Is there one place with full explanation of how vaults work on Mac, where they're stored, etc.?

Options
jeffreyrodman
jeffreyrodman
Community Member

I am an engineer who has become totally confused since moving to 1Password 7. Where vaults are located, where they were in 6, what are best practices, how this ties in with Dropbox, multiple vaults, how it's different with a subscription vs one-time purchase (almost dropped my teeth when I realized that signing up made things worse instead of better) etc. The Forum is better than nothing but it's a collection of fragmented answers about different versions written at different times and varying validity. www.dropbox.com/guide leads me to the Business version which is not what I have. The guide at http://tic-recherche.crifpe.ca/docs/guides/en/Dropbox_guide.pdf is undated, so I can't really trust that. And the Dropbox website itself, where I look for the how-to and guides, is all marketing stuff, which is of no help.

Come on, guys! I like 1Password, but can no longer use it reliably! I don't want to start looking at Dashlane, Keeper etc., but If this doesn't get better I will have to. Please write a decent guide and make your website useful again, that's all I ask.


1Password Version: 7.2.1
Extension Version: 7.2.1
OS Version: OS X 10.14
Sync Type: Dropbox
Referrer: forum-search:how vaults work

Comments

  • Jono_A
    Jono_A
    Community Member
    edited October 2018
    Options

    I'm also confused! It seems since migrating to 1password 7 my "Personal" vault under my account name is now synced with Agilebits servers? Is this correct? On my iPhone I now have the new Personal vault and my Primary vault that syncs with iCloud (that I always used before) - so now everything is duplicated. Can I delete the primary vault on iCloud since the new personal vault is syncing with your servers?! Help!

  • macindigo
    macindigo
    Community Member
    Options

    I use 1Password version 6.3.3, Safari extension version 4.7.3, running under OS X 10.11.6 and sync, when required with WLAN server. Under this configuration, 1Password runs the way it was originally designed to do with no issues whatsoever.

    I’m retired from the IT industry/software industry with about 38 years experience in system & applications programming. Therefore, I’m comfortable with reliable, old school practices and I do not upgrade operating systems without good reason. The same with critical applications.

    Why version 6.3.3 ? Let me explain.

    In general, most professional software vendors maintain a version history of their product. This is an invaluable resource to help determine when and if you should update software.

    1Password’s version history is here: https://app-updates.agilebits.com/product_history/OPM4#v684001

    In the version history, take a look at the notes for version 6.3.3. Basically, this was a release of 1Password that incorporated support for High Sierra. About a month later, version 6.3.4 was released that “Improves verification and authentication of communication with the 1Password browser extension”. The version history does not explain why this was done.

    However, the 6.3.5 release, two days later reveals that there are problems with the changes made in 6.3.4. Then take a look at the notes for the following 6.5.1 version released about a month later. The release notes show that there are major issues with many changes made to 1Password. This may be where 1Password was being changed to lay the groundwork for subscriptions. The version history clearly shows that version 6.3.3 is a stable release.

    Jeffrey, the OP, asks about 1Password vault storage.

    1Password 6.3.3, stores its vaults in the ~/Library/Application Support/1Password 4 folder.

    In addition, two preference files are used. ~/Library/Preferences/2BUA8C4S2C.com.agilebits.onepassword4-helper.plist and ~/Library/Preferences/com.agilebits.onepassword4.plist.

    This means it’s easy to set up 1Password on another machine. Simply install the 1Password application, copy the vault folder and two preference files to their respective locations on the new machine and you’re done. No syncing required and takes a few minutes.

    Syncing anything has always been problematic because it cannot determine intent. For example, if you delete something and then sync, should the missing item be replaced on the machine where it is missing or deleted from the machine where it exists.

    My iPhone has 1Password installed. However, the iPhone is just a convenience and I don’t create new 1Password records with it. That is all done on an iMac and I then copy the 1Password data from the iMac to the iPhone.

    To copy instead of sync, first erase all 1Password data from the iPhone and then do a WLAN sync. This, in effect, bypasses the sync logic and results in a copy as no records exist and so they are all added.

    The erase 1Password data function is under the Settings>Advanced menu of the iPhone app.

    Agree with the OP about making the website useful again. As it reads now, it appears that a subscription will solve all problems known to mankind :-)

  • Lars
    Lars
    1Password Alumni
    Options

    @jeffreyrodman - I'm sorry for the confusion. The forum is a place for users to get answers to specific questions. Although we get a lot of "this is my issue too" in here, it's often not the case; certain issues seem like other ones, but aren't, etc. And of course searches on Google which turn up answers from three or four years ago may just as likely to be totally inapplicable any more due to changes in 1Password or in macOS, as they are to still be accurate. It's best to ask us directly if you can't find what you're certain is the correct answer to your specific problem. We encourage people to look around, both here and at our dedicated support site (which, unlike this forum, will always have only up-to-date information about 1Password). But we also are here to help if you can't find the answer you're looking for.

