Showing passwords without reentering Master
I'm rather new to 1Password but one annoying thing is that i need to have the app unlocked in order to use my passwords in browsers. But while 1Password is unlocked i can have a look at all clear passwords without reentering the master password.
In my opinion the native OS X keychain solves this better. Even if you have unlocked a keychain (to use it in safari or in other applications) you have to reenter your user password to reveal the clear text.
Is there an option to change it? I don't want to have 1Password unlocked all the time when i need a password while I'm using Safari. If a colleague is using my mac for a couple of minutes, 1Password won't lock automatically if I'm not doing it (maybe i forget it) and then he could lookup all the plain passwords -> that's not nice.
Am I getting something wrong cause I'm a newbie on 1Password or can I change this behavior?
Comments
-
Hi @mrVVoo,
Thanks for writing in to us about 1Password! I'm sorry to hear that you're having difficulties here right now. Luckily we can get this straightened out pretty simply.
You're right, 1Password does need to be unlocked in order to user your data in the browser extensions. But your passwords certainly don't have to be displayed in clear text. Go to Preferences > Security and under 'Display' check the option to 'Conceal passwords'. While this option is selected, you can still view individual passwords while tapping the option key when you are viewing an entry, but all passwords will, by default, be concealed.
If you are using a publicly accessible computer, you might want to take a look at the other settings under Preferences > Security and ensure that they are set in a way that works for you. And remember, you can always click the lock icon in the main app or use Command-Option-Control-L to lock 1Password if you are stepping away from the computer. :)
0 -
And if you are willing to keep unlocking 1PW when needed, you can always set the lock time to a very short period in Preferences, Security.
0 -
Please could you add the option to require the vault password to be entered to reveal any concealed password, even if the vault is unlocked? That's how Apple's keychain does it (as noted by the OP), and that's how it should be.
0 -
Hi Mr. H,
Thanks so much for adding your thoughts here. I'm not quite sure this would be a feature we would implement though. Think about it this way. Unlocking your vault gives you access to your data. Would you really want to have to enter your Master Password again just to view the data you just unlocked? I would suggest following @danco's advice above and perhaps setting more strict Security Settings if you are concerned about your data.
0 -
Hi @Megan, I fail to see what harm it would do to give people the option﹡ to do this. As I said, this is what the Apple Keychain does, so it’s not some unheard of batshit crazy idea. By default, the login keychain, (and, in Mavericks the “local items” keychain) unlock automatically upon login and don’t lock again until logout. Any app that has been previously granted access to an item in either of those keychains, can then access the information without you having to enter the keychain password. But, if an app (including the Keychain Access app) hasn’t been granted access before, you still have to enter the keychain password to get at the info. For example, try this:
- Open Keychain Access and note that the login keychain is unlocked.
- Double-click any entry whose “kind” contains the word “password”.
- Tick the “show password” tick box.
Now, unless this is an item you have previously given “Keychain Access” the right to access, you will be presented with a dialogue saying:
“Keychain Access wants to use your confidential information stored in “[name of whatever you clicked on in step 2]” in your keychain.
To allow this, enter the “login” keychain password.Underneath this, is a box to enter your password and three buttons: “Always Allow”, “Deny”, and “Allow”
If you enter the correct keychain password and click “Allow”, the password of the item will be revealed, but for that one time only. Unclicking and re-clicking the “show password” tick box, or quitting and relaunching Keychain Access, will result in the same dialogue appearing. If you click “Always Allow”, Keychain Access from that point forward will show the password upon ticking the “show password” checkbox, without asking for the keychain password.
This mechanism prevents apps from harvesting the keychain and several other nefarious uses of items in the keychain, even if the keychain is unlocked. It allows the convenience of having the keychain always unlocked, without risking easily giving away all the passwords contained within.
The fact that you have (IMHO, and obviously Apple’s too) implemented vault security in a lax way is one of a few things that prevents me from embracing 1Password fully (I just use it as a form filler and for non-sensitive passwords such as those for online forums).
﹡ What I envision here is a tick-box in the “Advanced” section of preferences that reads something like “Always require vault password to reveal passwords” which when ticked would do just that, but would still allow vault items to be used in web browsers etc. without re-entering the vault password. Just like the Apple keychain.
0 -
Hi Mr. H,
First of all, we strive to keep things simple and don't want to overwhelm users with too many options. And considering we get "can you add x as an option" requests all the time, it could easily turn into "options gone wild". That's why we're reluctant to add new options.
But, more importantly, this is a case of security through obscurity. Trying to "hide" your data by not allowing someone to reveal a password using the 1Password app, while still allowing them to fill it in a browser, provides little to no security. We tend to stay away from features that may make people feel more secure, while not actually increasing security.
There are two problems that come to mind:
If an attacker wants to gain access to one of your accounts, they could simply login using auto-fill via the browser extension. They don't need to see your password to access your account (and steal info or do damage). And, while they have access, they could even change your password.
But, if that's not good enough for an attacker, and for some reason they really want to know what your actual password is, they could do that as well. One very simple way to do this is filling your login into a webpage, then modifying the
inputfield fromtype="password"totype="text". This will reveal your password.
If you're concerned about someone accessing your 1Password data, it's best to lock your vault completely. 1Password's auto-lock options, and/or keyboard shortcut (Command-Option-Control-L) make this easy.
It's also worth mentioning that only the minimal amount of data that needs to be available is decrypted at any one time. The rest of your data (not currently in use) stays encrypted.
With that said, thanks for the feedback! We never say never, so I will certainly pass your feedback along to our developers.
0 -
Hi @JasperP thank you for your detailed reply
Trying to "hide" your data by not allowing someone to reveal a password using the 1Password app, while still allowing them to fill it in a browser, provides little to no security
It prevents idle snooping without the inconvenience of having to unlock your vault all the time. You may have seen that I have also provided feedback about the multiple vaults feature (feedback which echoes feedback from others), and my feedback all couples together - if the multiple vaults feature was implemented better (fully independent vaults with their own auto-lock settings) then my really important stuff would be in a vault that auto-locks very quickly. The less sensitive stuff would be in vault that I would basically leave open all the time, and having the feature suggested in this thread would prevent idle snooping of all the passwords within. It’s how I have Apple keychains set up already and it works very well.
0
