To protect your privacy: email us with billing or account questions instead of posting here.

Unexpected behaviour: still able to see local data after deauthorising a device.

Options
XIII
XIII
Community Member
edited October 2023 in Memberships

Recently I bought a new iPhone and transferred the data from my old iPhone. Next, I deauthorised the old iPhone. However, after restarting 1Password on the old iPhone it only asked me for my 2FA factor! (So I did not need to enter username, password, or secret key). Is that because the secret key is stored in iCloud and I had Face ID still active?

Even worse, I could still see all local data (so everything!) even though I deauthorised the device! Shouldn't it delete all data as soon as it connects to the 1Password infrastructure and sees that it is deauthorised?

Comments

  • Damnatus
    Damnatus
    Community Member
    Options

    Good question. Would expect similar. But it might be a feature to prevent accidental (or malicious) loss of access.

    According to the Support Site only regenerating the Secret Key has the effect of needing to provide account password and secret key on every(!) device currently logged in.

    https://support.1password.com/lost-device/#regenerate-your-secret-key-and-deauthorize-the-lost-device

  • ag_josephine
    ag_josephine
    Options

    Hi @XIII,

    As a convenience feature, to make signing into the 1Password apps across multiple Apple devices easier, if you've set up your device with an Apple ID and have iCloud Keychain enabled (https://support.apple.com/en-us/HT204085), then when you sign into a 1Password membership inside one of our apps for Mac or iOS, the app will write some of your sign-in details to your encrypted iCloud storage. Then, if you go to sign into an account on a different Apple device that's set up with the same Apple ID and iCloud Keychain, the 1Password app there will find the account details stored in iCloud, and will present it as a list of found accounts to make signing into them easier.

  • XIII
    XIII
    Community Member
    Options

    Which sign-in details are stored in iCloud?

    I knew that the secret key was stored in there, but the password is a surprise to me (I only had to type the 2FA code to get back in).

    Even if you stored everything in iCloud, I would still expect the App to delete all data once it learns the device is deauthorized.

  • Dave_1P
    Dave_1P
    Options

    @XIII

    Thanks for the reply. Since I don't have access to your account information here on the forums could you open a ticket with our support team so that we can look into this further? I'd also like to ask you to create a diagnostics report from your iOS device:

    Sending Diagnostics Reports (iOS)

    Attach the diagnostics to an email message addressed to support+forum@1password.com.

    With your email please include:

    Please send the entire file.

    You should receive an automated reply from our BitBot assistant with a Support ID number. Please post that number here. Thanks very much!

    -Dave

  • XIII
    XIII
    Community Member
    Options

    Not sure whether that still makes sense now (already wiped the old iPhone).

    Can you please tell me how 1Password should behave?

    Is this a bug, or do I have wrong expectations?

  • Dave_1P
    Dave_1P
    edited October 2023
    Options

    @XIII

    Thanks for the reply, I wasn't aware that you had already wiped the old iPhone.

    If you deauthorized the old iPhone then you would have seen an account suggestion for your account when you opened the 1Password app on that iPhone. While your Secret Key and email address would have been provided by iCloud Keychain, you would then have been required to enter your account password and two-factor authentication to authorize your account again.

    The behaviour that you describe sounds like you chose the "Require 2FA on Next Sign-In" option instead. If you didn't then I would recommend sending an email to the team using the instructions in my previous post (aside from the diagnostics report) so that we can investigate further.

    -Dave

  • XIII
    XIII
    Community Member
    Options

    Yes, I understand all that.

    Please focus on the second part: what should happen if I do not log in?

    1Password said it would not sync (until I logged in), but I rather had that it deleted all local data (since the device was already deauthorized).

  • Dave_1P
    Dave_1P
    edited October 2023
    Options

    @XIII

    Thanks for the reply. Deauthorizing a device removes the local copy of the data on that device. Without access to a diagnostics report from your device, and knowing more, I wouldn't be able to comment on what might have happened on your device.

    Are you able to reproduce the issue if you deauthorize 1Password on your new iPhone? Do you remember what specific version of 1Password for iOS you were running on that old iPhone?

    -Dave

    ref: dev/core/core#19697

  • XIII
    XIII
    Community Member
    Options

    Sorry, only know the major number (8).

    Since I already wiped the device (and gave it to a family member) I can't provide diagnostics.

  • Dave_1P
    Dave_1P
    Options

    @XIII

    If you're willing to help us dig a little deeper then please send an email to the team and they can see what additional information they can find from the account information available on our end: support+forum@1Password.com

    -Dave

This discussion has been closed.