Why isn't the Secret Key masked on the sign-in page?

@Dave_1P I appreciate the answer but I am not sure if your post answers the question. The OP asked, given the rather critical function the Secret Key provides, why was a decision made not to hide them on the webpage? Your answer is... there are other metrics that the threat actor needs to gain access before breaching. It's clearly easy enough to "hide" the Secret Key on the website (or anywhere for that matter). I am kind of speculating here but I have a feeling that it's so that whoever is entering it can spot any mistakes given how long the key is and seeing that it only needs to be entered once (or at least only occasionally).

@Dave_1P Thanks. I didn't mean to sound accusatory but now that I am re-reading my post, it may seem so. Anyway, that's an interesting perspective I haven't thought about. However, from the OP's original post (I could be wrong about this), but it appears that other 1PW platforms (e.g. apps?) do hide them, which, if true, is slightly inconsistent with the explanation.

@danglygem I agree with you, and would think as a compromise they could at least provide a toggle option to hide it before pasting or typing it in, if someone chooses to do so.

I just had to log into my.1password.com to check my billing info and realized when I pasted my Secret Key into the text box, it was not hidden as I expected. I would really prefer this not be visible like the password text box.

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: MacOS 14.4
Browser: Safari

Thanks. Yeah, it prompts me to do so every time. It could be the privacy sections I use in Safari or the VPN I use when working remotely. Not sure. I just feel the Secret Key is too precious to be publicly exposed. I was in a coffee shop with people (and cameras) around me when I had to access my.1password.com. I wasn't expecting it be exposed. Thanks for passing it along.

I think I'd like to add a devils advocate opinion on this.

1Password has been very clear that they use public key cryptography. Which is better explained by this video, Wikipedia and 1password themselves.

https://youtu.be/GSIDS_lvRv4
https://en.wikipedia.org/wiki/Public-key_cryptography
https://blog.1password.com/what-is-public-key-cryptography/

I do agree that 1password calling the Public key the "Secret key" is a misnomer. And has the potential for most users to incorrectly assume that the secret key is the next level of security above their password. Which it is not.

The thing is public keys are designed to be shared. Which is why they are called public. Everyone knows the key already. If you watch and read up about how public key cryptography works you'll know that even if your "secret key" were hidden on screen there are probably much much easier ways to retrieve this without having to look over your shoulder. (like packet sniffing) The only thing the public key tells an attacker is the door to your account. Which by design is not enough information for an attacker to compromise your account. Ever.

Even then the benefit of an attacker knowing your public key is completely nullified (as others have noted) by users having the ability to regenerate their "secret key" aka your public key, anytime.

In fact if you read around security/crypto forums people even ask for more convenient ways to publish their public keys. I think one of them even suggests putting their public key on their Facebook. Which is pretty funny but also goes to show what the public key's purpose is for. It's not something that needs to be hidden. In fact for it to work properly everyone needs to know it!

https://security.stackexchange.com/questions/406/how-should-i-distribute-my-public-key
https://www.reddit.com/r/crypto/comments/120uiop/does_publishing_a_public_key_lower_the_security/

I think the unfortunate reality is that most people don't know how public key cryptography works. And the idea of having some random string of characters linked to your account be "public" is scary to most users. As such 1password as taken the route of calling it a "secret key". But since hiding the public key on screen provides no benefit to security, this is why it isn't hidden.

To combat an "over the shoulder attack" or a picture being taken of your screen, your "secret key" is intentionally long. Which as discussed before, gives nothing to the attacker except the door to your account. Which would be like an attacker knowing your username/email address. (Which usually isn't hidden either on the login page of a website)

IMHO making the text box for the "secret key" be hidden is just something to make users "feel safe" without actually providing anything to security. Aka security theater. To me this is essentially faking security. Which is the last thing 1password or any company that sells itself on its security, should be doing. And quite frankly saying 1password "doesn't care" when it comes to security over this is silly. Their entire business depends on them being secure.

This whole conversation to me honestly just stems from 1password staff being barred from telling users "no". Using html to hide what you're typing isn't "security" anymore people.

However I think something 1password could add as a feature is to allow users to have a reminder to regenerate their "secret key" after some set amount of time. For users that travel a lot.

@ag_tommy

Thank you for the clarification. I suppose the name "secret key" is not as much of a misnomer as I thought. All the strengths of public key cryptography without the vulnerability of sniffing. Nice.