Trouble changing passwords
I know you are trying to make 1P better and help with changing passwords. Yet your software needs improvement. I am continually running into situations where 1P is "trying too hard", and I get into a situation where the password is messed up and I don't know what it is. So I have to do a password reset.
Because of long-standing issues in this area, I adopted the practice of saving existing passwords in a text editor and putting new ones there. I cannot tell you how many times I have to resort to those extra steps to save the day, as the automated features of 1P just fail.
The net result is all the "helpfulness" results in unnecessary password reset requests with websites.
Could you please simplify this and either get all the unwanted helpfulness out of the way or make it just work?
1Password Version: 7.9.1
Extension Version: 2.1.4
OS Version: 10.15.7
Comments
-
Hey @jasimon9 ,
You didn't quite explain what goes wrong in your process and what can/should be improved, so I'll just describe the flow of things and include some key points and helpful notes that you might find useful.
- Get to the website you want to change your password for and log into your account.
- Get to the "Change Password" form.
- Let 1Password autofill your current/old password.
- In the "New Password" field, 1Password will usually show up on its own and suggest a new strong password. If you click and select the suggested password, 1Password will autofill it into the "New Password" and "Confirm new password" fields, and will ask you if you'd like to update your existing login entry with this new password. Confirm and update it. The login item entry will now contain the new password.
- Send the form on the page and make sure the website accepts the new password as well.
Now, in some cases, the website will not accept the new password because it doesn't comply with the website's requirements. In that case, stay on the page and generate your own new password, like so:
- Click the 1Password extension icon in your browser's toolbar to open it.
- Click the grey key icon to reach the generator.
- Change the password's type from "Smart Password" to "Random Password" and adjust the recipe to comply with the website's requirements (length, digits, symbols etc).
- Autofill the password you generated. 1Password will autofill it and show you the update prompt again - confirm and update your login entry with the newer password.
- Send the form on the website and make sure that it accepts your new password.
You can repeat these steps for as many times as you need until you get the website to accept your new password.
If you ever need your old/original password back, you can recover it like so: https://support.1password.com/item-history/
In case you need to recover a password you generated in the generator, get to the generator and click the "Generator History" button at the bottom.
These failsafes are there to ensure you will never lose access to your account and will always be able to recover the required password, so no need to use a text editor and copy-paste passwords.I hope you'll find this helpful. If you have specific actions or flows you'd like to point out for us to improve, please describe an example and how you'd improve it. :)
0 -
I understand that following specific procedures work. However, there are other procedures that are problematic. I seem to be able to find such procedures. Here is an example, which is not for changing passwords, as I was originally questioning about, but nevertheless shows issues.
- Create a login for a new website.
- In the password field, there are two choices presented: (1) suggested password; (2) save in 1P. If you click "save in 1P".
It is not clear which of these choices I should take. When I save in 1P, it seems to save a different password, as if it is generating a new one. It would be best if the next time this happens, I take note of every single step and all the rework that I needed to finally get it right.
0 -
Hey @jasimon9 ,
You can test things on our test website: https://fill.dev/form/registration-simple
The "Save in 1Password" button will save all fields that were filled on the page as they are. If some fields are still empty, don't click the "Save in 1Password" button yet. Only click that button when all required fields are filled in.
If you click the suggested password that 1Password offers, it will automatically tigger the save prompt so you can save that new password and won't lose it, but if you prefer to type in your own password and click the "Save in 1Password" button, make sure to click that button only when you're done filling all the fields on the page.
0 -
Here is yet another failing scenario: setting up a new user in postfix.
- when password field is arrived at, 1P suggests a password.
- If that is clicked on, the password fields are filled and a popup appears to update the postfix password. If you are not careful, you will update the postfix password. You don't want this to happen because you are not changing the postfix password so you have to be careful to click Cancel.
- Now the password is filled, but one does not know what it is. Previously whenever 1P filled, it would copy the newly generated pw to the clipboard. This no longer happens. So now you have a newly generated password that you don't have any information on.
