Destroyed item is still accessible via a share

Options
bassmastergg
bassmastergg
Community Member
in 1Password in the Browser

Hey there,

It seems that a shared item is still accessible after the item is deleted and then destroyed (via the recently deleted view). This seems like a bit of a security issue as the item is no longer accessible by the owner but can still be accessed via the link and there is no way of invalidating the share because the item is supposedly destroyed.

Is there something I’m missing here?

Thanks in advance

Comments

  • steph.giles
    steph.giles
    Options

    Hey @bassmastergg,

    This is expected behaviour. The shared link provides a snapshot copy of the original item regardless of any changes (including deletion).

    If you would like make things more secure, I would suggest either selecting a shorter expiry window or allowing the user to only view it once.

    I hope this helps!

  • bassmastergg
    bassmastergg
    Community Member
    Options

    Hey @steph.giles ,

    Thanks for your response.

    For me my main concern is that once an item is shared there is no way to update the expiration information other than manually deleting the link. That however is not possible once an item is destroyed.

    I would have expected that at least on deleting of the item that any links would also be deleted as from a user perspective this is not possible anymore. At the very least I would expect a prompt to inform the user that there are active shares of the item prior to deletion.

    On a secondary note, if I understand correctly to update an item that is shared a new link must be created?

    Thanks again!

  • steph.giles
    steph.giles
    Options

    Thanks for getting back to me @bassmastergg.

    When you share an item, a copy of the item is created, with the password history removed. Only the copy is shared and not the original item. If you change an item’s details after you’ve already shared a copy, your changes won’t be shared unless you share the item again.

    When the item was hard deleted this essentially revoked your own ability to delete the shared copy link via the tools we provide to do so here.

    I agree that it might be helpful to have a prompt if you are deleting an item to let you know about active shares so you can manage these prior to deletion so I have gone ahead and created an internal feature request.

    Whilst I can't make any promises as to if or when this will be implemented, your feedback has been noted.

    Let me know if you have any further questions!

    ref: IDEA-I-2056

This discussion has been closed.