How do I disable https://my.1password.com as a login? Someone can use my computer to autologin.

chr1s

If I forget to lock my laptop when I go to get coffee, someone can use my browser (Chrome with 1Password X) to auto-fill my credentials for https://my.1password.com, and gain access to my https://my.1password.com account. Can I just delete it from the list of saved logins? I was afraid to because it seems like a root login or something, and contains my Secret Key.

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided
Referrer: forum-search:How do I disable https://my.1password.com as a login? Someone can use my computer to autologin.

AGAlumB

@chr1s: I'm not sure what you're asking. 1Password won't auto-login to itself on your computer; the Master Password will be required, even if you've signed in there previously. Just reloading the page will result in that.

However, it's important to note that it isn't really safe to use a shared machine to access anything sensitive, since others could install malware either intentionally or accidentally.

chr1s

Here's a screenshot of what I mean. Seems like an intermittent bug, as it doesn't happen all the time, but definitely happens to me often.

dteare

Thanks for the screenshot, @chr1s. That's very helpful.

In your screenshot the "1Password Account (Chris..." login is being shown by 1Password X. You're right, if you select this it will fill in your password. You could delete this login but it's not going to help as 1Password X is already unlocked. Next time this happens you can see this by clicking on the 1Password icon in the toolbar and you'll see that 1Password X is unlocked and your data is viewable there.

What you'll want to do instead is go to your 1Password X settings and configure your autolock settings to be more restricted. Make sure Automatically lock 1Password is enabled and set your idle time to something relatively small that you're comfortable with.

With that said, you really should lock your computer whenever you leave it as people could do other nasty things to your computer while you're not there. Like installing a malicious extension that records your passwords or something equally as evil.

I hope that helps.

Take care,

++dave;

chr1s

Maybe. However, after 10 min, I was not logged out. My settings are as you mentioned - Automatically lock password is set and timeout is 10 min. After 10 min, it did indeed think the session had timed out as shown here, but when I clicked the icon in the toolbar (shown in the screenshot) as you suggested, it happily opened without a password. So, it violated the timeout.

AGAlumB

@chr1s: 1Password can't do that. It's not something we're able to track, as only the OS can. To clarify, I wonder if there may be some confusion about auto-lock. 1Password (X or otherwise) should only be locking if the machine has been idle for the allotted period of time. To determine this, we poll the OS, and it should only report as idle if there is no input at all — mouse, keyboard, and certainly some other input peripherals will affect this. So if you yourself weren't physically interacting with the machine for 10 minutes at all, something else is keeping it active. Do you have gaming devices, drivers, or software that may be causing this? That's typically what we see, though something as silly as speakers vibrating the mouse while music is playing have been known to keep people's machines awake. And the OS isn't going to tell us it's been idle for 10 minutes if it hasn't. It's definitely locking here, but then I don't have anything interesting going on on or around my computer. Let me know what you find. :)

chr1s

I think I get it now. There's the Chrome browser tab, which I assume is 1PX, and the icon in the toolbar, which I assume is 1P?? I may have the names confused, but I see now that they each have their own independent timeouts. If the timeout in the toolbar icon is longer than the other one, then it will let you auto-fill. I also now see that the icon can sometimes have a lock symbol next to it. It's when it's unlocked (no lock symbol) that my case comes into play.

Can't you guys sync up those two timeouts so this case can never happen? Seems like that would solve the problem, no?

AGAlumB

@chr1s: Aha! Indeed, if you're also using the 1Password desktop app, that has it's own settings and is not restricted to the browser. It may be possible for them to work together in the future, but it's even more important that they can work separately since otherwise many folks would not be able to use 1Password at all, for example on Chrome OS, Linux, or restricted company computers. Can you tell me what OS version you're using?

chr1s

My OS is macOS High Sierra 10.13.6. Just to be clear, I have 3 'clients' - the 1P Chrome extension, the 1PX Chrome extension, and the native app. I'm talking about the timeouts in the first 2 - what I am calling the icon in the Chrome toolbar and the Chrome tab.

AGAlumB

@chr1s: Confusing, I'll grant, but technically that's two: 1Password X and the 1Password desktop app/extension. The latter is operated solely but the native app; the extension is just a way to interface with the browser. So they are also one in the same with regard to security settings. Only 1Password X will have separate settings then in your case. Less to troubleshoot. But is there a specific reason you're using both 1Password X and the desktop app/extension combo? You can certainly do so, but we don't recommend using both silly because that can cause confusion like this. Let me know what you think. :)

chr1s

These are the 2 timers I'm talking about. I took your advice and uninstalled the desktop/extension, so that's out of the picture now.

AGAlumB

@chr1s: Okay, thanks for clarifying. Those are not at all related: The first screenshot if for the 1Password.com website, and the second is for the 1Password X extension. As you can see, these have different settings. The only exception, where these two do interact, is that if you're using 1Password X unlocked, and you select Edit, it can open the 1Password.com web interface using 1Password X's existing session. Otherwise, if you go to the website yourself, you'll need to enter your Master Password; and if you're using the website and then open 1Password X you'll need to enter your Master Password there at first too. Again, I'm sorry for the confusion there, but does that help?

chr1s

I think I'm good now that I understand how everything works. Thanks. What I'm doing is to have the 1PX timeout set shorter than the one on the website. That seems to have solved my problem.

AGAlumB

Ah, nice idea. I'm glad that works for you. Cheers! :)