web login is likely the same as app login credentials. I don't use 1password, but that's the generate case with LastPass (at least last time i used its mobile

web login is likely the same as app login credentials. I don't use 1password, but that's the generate case with LastPass (at least last time i used its mobile app). So, if they take the actual password, as opposed to having you log in for them, then they can easily go to 1password's web interface. I'm not sure if there is a legal barrier to taking that step, but there is no real barrier there if the credentials are the same. Perhaps if there were also travel credentials, that would be useful. With the travel creds there would be no indication that you were in travel mode and no access to additional data.