Bottom line, 1P is getting in the way here, and not helping. The only solution for such a case is to ignore 1P. Generate a pw separately and save it in an editor and use it, and later update 1P with that pw. Lot's of extra steps. Don't either click on the suggested pw or the Save to 1P. Both of those will trigger a lot of rework.
Another scenario: an issue that I was experiencing before is that if you click Save in 1P, it saves a different pw than the suggested one. So now you have put the suggested pw into the website, and saved a different one in 1P. Again, rework required with the website to request another pw reset.
All of these mean that 1P pw set and change features have changed from a tools that just worked, to one that should be ignored,
0 - when password field is arrived at, 1P suggests a password.
-
Hey @jasimon9 ,
I don't quite understand what the issue is with the example scenario and screenshot you provided. 1Password seems to be working correctly and doing its job here.
If you sign up to a new website, 1Password will suggest a new password for you to sign up with. When you select that new password, it will trigger the save prompt and save the entire page for you (including the username and any other field that is filled), creating a new working login for you to use the next time you try to log into the website.
You are not supposed to know or remember what the new password is because that's not interesting. That's not important. That is why 1Password was invented.
Using the clipboard is not a great security practice and is one we try to avoid. The clipboard is not a secure space to store passwords in (even if only for a moment), so 1Password bypasses all that and saves what you need for you.If you ever find yourself in a situation where you did not save the password for some reason, you can still recover it in the generator's history as I mentioned in my previous reply. You will never be locked out of your account or lost without the password that you autofilled, we have failsafes that prevents it such as the generator's history.
Another scenario: an issue that I was experiencing before is that if you click Save in 1P, it saves a different pw than the suggested one. So now you have put the suggested pw into the website, and saved a different one in 1P. Again, rework required with the website to request another pw reset.
That scenario is not possible unless the website does some javascript voodoo magic in the password field that changes the input you type in it.
If the password field is empty and you click the "Save in 1Password" button, 1Password will show the save prompt and will have an empty password field in the new login item you create. If there was already something typed into the password field and you click on "Save in 1Password" (but you do NOT click on the suggested password), then 1Password will save whatever is typed into that field.
The biggest point of interest here is that the "Save in 1Password" button and the strong suggested password are two separate functions that do different things, do not expect them to perform the same action. The Save in 1Password button will save whatever is filled into the fields already but will not add anything new to any field - it will not fill the suggested password it shows you. The strong suggested password option will overwrite whatever is in the password field and will autofill it with the new suggested password it showed you, then trigger the save prompt with that new password in it.
I hope that clarifies things a bit better. If you encounter a website that is publicly accessible where you can reproduce a specific scenario where you're having troubles, please provide us the link here with an exact step-by-step description of your actions and clicks so that we can replicate it and follow up on it. :
As I mentioned previously, you can use this website to do some testing: https://fill.dev/form/registration-simple0 -
I understand that from your point of view it is working as designed. But for me, I normally have to take a lot of extra steps, including frequent "forgot my password" with websites. Plus saving the password temporarily in textedit. Wish it was not so.
Yes, the generation history could be helpful, but as I am pointing out in a separate question, that has gone missing in a lot of cases.
Clearly discussing this back and forth is getting nowhere. I will have to carve out some time where I can take detailed notes and screen shots to show you what I go through.
0 -
I do appreciate the feedback and input here @jasimon9 , we always strive to improve 1Password and make it more helpful/useable.
I would like to separate between feedback and actual issues that are occuring, so if something is not working we would love to dive into it and improve things.
If/when you encounter a website where you can provide us with a step-by-step to reproduce it (or record a video of what exactly goes wrong and where), we'll be happy to investigate it with you. We can do that here publicly, or, if your screenshots/videos contain personal information, we can do it privately via email so always feel free to email us to support+x@1password.com and we'll dive right into it.
Thanks for investing the time and effort here, it is very appreciated :+1:
0 -
Seems almost every time I try to change a password over the last several months, it goes wrong.
