4 ms·

I wish 1Password had a feature where you could put in a list of domains like this or a "Auto Change Possibly Compromised Passwords" feature.

by poorman 10y ago

erichurkman 10y ago
Isn't this what Watchtower is supposed to be for? I have no idea if AgileBits is going to add this list to Watchtower, though.
- AGKyle 10y ago
  Disclaimer: I work for AgileBits, makers of 1Password I am helping comb through a list of sites to see which of those has suggested password updates. I think we've had very few sites suggest updating the password though. Have you all seen any sites explicitly state users should update? If so I'd love a list so we can get them in Watchtower. Kyle
  - data4science 10y ago
    I would subscribe to Watchtower, or, heck, probably even 1Password Famlies, if AgileBits took a more aggressive/proactive approach to password updates: 1. Prompt batch password resets for services whose vulnerabilities have been exposed before those exposed admit their breach to consumers (e.g. All services compromised by the Cloudflare dump - usually consumers are the last to know). 2. Preformed all password resets in a secure AgileBits browser (assuming the browser built-in to 1Password on iOS is secure). 3. Had an optional prompt to prevent unintentionally syncing/backing-up 1Password data, and accessing said secure browser without first confirming VPN status with the operating system (maybe even prompt user to connect to VPN before unlocking if VPN connection isn't established) Alternatively, I'd subscribe for integration of a 1Password browser extension for a reputable (regularly high, multiplatform AV-Test/NSS performance) internet security service's browser, and Watchtower was as sensitive as mentioned above and integrated with said internet security service. This is coming from a longtime 1Password Pro user (3-6 yrs) who recently got his family on the 1Password bandwagon.
    - drakenot 10y ago
      Yep, I totally agree. Before I read this thread, I actually tweeted to 1Password to ask if they would be willing to produce some way for me to quickly cross reference the Cloudbleed sites against my 1Password vault. I think Watchtower alerts should be based on any publicly known breach, not based on what the companies themselves say. At this point, I consider any account using an affected Cloudflare service as potentially compromised. This is a missed opportunity for 1Password to say that not only is your vault safe, but we will also help protect you from any potentially sites that had their data exposed.
- dingdongding 10y ago
  I never received any notification from Watchtower to change password during linkedin hack, Dropbox hack and Yahoo hack. Apparently Watchtower was only supposed to notify you about Heartbleed vulnerability according to their website. > 1Password Watchtower is a service that identifies websites that are vulnerable to Heartbleed, and will suggest which sites need to have their passwords changed. https://watchtower.agilebits.com/ https://watchtower.agilebits.com/
  - AGKyle 10y ago
    We update it all the time with new items as we see them announced. It won't contain all of them but whatever we stumble on or see in various places get added when there's an actionable thing a user can do. We've added a handful of sites today that have suggested changing passwords after this announcement. Kyle AgileBits
    - nicolas_t 10y ago
      I think you should suggest all sites that could have been compromised not just the few that suggest changing passwords.
    - gavingmiller 10y ago
      As a happy customer of 1Password, it would be great to see you connect with Have I been pwned?[1] for watchtower notifications. [1] https://haveibeenpwned.com/ https://haveibeenpwned.com/
IgorPartola 10y ago
LastPass sort of has that.
gregschlom 10y ago
Dashlane has that. Doesn't work with all sites though. But all major ones should work. See: https://www.dashlane.com/features/password-changer https://www.dashlane.com/features/password-changer https://csdashlane.zendesk.com/hc/en-us/articles/202699281-How-to-use-Password-Changer- https://csdashlane.zendesk.com/hc/en-us/articles/202699281-H... Supported sites: https://www.dashlane.com/en/password-changer-list https://www.dashlane.com/en/password-changer-list
deleted 10y ago
[deleted]
pkcsecurity 10y ago
fwiw, I wrote a script in node that takes your 1Password exported URLs and checks them for cfduid and headers...not nearly as nice as if 1Password did this with Watchtower, but in the meantime... https://github.com/weltan/cloudbleed-1password https://github.com/weltan/cloudbleed-1password

I wish 1Password had a feature where you could put in a list of domains like this or a "Auto Change Possibly Compromised Passwords" feature.

by poorman 10y ago

I wish 1Password had a feature where you could put in a list of domains like this or a "Auto Change Possibly Compromised Passwords" feature.

erichurkman 10y ago

Isn't this what Watchtower is supposed to be for? I have no idea if AgileBits is going to add this list to Watchtower, though.