    ...I realized that signing up made things worse instead of better

    I'm sorry to hear that; 1password.com accounts are actually much simpler to use on a day-to-day basis in many ways than standalone 1Password, but if you're an existing standalone user, there is definitely a transition, both literal (of your data) and figurative (learning the new way).

    I'm happy to help, but I didn't see much in the way of questions in your post. I'll answer what I can: your 1Password data is indeed in a different place in 1Password 7 for Mac than it was in 1Password for Mac 4-6:

    In 1Password for Mac 4-6

    • if your copy of 1Password was from the Mac App Store, your data is located at: ~/Library/Containers/2BUA8C4S2C.com.agilebits.onepassword-osx-helper/Data/Library/Data/OnePassword.sqlite
    • if your copy of 1Password was from AgileBits: ~/Library/Application Support/1Password 4/Data/OnePassword.sqlite

    In 1Password 7 for Mac, regardless of where you got it from, your data is at: ~/Library/Group Containers/2BUA8C4S2C.com.agilebits/Library/Application Support/1Password/Data

    Can you say a little more about "best practices?" Regarding what, specifically?

    ...how this ties in with Dropbox

    How what ties in with Dropbox? You mean a 1password.com account? It doesn't - 1password.com is (among other things) an entirely separate sync mechanism -- one that we wrote both ends of (client and server), to handle nothing but your 1Password data, which is why it's a superior method of sync. To be clear, you don't need to have a 1password.com account to use 1Password 7 for Mac or vice-versa; we still sell standalone licenses for 1Password for Mac in version 7.

    I'm unclear on your references to Dropbox -- what is it specifically that you'd like help with? Dropbox sync is still available in 1Password 7 for Mac as well, if you have standalone (local) vaults. If you intentionally or inadvertently created a 1password.com account and migrated over your vaults, you don't need Dropbox any longer -- your data is already in sync; just sign into your account on each device you want to use 1Password on, and you're done.

  • Lars
    Lars
    1Password Alumni
    Options

    Welcome to the forum, @Jono_A!

    It seems since migrating to 1password 7 my "Personal" vault under my account name is now synced with Agilebits servers? Is this correct?

    Yes. :)

    Can I delete the primary vault on iCloud since the new personal vault is syncing with your servers?!

    Yes. :) Can, and should. In 1Password for iOS, tap Settings > Vaults > Primary > Delete Vault, and you'll be running only your 1password.com Personal vault. Make sure there is no data still in your Primary vault that ISN'T already in your Personal vault before you remove the Personal vault. If there are a few things, use these instructions to move any items over and you should be all set. Let us know if you have questions, however. :)

  • Jono_A
    Jono_A
    Community Member
    Options

    Thank you!! Much appreciated

  • Lars
    Lars
    1Password Alumni
    Options

    @macindigo - I'm not even sure where to begin with that. But I think this is probably the best place:

    I’m retired from the IT industry/software industry with about 38 years experience in system & applications programming. Therefore, I’m comfortable with reliable, old school practices...

    That alone separates you from all but the tiniest fraction of our current user base. Back in 2007, 2008, when most people had no idea what a password manager even was, let alone what it did or why they might want to use one, our user base was orders of magnitude smaller than it is today, and our average user looked much more like you than new users today: tech-literate, "comfortable with old-school practices" and whatnot. But those times have changed considerably, and the average new user of today much more closely resembles your mom -- or your grandma -- than they resemble you. I'm glad you're comfortable running versions of OS that are three versions from current (OS X El Capitan was first released in July of 2015), and versions of 1Password that are now in legacy status and more than two years out of date...but it's simply not a strategy we can, as a security company, recommend to ordinary users.

    In the version history, take a look at the notes for version 6.3.3. Basically, this was a release of 1Password that incorporated support for High Sierra. About a month later, version 6.3.4 was released that “Improves verification and authentication of communication with the 1Password browser extension”. The version history does not explain why this was done.

    However, the 6.3.5 release, two days later reveals that there are problems with the changes made in 6.3.4. Then take a look at the notes for the following 6.5.1 version released about a month later. The release notes show that there are major issues with many changes made to 1Password. This may be where 1Password was being changed to lay the groundwork for subscriptions. The version history clearly shows that version 6.3.3 is a stable release.

