Old credentials on 1password.com account
Hi, currently trying out families account on Windows. If I change both my secret key and master password to new ones, but then try to login to my 1password account with my old secret key and old master password, then would I still be able to login to my 1password account and access my data?
Comments
-
No, when you change your Secret Key or Master Password with a 1Password membership the old ones will no longer be accepted. I hope that helps. Should you have any other questions or concerns, please feel free to ask.
Ben
0 -
The way you described, is what I would much like to see, but when I read the whitepaper, I saw this, which made me concerned. So is this snippet from the whitepaper not valid for the 1password.com account and does this mean that the personal keyset does change on changing the master password and/or the secret key?
Master Password changes don’t change keysets
A change of Master Password or Secret Key does not create a new personal
keyset; it only changes the Master Unlock Key (MUK) with which
the personal keyset is encrypted. Thus an attacker who gains access
to a victim’s old personal keyset can decrypt it with an old Master Password
and old Secret Key and use that to decrypt data that has been
created by the victim after the change of the Master Password.Your mitigations
A user’s personal keyset may be replaced by voluntarily requesting
that their account be recovered. This will create a new personal keyset
which will be used to re-encrypt all of the vault keys and other items
which were encrypted with the previous personal keyset.0 -
Maybe I'm misunderstanding your question, but the personal keyset is not the Master Password and/or Secret Key. Try it. Create a 1Password.com account and set the Master Password. Then change the Master Password and try to log in with the old one. It won't work. :) But the whitepaper is correct that the personal keyset does not change unless going through recovery.
Ben
ref: XMP-85994-937
0 -
You are correct Ben, I cannot login with the old password. So that is very helpful. Your white paper and responses have been nothing but outstanding. However, in making a decision to put all my eggs in one basket with 1password, i'm thinking from a business continuity purpose. I guess my question then is:
- Let's say I make a local backup of my data by copying my Windows profile data today in an external hard drive
- Tomorrow, I change both my master password and secret key in 1password.com
- The day after changing them - in the event of a scenario where 1password.com site is not available for any reason and my current machine fails as well - if I need to access my passwords from my profile backup using a new installation of Windows 10 1password app on a different Windows 10 machine, will I be able to use my old master password and secret key to access my data (noting that this data backup was done before the master password and secret key were changed)?
- Will the new master password and secret key combination be able to open my backed up 1password data?
Please let me know if you would like me to clarify this. I understand that this could be a far fetched scenario, but then this is important for me to make a decision, especially if I will be putting important data in this solution. So I would appreciate your thoughts.
0 -
@nis: Unless you disconnected your computer from the internet completely (and leave it offline) before you change your account credentials, you'll be prompted there to update them immediately, so they will be up to date as well. So that would work for you in that case. And keep in mind that even if your computer is lost, stolen, or destroyed, you'll be able to access your data on the next one by signing into your account, either in the app or in your browser. Everything you save in 1Password is backed up on the server automatically. Does that help? :)
0 -
Hi @brenty, i do understand that. But maybe I'm not articulating my question to get to the matter correctly.
So let me put my question other way -Is the sync of data happening in real time for all my authorized devices so that a password change on 1password.com via a browser, will force all devices immediately to expect the new password going forward?
Is there any scenario in which a bad actor can get into my data if somehow they got hold of my old password and secret key?
Thanks!
0 -
@nis: Sure thing. I’m sorry for misunderstanding.
- Indeed, any changes will be sent to the server if the device is online when you make them. In your example, that would be a given since you’d need to have Internet access to use the website. At that point, the server will also send those changes to your other devices, provided they are also online at that time. Otherwise they will connect the next chance they get.
- If someone has all of your account credentials, they can use them to sign in and decrypt the data just as you can. If you believe that your Master Password and/or Secret Key has been compromises, you can change them from your Profile page in your account.