Just today:
1. Need to change a password.
2. Get new password from password generator.
3. Fill in the new password (but did not save it to an editor).
4. Password is changed.
5. I have no idea what the password is--the login in 1P has the old password.
6. So I have to do a pw resetI long ago adopted the policy of copying newly generated passwords into an editor, to prevent this problem. I hate doing it, but it is the only way to avoid the problems of losing the new password. I also hate having to copy the password.
This did not used to happen. 1P automatically changed the password. But it no longer works for me.
Unfortunately, I did not capture screen shots in advance. But for the umpteenth time I have to do an extra password reset.
0 -
Hi @jasimon9. I appreciate the steps you shared. That's super helpful.
I can see that step 4 is where our issue lies. When you mentioned the "Password is changed", does it mean you clicked the Save button for the new password on the website? However, the password is not changed yet for the saved item in 1Password. Using the Password Generator will not directly update the saved item.
We will need to update the saved item's password by editing it. Let's try the following steps to see if it would help with the process:
- Go to the password-changing page.
- Copy the new password from Password Generator.
- Paste it into the password-changing page and save it.
- Search the saved item in 1Password. Edit it and paste the new password into the password field. Save the item.
- Go to the login page and test it with the updated-saved item.
In addition, if you are using the Autofill button in step 2 above. 1Password will autofill the new password to both fields and will prompt you with an update password window as demonstrated below:
I hope my suggestion above will help you with the password-changing process.
0 -
I can relate to every word from @jasimon9. He described the issues very good. I don't have such issues with every password change, but from time to time. The changing of a password is the most fragile workflow you find in 1Password.
The main issue for me is that you have to change the password in 1Password before you actually change it on the website. If the website rejects the new password, you're often thrown back and need to enter the old password again, which can then only be found in the history, which gets real tedious, as soon as the password is rejected multiple times: which of the last passwords was the real old one? The last one? The next to last one? Or even the third? The history starts to get cluttered with passwords that were never active. It's also not clear if you will really get a valid new password according to the policy of the website, because you never see the new password. You cannot validate the password manually. I also tend to use a copy via clipboard to some notepad to "see" the new password. Which is a security risk of course. 1Password doesn't support me here good enough.
I recommend an update workflow in two steps. Instead of directly saving a new password, I propose the new password is saved to a temporary area, if I click on "save Login". Then I update the password on the website. I may need multiple loops until a new password is accepted. After the new password is actually accepted on the website, I click on a "commit password" function and commit the temporary area to the real password entry. If I abort the password changing, I do nothing or use some "abort password change" function to clear the temporary area.
An alternative to this could be "rollback password" function that pulls the last password from the history if the last change was only a few seconds ago and inserts it again as current password. I would use this to restore the password entry to the start, if a password was rejected and I have to do it all again. This should throw away and destroy the rejected password from the entry, which makes sense, because it was never active.
0 -
Thank you to Tertius3 for chiming in.
I have used 1P since 2009. The change password function worked pretty well for most of that time. However, during the last year it has become extremely difficult. Sometimes it works, but at least half the time it results in a large amount of rework, including additional password resets with websites.
It is a fact that when you create a new password, it you don't save it temporarily somewhere, you are asking for a good chance of quite a bit of additional rework. The fact that I have a listing of passwords, including the current one and the new one, available in a separate text editor has saved me countless episodes of frustration.
The automated support from 1P should just work. It doesn't.
Here are things that need to be improved:
- the password history function. Used to be great. Now it is useless.
- the confusing UI where you get multiple popups, some covering others, and you never know whether to click Save, or something else. The fact that Kevin.li gives a workaround demonstrates somewhat the issues.
Hope this helps.
0 -
There used to be a password history feature. It is no longer there.
0 -
Many times there is no such choice. Does that mean there is no history present?
0 -
It probably means there's no history to show for that particular item. If you're on a website and trying to change a password but failed to save it, the new password won't be stored in the item's history, but rather in the generator's history:
- Click the 1Password extension icon in your browser's toolbar to open it.
- Click the Key button on the top right area to reach the generator.
- Click the "Generator History" button at the bottom to view and recover any lost new passwords that were used in websites but weren't saved.