    None of that's really accurate. 6.5.1 was released on November 16, 2016...just over a full year after 1Password accounts became available, so it's definitely not the case that 6.5.1 was "...where 1Password was being changed to lay the groundwork for subscriptions." It's also not the case that 6.3.4's release notes do "not explain why...[it]...improves verification and authentication of communication with the 1Password browser extension." In fact, it says why it was done, right there in the release notes:

    Today’s update brings a small change to how 1Password communicates with the 1Password extension in your web browser. Once you update to the latest version of our browser extension you will be prompted to verify 1Password’s connection to the extension in the form of a six-digit code. (emphasis added)

    Doing so adds another layer of security between in the communication between the mini and the browser extension so that a rogue process would have a harder time impersonating the extension. We've even got an entire page devoted to documenting this, which includes the note at the bottom:

    Browser authorization was introduced in 1Password for Mac 6.3.4 and 1Password for Windows 4.6.1. Earlier versions of 1Password didn’t have this feature. (emphasis added)

    If we wanted to make our updates and changes obscure and opaque to the user, we'd simply write release notes like much of the App Store does: "bug fixes and improvements." Instead, we take pains to write considerably lengthier ones because we think users should have an idea (if they want to know) what's being done in each release. It would be kind of pointless to add all that description, then use it to try to elide what was really happening. We're glad to have you here on this forum, but please do try to refrain from the groundless speculation about what the "last stable version" was or suggesting other users will be better off using years-old versions and manually WLAN syncing their data as the best method. Thanks. :)

  • Lars
    Lars
    1Password Alumni
    Options

    @Jono_A - you're quite welcome. Glad I was able to assist. :)

  • macindigo
    macindigo
    Community Member
    Options

    Lars, thanks for the link to the document that discusses browser authentication, introduced in version 6.3.4. To me, the version history is clear that this was done but not why. This 2018 document is helpful on why.

    The intent of my original post is not groundless nor grounded speculation. Rather, it is a description of an implementation that does what it needs to do (manage passwords) and is trouble-free. Whether or not this information is useful to someone else, I can’t say but this is a community forum after all.

    You’re right that OS X El Capitan was released in 2015 but it should also be noted that Apple supported El Capitan up until a few weeks ago when Mojave became available. Not only is El Capitan current as of now but it also has the benefit of having had 3 years of maintenance.

    I value software functionality and reliability more than having the latest shiny new feature :-)

  • Lars
    Lars
    1Password Alumni
    Options

    @macindigo - I'm glad the support page link was helpful in filling in some of the backstory. :)

    I value software functionality and reliability more than having the latest shiny new feature.

    Doesn't that describe most people? Most people (I assume including you) DO want the latest newshiny...but not if it comes at the expense of the usability of the thing in question. Nobody wants a new iPhone - or a new app - if it doesn't...y'know...work. And it's certainly true that brand-new releases of anything often have bugs in them that slipped past even the most vigilant/careful development and QA process, and also that time and user discovery/input often results in many of these things being hammered out/fixed, resulting in a more stable product overall. So waiting briefly to adopt the latest release of anything is usually at the very least harmless and often prudent.

    However, it's also true that there's a downslope to that hill as well -- waiting TOO long in an environment where there are many factors and players can and often does mean that unless one is willing to leave all aspects of one's setup carefully frozen in amber like one of Spielberg's prehistoric mosquitos, inconsistencies and even incompatibilities dangerous enough to result in data loss can result. A casual glance over these forums will show you hundreds of examples of people who, for one reason or another, chose to stick with a very old version of 1Password for Mac -- or perhaps of OS X -- while, at the same time, insisting on the latest and greatest versions of, say, their 3rd party browsers, and it resulted in trouble.

    This thread from our iOS forum, is into its 9th page and twelfth month, because 1Password 3 for iOS was a 32-bit app, and as of iOS 11, Apple has removed the ability to run 32 bit apps...and we CAN'T update it because it's not the current version. So anyone still running 1Password 3 for iOS -- which was great in its day and VERY stable by the end of its life -- was and will continue to be completely out of luck as soon as they get a new phone or upgrade their iOS version to 11 or 12. Literally in an instant, a person can go from having dozens or hundreds of items in a fully-functioning copy of 1Password 3 for iOS to losing all their data entirely. Sometimes, we can help recover it, depending on whether they had backups/sync and other factors...but sometimes we can't. That's a direct result of using an old version too long while insisting on making other parts of their setup as current as possible: eventually, stuff just breaks, for any of a galaxy of reasons.

