1password Extension unlock biometrics?

Unfortunately there isn’t a way to remove it, only switch it off (but it can easily be switched on again). I too have set it to the minimum of 15 mins, but that’s 15 mins too long in my opinion.

So it's only locking after 15 Minutes (minimum setting) or when I manually lock it?

Quite a big security issue in my eyes...
I "always" have to get in mind to do it, before giving my iOS device to someone else (show something or family/kids).

Even locking the iOS device doesn't help at all.

For me it's better to "not" use this new extension until this issues are solved (hope they will).

Forgive me, but I’m not getting the point of this new Safari extension (and I don’t get the point on my desktop either). Before the extension, I had to use TouchID each time I logged in to a website. Now I (anyone?) can log into any website on my phone without needing biometrics or the master password.

How is this secure? Enabling the extension allows anyone to log in. Switching off the extension obviously prevents this, but again this can easily be switched back on by anyone who knows about the extension. I have no way of removing the function completely.

My concern is that, although I use TouchID to unlock my phone, my phone can also be unlocked with the passcode (which is what my children do to play games). But no-one could log into websites as they couldn’t unlock 1Password. Now the extension is present, you don’t need biometrics or TouchID and can simply log in.

Am I missing something?

@desmondfuller yes that flow is at least strange and not intuitive

@ag_ana I should clarify since I didn't give you much to go on. Let me share a better explanation.

1. Cold start of iPhone 12 running iOS 15 (reboot)
2. After restart, I open 1password app and I have to enter the password or use FaceID. I choose the latter.
3. I go into Safari. Go to website.
   

Here is where I think the flow is unusual. I have AutoFill Passwords option turn on with the phone (since this is what I would use with iOs 14). Now when I go to a website I see the 1Password icon in the userID field on the website AND I have the key icon and "Passwords" box above the virtual keyboard.

Two choices to use (which now seems redundant with the new extension):

1. If I select the Passwords selection on the bottom, it brings up the faceID and brings up the account login information.

2. If I select the 1password icon in the UserID field, I will get the "Please unlock 1Password from the toolbar icon". This I assume is because this is a cold start and it is not using the local 1Password app verification.

I click the puzzle piece at the bottom (which is sometimes hidden by the virtual keyboard "Passwords" box) and select 1Password. 1Password comes up and here is where the question comes. I have to enter my 1Password mater password and there is no biometric ability here.

That last sentence was what I was trying to understand on lack of biometric. I am guessing that 1Password is not using the local 1Password app for verification and is using the online service only so to 1Password makes you use the Master Password since this is your "first time" and will remember from that point on (for 1 day by default unless changed).

You are welcome Thomas! I am glad I could help :)

@ag_ana - that helped. When I set require auth after to 1 week and delete the website data, 1password takes a while to relogin (and I get a corresponding e-mail). Thanks a lot!

@desmondfuller:

What is the value of the setting I mentioned in my previous post in your 1Password app?

I’d like to know the same thing.

Thomas:

The only other thing I can think of is if you have tried changing the value of 1Password Settings > Safari Extension > Require Authorization After, and change the default value from 1 Day to 1 Week. Is the extension remaining unlocked for you in that case?