AGKyle 10y ago
Disclaimer: I work for AgileBits, makers of 1Password I am helping comb through a list of sites to see which of those has suggested password updates. I think we've had very few sites suggest updating the password though. Have you all seen any sites explicitly state users should update? If so I'd love a list so we can get them in Watchtower. Kyle
- data4science 10y ago
  I would subscribe to Watchtower, or, heck, probably even 1Password Famlies, if AgileBits took a more aggressive/proactive approach to password updates: 1. Prompt batch password resets for services whose vulnerabilities have been exposed before those exposed admit their breach to consumers (e.g. All services compromised by the Cloudflare dump - usually consumers are the last to know). 2. Preformed all password resets in a secure AgileBits browser (assuming the browser built-in to 1Password on iOS is secure). 3. Had an optional prompt to prevent unintentionally syncing/backing-up 1Password data, and accessing said secure browser without first confirming VPN status with the operating system (maybe even prompt user to connect to VPN before unlocking if VPN connection isn't established) Alternatively, I'd subscribe for integration of a 1Password browser extension for a reputable (regularly high, multiplatform AV-Test/NSS performance) internet security service's browser, and Watchtower was as sensitive as mentioned above and integrated with said internet security service. This is coming from a longtime 1Password Pro user (3-6 yrs) who recently got his family on the 1Password bandwagon.
  - drakenot 10y ago
    Yep, I totally agree. Before I read this thread, I actually tweeted to 1Password to ask if they would be willing to produce some way for me to quickly cross reference the Cloudbleed sites against my 1Password vault. I think Watchtower alerts should be based on any publicly known breach, not based on what the companies themselves say. At this point, I consider any account using an affected Cloudflare service as potentially compromised. This is a missed opportunity for 1Password to say that not only is your vault safe, but we will also help protect you from any potentially sites that had their data exposed.
dingdongding 10y ago
I never received any notification from Watchtower to change password during linkedin hack, Dropbox hack and Yahoo hack. Apparently Watchtower was only supposed to notify you about Heartbleed vulnerability according to their website. > 1Password Watchtower is a service that identifies websites that are vulnerable to Heartbleed, and will suggest which sites need to have their passwords changed. https://watchtower.agilebits.com/ https://watchtower.agilebits.com/
- AGKyle 10y ago
  We update it all the time with new items as we see them announced. It won't contain all of them but whatever we stumble on or see in various places get added when there's an actionable thing a user can do. We've added a handful of sites today that have suggested changing passwords after this announcement. Kyle AgileBits
  - nicolas_t 10y ago
    I think you should suggest all sites that could have been compromised not just the few that suggest changing passwords.
  - gavingmiller 10y ago
    As a happy customer of 1Password, it would be great to see you connect with Have I been pwned?[1] for watchtower notifications. [1] https://haveibeenpwned.com/ https://haveibeenpwned.com/

IgorPartola 10y ago

LastPass sort of has that.

gregschlom 10y ago

Dashlane has that. Doesn't work with all sites though. But all major ones should work. See: https://www.dashlane.com/features/password-changer https://www.dashlane.com/features/password-changer https://csdashlane.zendesk.com/hc/en-us/articles/202699281-How-to-use-Password-Changer- https://csdashlane.zendesk.com/hc/en-us/articles/202699281-H... Supported sites: https://www.dashlane.com/en/password-changer-list https://www.dashlane.com/en/password-changer-list

deleted 10y ago

[deleted]

pkcsecurity 10y ago

fwiw, I wrote a script in node that takes your 1Password exported URLs and checks them for cfduid and headers...not nearly as nice as if 1Password did this with Watchtower, but in the meantime... https://github.com/weltan/cloudbleed-1password https://github.com/weltan/cloudbleed-1password