If available for share every family administrator can invite anyone of the family, him- or herself, just like now.

Lars

@D4niel - it certainly seems to be something that's ardently wished-for among the small group of users who want it, and that's great! We all have passion for security in general and 1Password in particular or we wouldn't be here, and we feel lucky to have a user-base that's not shy about advocating for things they want to see (or not see) in 1Password as well. But I'm not sure I'd call it that hot of a topic -- our user base is in the millions these days and so what seems like a bustling thread in the forum still represents a tiny fraction of users.

To be clear, you CAN have as many "Personal" vaults as you wish -- but only the default vault called "Personal" has the specific property of being unable to be seen or shared by other Family Organizers. And to be clear about <-- that, the only way another Family Organizer could see the contents of a vault you created for yourself would be if they a) noticed it in the Vaults list and b) specifically chose to add themselves to the vault, without asking you. That's an unlikely scenario, and one we just don't build into the concept of 1Password Families. If users are worried that someone in their family with Family Organizer privileges would do that -- notice other family members creating vaults, and add themselves to those vaults without notifying or asking permission of the vault's creator -- there are multiple ways to solve that:

1. If you're a family member instead of a Family Organizer, you can use individual accounts instead: in an individual account you are lord and master of all you survey, and no one has the keys to your account except you. You can do this either instead of the Families account (i.e. - transfer all your data out of 1Password Families and into an individual account), or create an individual account in addition to the 1Password Families account, so you can keep other vaults 100% away from potential prying eyes.
2. If you're the Family Organizer and you're the one worried about this scenario because you made another family member an Organizer in order to enjoy the security of having someone else be able to recover your account, remove them as a Family Organizer. You'll be solely responsible for your account, just as you are with standalone 1Password or with an individual 1Password account, but no one else will be able to add themselves surreptitiously to any vaults you create.
3. Just use the default Personal vault instead of multiple vaults, but with a system of tags to keep things organized.

The bottom line here is that it's already possible for any family member (not just Family Organizers) to create new vaults for themselves, and those vaults will be entirely private unless the creator of the vault(s) in question chooses to invite other family members to share the vault(s). The ONLY way that's even potentially not the case is if a family member does not trust their Family Organizer(s) to respect their privacy; in other words: suspects that the Family Organizer(s) would take the proactive step of adding themselves to any privately-created vault. If I was in a case with that kind of lack of trust, I'd definitely be looking into an individual 1Password account, either in addition to or instead of my 1Password Families account.

tompave

Hello, I was pointed to this thread by a community moderator in a response to a similar thread I opened today.

I'd like to add my voice to ones of the other customers who commented on this thread. I definitely agree with their feature requests and share their use cases and concerns, but I also agree with their positive comments about the product :-)

It would seem that there is no plan to do anything about a family organizer's ability to invite themselves into other family members vaults. Honestly I was surprised to discover that it's such a polarizing issue. Anyway, since it seems that the 1Password team has an opinion that is the direct opposite of the one of the users who commented here, I suppose that there is no point in insisting.

After reading most of the comments I think that I agree with @Lars' point that 1Password for Families's price is extremely competitive, and so I can accept that it comes with some limitations. After reading the 1Password team's explanations I've come to terms with the fact that it's not really "1Password for the entire family", but more "1Password for the account owner (who pays), with the ability to add a few limited and managed accounts". If a user doesn't want the limitations of a managed account, they can get the personal one.

However, I still find the other issue mentioned at the beginning of the thread very interesting. I'm referring to what happens when a family member gets deleted, either intentionally or accidentally. (users @jordvisser and @rlh described very realistic scenarios where this could happen)

At the moment the kicked-out user would immediately lose access to all their data, which is not great. Users @rlh and @prime suggested some solutions (one and two and three) that would eliminate the problem (and likely turn the kicked-out users into new AgileBits paying customers!). The best part is that something similar is already implemented for normal accounts.

Access your data even if you stop paying

Your data is yours. Even if you cancel your subscription and your account is frozen, you can still sign in to 1Password.com or in the apps to view and export your data.

I also think that it doesn't conflict with the 1Password Team's stance that "family organizers are paying for the family account, and so should have the right to kick out any user they don't want to pay for anymore". The kicked-out users would still be removed from the family accounts, but their data wouldn't just be deleted immediately. From what I can see, each family member accesses the family account with their own email address, secret key and master password, so I suppose that they are backed by a proper "user resource" on the servers.

Has there been any further thought on that?

AGAlumB

@tompave: Not within the last 6 hours no, there haven't been any additional developments. ;) You already received a response from Ben in the other discussion, so I won't rehash all of that. Thanks for sharing your perspective though. Cheers! :)

tompave

Hi @brenty , thank you for closing the other thread :) . I wanted to do it myself to maintain forum hygiene, but I couldn't find a way.

Yes, Ben's comments were quite useful. I really valued his explanation on how 1Password for Business and Family can be combined (I didn't think that was possible), and he really clarified how the family plan is meant to be used. His post, in a way, echoed a lot of the staff's posts in this thread.

What his comment didn't do was addressing the fact that a disabled/deleted family user completely loses access to their vaults. He pointed me to this thread where I found some very good suggestions (at least, from a UX perspective), and I realized that they've just been forgotten since they've been proposed.

Ben

Yes, Ben's comments were quite useful. I really valued his explanation on how 1Password for Business and Family can be combined (I didn't think that was possible), and he really clarified how the family plan is meant to be used

I'm glad to hear that helped.

and I realized that they've just been forgotten since they've been proposed.

They haven't been forgotten, but we also haven't decided to move forward with any of them at this time. That doesn't mean we've rejected them, just that we have other irons in the fire, and no definite decision has been made either way. As such, for the time being, I'd recommend planning your setup around the current situation that exists. We'll continue to evaluate the feedback we receive from customers to help us determine what improvements may make sense.

Ben

tompave

I see, thank you for the clear comment!

Ben

You're welcome :+1: :)

Ben