Does that answer your questions? Please let me know. :)
0 -
@brenty, i guess i was confused by reading the whitepaper (paralysis by analysis :smile: ), especially the section i quoted in my earlier response in this thread. Based on your responses, it sounds like if I am concerned about my credentials getting compromised, then just changing them will be sufficient. Also, that would mean, that it is not necessary for me to create a new vault to mitigate this compromise per the section given below form the whitepaper, correct? Once I get this final confirmation, my questions would be satisfied in full. Thank you for your patience and your awesome responses :smile:
Your mitigations
A user’s personal keyset may be replaced by voluntarily requesting
that their account be recovered. This will create a new personal keyset
which will be used to re-encrypt all of the vault keys and other items
which were encrypted with the previous personal keyset.0 -
@nis: I can relate! It's pretty dense, and I had to read it, ask some questions, and read it again before it all clicked for me. So if you appreciate my replies to your own questions (thank you for the kind words!), I have to say it's only because I have the benefit of the expertise and patience of these awesome people here at AgileBits. :blush:
To try to tie it all together, I think it's important to consider that the passage you're referring to is very much a worst-case scenario. In that case, someone has already gotten your account credentials and accessed it (that's how they can get the keyset and decrypt it). If that happens, yes, you will need to take steps to get a new keyset. But on the plus side, if someone signs into your account, you'll be notified. You then know that they have your account credentials, and you can change them immediately.
But there's an important fact that I don't want to gloss over: in order to get your Master Password, Secret Key, and the rest, they would need to get them from you. We never have these, as they are literally never transmitted to us (that's why we use SRP, to avoid being in that position). Additionally, the Secret Key is only ever used when authorizing a device in the first place, so that also limits the situations where it could be captured. For example, the vast majority of the time, even if someone could observe you entering your Master Password and learn it that way, you will not be doing the same with your Secret Key. So they would have to get direct access to one of your authorized devices to make use of that. They could not sign into your account on a new device without the Secret Key. Let me know if that helps. :)
0 -
Thanks @brenty :smile: The whitepaper is really good. And i'm glad that you guys have published it. Also, as you said, you have the luxury of asking questions to your team members, and I'll take this forum as a substitute :smile:
Your response does help a lot and has clarified my concerns. I am curious about one thing though that you mentioned in your reply. It's about "that's how they can get the keyset and decrypt it". This also ties in with story 9 where Mr. Talk is able to copy the keys.
Saturday Mr. Talk decrypts the data he stole on Friday
using the keys he saved on Tuesday and then is able
to see the hiding place that Patty added on Thursday.Basically, if someone does access my 1password.com account after getting the credentials, is it simple enough for them to copy the keys before the password is changed? Like Mr Talk in the story, will that person be able to decrypt my data with old credentials if they have made a copy of the data along with a copy of the keys when they accessed my account (me being Ms Molly in this case) :smile: ?
0 -
Thanks @brenty :smile: The whitepaper is really good. And i'm glad that you guys have published it. Also, as you said, you have the luxury of asking questions to your team members, and I'll take this forum as a substitute :smile:
@nis: Glad to hear it! What I meant was that while it's arguably a bit easier for me to have an in-depth conversation with the folks working on all of this, the reason that's valuable (other than because I'm a curious nerd) is that I can better answer questions like yours as a result. But when I don't know the answer, I am happy to poke someone else to respond directly. ;)
Your response does help a lot and has clarified my concerns. I am curious about one thing though that you mentioned in your reply. It's about "that's how they can get the keyset and decrypt it". This also ties in with story 9 where Mr. Talk is able to copy the keys.
Ah, that's a great point. There's a lot of ways, but they would all involve some pretty significant security lapse, either on our part or yours:
- They break into the server and compromise its security.
- They break into one of your devices and compromise its security.
The first one, for us, is obviously very scary, because it's literally the company at stake. For you, while that may sound dire, our paranoia and real-world motivation (our livelihood) should hopefully provide some comfort, as this means that we have not only cryptographic, system-level, and organizational protections in place to defend against attack, we also participate in external audits and cooperate with independent security researchers to find any flaws so we can fix them. So, ultimately, since you and I personally probably have a less stringent defense in place (after all, we use our devices for things other than securing data — 1Password.com server infrastructure is used for nothing else — and we also manage our operational security ourselves), it will be much easier for someone to compromise our personal security. And, of course, they would still need our Master Password and Secret Key to be able to decrypt our personal keyset in order for it to be of use to them...and they cannot get either of those from AgileBits. So essentially we're talking about a true worst-case scenario, which necessarily involves you being compromised on some level.
0 -
Glad to help! And, rather than giving me nightmares, I find it comforting to have a good overview of things so I can take the necessary precautions and not worry about it. Hopefully this helps you get there too. :chuffed:
0