0 -
I see the generator history in the 1P extension in Chrome. That could be useful in these edge cases!
However, I have recently switched to Safari, and trying to make a go of that. I don't see the "Key" button or another way to access the generator in the Safari version.
0 -
Hey @jasimon9 ,
Safari is indeed different. When you use a new generated password on a website, it is automatically saved as a new "Password" item in your 1Password app (an item with a grey key icon instead of a website's icon/logo). When you update that new password in the relevant login item, that password item will disappear automatically as to not clutter your 1Password, but if you failed to save/update the new password, then you can find it in the "Passwords" category of your 1Password app.
0 -
Thanks for the explanation.
0 -
Just happened when trying to reset pw for Ticketmaster. Went through the site's password reset steps. 1P suggested a password. I accepted it. I asked me about updating in 1P and I did so. But now I don't know what the password is because I did not copy it somewhere, and 1P did not update it.
Fortunately, the new password was saved in the password section, as has been suggested above. So it works, but is kind of clunky.
0 -
I just ran into another sequence that makes it a lot of extra work.
- Attempt to login to website. URL has a directory, such as www.exmaple.com/premium/
- Site tells me that they upgraded their passwords and I have to create a new one.
- I use 1P to generate a new password.
- 1P asks to update or save the new password and I do so.
- However, instead of updating the existing login, it creates a new one but with the URL not having /premium.
The next result is that I now have two logins. One has the old username, old password, and old URL. The new one is missing the username, has the new password, and a new URL. Now I have to work to combine the proper info back into a single login.
I have also noticed lately a lot of cases where the username is not being saved, or even the site name not being saved. Again rework to fix these to combine the information back together.
0 -
But now I don't know what the password is because I did not copy it somewhere, and 1P did not update it.
When you say "did not update it", do you mean on the website?
1P asks to update or save the new password and I do so.
You do so meaning you chose to update the existing item or to create a new one? What option did you choose in the popup window? Because it sounds like you chose to create a new item instead of updating the existing one.
0 -
I mean 1P did not update it in the login.
I was not given the choice to update the old one. It created a new one. My theory is that because the URL was different, 1P did not recognize that it could be an update. One URL was https://www.sitepoint.com and the other was https://www.sitepoint.com/premium/
0 -
Since the root domain of the site is the same on both URLs, it should not matter. It appears that the change password page sits behind a paying account, which we don't have access to. If you don't mind, I'd like to ask you to collect some page details for us to test:
- On the page exhibiting the behaviour, right click the 1Password icon in your browser toolbar.
- Click Help and choose Collect Page Structure.
- 1Password will save a .json file to your "Downloads" folder.
- Send the downloaded .json file to us at support+x@1password.com with a link to our current discussion.
One of our extensions team members will have a look and let you know what we find.
0 -
I tried right clicking on the 1P icon in the browser toolbar. In the dropdown the only choices are "Manage Extension" and "Customize Toolbar". Having had similar issues before with Safari not acting properly, I loaded Chrome, and the followed your steps. This time it did have Help > Collect Page Structure. So I did that .
I am again wondering why Chrome works as you would expect, where Safari does not.
0 -
Thanks @jasimon9. I was able to locate your ticket. Let's continue the conversation there.
ref: NAB-32183-429
0 -
Re the question about why secondary logins are created, when you say "continue there", I assume you mean that I will get an email reply (which I have not yet) and to reply to that email.
Do you have any idea why Safari does not give the choices that Chrome does on the right click?
0 -
I see that my colleague Nhat has replied to your email. To avoid duplication, and to keep the conversation in one place, I'd suggest replying to him there.
To answer your last question here, the difference you're seeing are two different versions of 1Password for your browser. The version in Chrome is our newest standalone 1Password web extension with integrated features. The one you have in Safari is an App Extension that automatically comes built in with the desktop app for Mac - so the features will vary slightly. We are working to align these when we release 1Password 8 for Mac alongside 1Password for Safari later this year, so you can expect more consistency there.
0