    Even in the cases we CAN help people recover their data, it takes a ton of time and effort, both on their part and on our own (witness the steps in that thread, then imagine that we had to cover that same ground individually in private email conversations with nearly everyone in that thread, often over many days, to get an idea of how much time's been spent on it). This is all time everyone involved - the users and us - could've used more productively...and that's in the best of cases. Sometimes, we've had to tell people: I'm sorry but there's nothing we can do for you in this case; your data cannot be recovered. So please believe me when I tell you that we're quite aware that the longer a version's been out, the more bugs get squashed and more stable it can tend to be, but that we just can't recommend users do anything but use the most-current versions of macOS, their browser, and 1Password, for the reasons above. And while we're always tickled to see users here interacting with one another, this isn't a community forum like Reddit or even Facebook; it's a forum maintained and curated by us for the express purpose of assisting 1Password users who are having problems. Thanks for understanding, and for participating.

  • macindigo
    macindigo
    Community Member
    Options

    Lars, interesting reading, that IOS thread about 32 bit apps.

    It appears that this situation developed due to two things. 1: Insufficient research on the implications of upgrading IOS and 2: Not having an application independent backup of 1Password data.

    Two major shortcomings of IOS and Apple iPhone policy are that there is no user UI into the file system and no straightforward way of regressing to a previous version of IOS. Therefore, in my book, an iPhone cannot be relied upon as the sole repository of data. A strategy needs to be in place that enables complete data recovery without involving IOS in any form.

    To Agilebits credit, creating an application independent backup is easy to do on a Mac. Export all 1Password items and then use Disk Utility to create a 256-bit encrypted dmg of the export folder.

  • AGAlumB
    AGAlumB
    1Password Alumni
    Options

    It appears that this situation developed due to two things. 1: Insufficient research on the implications of upgrading IOS and 2: Not having an application independent backup of 1Password data.

    @macindigo: Yeah, as someone who is the one helping most of the people dealing with that particular issue, I really don't think that's a fair assessment at all. After all, this is the logical conclusion of the philosophy you espoused earlier about valuing "trouble-free" and "reliability" over new stuff. I felt a little bit bad writing that because I laughed a little bit, until I realized I was wincing, not smiling. Situations like that suck for people more than you will hopefully ever come to know...but you will if you wait long enough. I think that's was the point Lars was trying to make, and I can tell you from experience that it is painfully true. In practice we can't expect most people to "research" stuff like this, because they don't. Same goes for backups. If the tables were turned, that could just as easily be you or me. :(

    Two major shortcomings of IOS and Apple iPhone policy are that there is no user UI into the file system and no straightforward way of regressing to a previous version of IOS. Therefore, in my book, an iPhone cannot be relied upon as the sole repository of data. A strategy needs to be in place that enables complete data recovery without involving IOS in any form.

    While I do want to be clear that this isn't a platform for discussing "Apple policy", the thing you're pointing toward has nothing at all to do with iPhones or Apple; rather, it's about the importance of backing up. The fact is that with 1Password.com memberships, there is a solution to that problem for 1Password users: they just never have to think about it (which is good, because most of them won't anyway), as everything in the account is automatically backed up offsite, so even if all their devices are lost, stolen, or destroyed, they just need to sign in with their account credentials to get their data back.

    To Agilebits credit, creating an application independent backup is easy to do on a Mac. Export all 1Password items and then use Disk Utility to create a 256-bit encrypted dmg of the export folder.

    Indeed. We also have built a backup/restore feature into the iOS app since the beginning. Getting people to use it, however, was the challenge. :blush:

  • macindigo
    macindigo
    Community Member
    Options

    In practice we can't expect most people to "research" stuff like this, because they don't. Same goes for backups. If the tables were turned, that could just as easily be you or me.

    Brenty, thanks for the response although I’m not quite clear on it’s point. It appears to me that, in essence, you’re agreeing with my unfair assessment :-)

    I do have a question re the IOS backup. The sqlite database in the backup; is that an identical copy of the IOS working database or something for backup & restore use only?

  • AGAlumB
    AGAlumB
    1Password Alumni
    Options

    Brenty, thanks for the response although I’m not quite clear on it’s point. It appears to me that, in essence, you’re agreeing with my unfair assessment :-)

    I just don't think it's productive to play the blame game. That's why we've built things like account recovery and automatic versioned backup into 1Password.com. I'm glad the technology is available these days for that to be possible. Unfortunately that doesn't help anyone retroactively. :(

    I do have a question re the IOS backup. The sqlite database in the backup; is that an identical copy of the IOS working database or something for backup & restore use only?

    It's essentially an encrypted SQLite containing the contents of all local vaults setup in the app at the time. It's not really useful for anything other than backup/restore though since we have made changes to the database structures over time.

This discussion has been closed.