Master Password gets replaced during Wi-Fi Sync between PC and Android
This one drove me crazy...
When the Wi-Fi Sync process starts (by running the option in 1Password for Windows then selecting Sync in 1Password for Android) 1Password for Windows asks for the Master Password. Once entered 1Password for Android does the same (i.e. asks for the Master Password). If all successful, syncing takes place.
Problem is.... you can enter any password whatsoever in 1Password for Windows when it asks for the Master Password. Then you enter that same password (which is now other than the Master Password) in 1Password for Android who is however asking for the Master Password. As long as the passwords match even if it is not the Master Password, the syncing successfully takes place. What is worse, the Master Password on 1Password for Android gets wiped out and replaced with this new password!
Needless to say I spent one hour at least trying to get my 1Password Android to unlock at no avail obviously since it seems I typed the Master Password on 1Password Windows incorrectly so this incorrect password replaced the Master Password in 1Password Android. Anyways...I had to clear the 1Password Android data to wipe the vault and start over. Luckily the changes I made in 1Password Android's vault got sync'ed so I didn't lose them...man....
First of all...please fix this. Second, this critical issue brings up some questions:
1- Does the password gets transmitted to 1Password Android in plain text? Or does it get transmitted encrypted? and more importantly,
2- If the Master Password was provided on the very first original sync (i.e. when the secret is entered in 1Password Android) and the 1Password for Android already has it why do you need to transmit the password again on every Wi-Fi Sync? This to me is another security flaw. Rather the Master Password should be provided individually in 1Password Windows and in 1Password Android without transmitting it over the Wi-Fi network. You could just transmit an acknowledgment of successful password entry which is hashed using the secret and Master Password (or whatever super duper crypto method is used now days to verify).
Please fix the issue and reconsider changing this protocol...seems flawed. The only reason I see you need to transmit the password every time over Wi-Fi before syncing is if the user changed the password on any of the vaults (Windows and/or Android). But that would defeat the purpose of "1Password" wouldn't it? The whole point is to only know guess what...One password!
I can't wait for SQRL (Secure Quick Reliable Login) to be adopted universally so we don't have to deal with passwords anymore....man...
Thank you.
PC OS: Windows 10
1Password Windows version: 4.6.0.604
Android version: 5.1.1
1Password Android version: 6.3.3
1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided
Comments
-
Hi @AlphaParanoid. Thanks for getting in touch with us. :)
What you're describing is actually not a bug, but the designed behavior. Unlike 1Password on Mac, 1Password 4 for Windows does not have an OPVault based internal database, which means the Master Password is not stored in memory. Consequently, 1Password 4 for Windows needs to create an in-memory OPVault for every Wi-Fi Sync session. We refer to this as the “transport vault."
When you initiate sync, you're prompted for the Master Password on Windows in order to encrypt this transport vault. . If you give it your vault Master Password, then 1Password on Android can decrypt it, but if you give it anything else, then 1Password on Android will prompt you for your transport password, then decrypt and import your transport vault. This then becomes the Master Password on Android, and then you'll need to use the correct transport password every time you want to Wi-Fi sync in the future. Essentially, it's not asking for your 1Password 4 for Windows Master Password, it's asking for your 1Password for Android's Master Password, which you just designated during sync.
That said, we've recently introduced 1Password 6 for Windows in beta, and I don't believe we will be making many changes to 1Password 4 from here on out. Sorry for the little bit of a scare that caused you! Don't worry, though. :)
Let us know if you have any other questions or problems!
0 -
@peri Thank you for the prompt reply. AgileBits needs to find a better way to do this. The whole point of a password manager is to only be aware of one password, the one that opens the vault. That password needs to be a strong one which means it is easy to enter a wrong character when entering it.
Do you see the problem? AgileBits is assuming that the password entered on the PC side when Wi-Fi syncing when it doesn't match the master password is a new password the user wants to use. This is a bad assumption. Again the whole point of a password manager is to only know one password. What you're doing by replacing the password on the Android side is driving people crazy because it is simply not expected. I have seen posts here where people complain their Android vault doesn't recognize their master password. I'm sure this is what is happening to them. They must have misspelled their master password at sync time on the PC side and now that new password became their master password on their Android side. Now, the user have two different passwords and he/she doesn't even know what the second one is!
If AgileBits wants to keep on using this way then at least notify the user when the master password gets entered incorrectly and don't continue until the user enters the master password correctly. This is just to avoid having multiple passwords for the same vault.
Thanks again.
0 -
Thank you for the prompt reply. AgileBits needs to find a better way to do this. The whole point of a password manager is to only be aware of one password, the one that opens the vault. That password needs to be a strong one which means it is easy to enter a wrong character when entering it.
@AlphaParanoid: I tend to agree with you, but not everyone else does. We have a lot of requests to make it possible to lock and unlock individual vaults separately in 1Password for Mac, for example. I guess the grass is always greener on the other side! :lol:
So while, much like pizza toppings, we can't all agree on the vault/password question, I think we can agree that you make some excellent points when it comes to usability. It can definitely be confusing to the user, and that doesn't help anyone. So we're working to improve this in the next version of 1Password, and also overall consistency between platforms. I'm sorry that this doesn't help you today, but it's very much something we're thinking about daily. We can't change the past, only try to make things better today and in the future. And your feedback (and that of other customers) is a great help when it comes to developing 1Password going forward. :)
0
