4 ms·

What's the password recovery process like with 1Password for family accounts? I'm the administrator for my family's account on LastPass and my wife forgot her

What's the password recovery process like with 1Password for family accounts? I'm the administrator for my family's account on LastPass and my wife forgot her master password and has now burned the associated email. The account was unused and empty so nothing was lost but it highlighted to me that account recovery was not smooth or seamless. As an administrator you can't just issue a password reset on their behalf. If you're testing out these password managers, try a recovery first with a burner account before fully entrusting them with valuable passwords.

kelnos 5y ago
If it were possible to recover lost passwords as in your wife's case, then I absolutely would not trust the service at all. If you forget your master password, the passwords contained must be unrecoverable at that point. If they aren't, then that means the server/service has access to your plaintext passwords, and that is (or at least should be) an unacceptable security risk.
- Hackbraten 5y ago
  The server never gets to see your master password nor the vault key. Every client has a public/private key pair. The private key grants access to the (symmetric) vault key and will never leave your device. At vault creation time, a copy of the vault key is encrypted using the public key of the recovery group and then stored on the server. The only secret the server ever sees is the secret (device) ID, and that’s by design.
Hackbraten 5y ago
> What's the password recovery process like with 1Password for family accounts? Short answer: When 1Password creates an encrypted vault, it will make a copy of the key, encrypt it with the public key of another family member (e.g. you) and hold the encrypted result in escrow on 1Password’s servers. If your wife forgets her master password and chooses to request recovery, a special procedure starts. First, 1Password asks you to confirm that the request is legit. If you confirm, the server will delete and re-create your wife’s account, then send you her new public key and the encrypted escrow key. Your app uses your private key to decrypt it. (Now your app has your wife’s vault key.) Your app re-encrypts it with her new public key, uploads the result and forgets the key. Finally, the server sends your wife her encrypted vault together with the thing your app just did. Now your wife can access her vault again. Long answer: see 1Password’s security white paper [1]. [1]: https://1password.com/files/1Password-White-Paper.pdf https://1password.com/files/1Password-White-Paper.pdf

kelnos 5y ago

If it were possible to recover lost passwords as in your wife's case, then I absolutely would not trust the service at all. If you forget your master password, the passwords contained must be unrecoverable at that point. If they aren't, then that means the server/service has access to your plaintext passwords, and that is (or at least should be) an unacceptable security risk.

Hackbraten 5y ago
The server never gets to see your master password nor the vault key. Every client has a public/private key pair. The private key grants access to the (symmetric) vault key and will never leave your device. At vault creation time, a copy of the vault key is encrypted using the public key of the recovery group and then stored on the server. The only secret the server ever sees is the secret (device) ID, and that’s by design.

Hackbraten 5y ago

> What's the password recovery process like with 1Password for family accounts? Short answer: When 1Password creates an encrypted vault, it will make a copy of the key, encrypt it with the public key of another family member (e.g. you) and hold the encrypted result in escrow on 1Password’s servers. If your wife forgets her master password and chooses to request recovery, a special procedure starts. First, 1Password asks you to confirm that the request is legit. If you confirm, the server will delete and re-create your wife’s account, then send you her new public key and the encrypted escrow key. Your app uses your private key to decrypt it. (Now your app has your wife’s vault key.) Your app re-encrypts it with her new public key, uploads the result and forgets the key. Finally, the server sends your wife her encrypted vault together with the thing your app just did. Now your wife can access her vault again. Long answer: see 1Password’s security white paper [1]. [1]: https://1password.com/files/1Password-White-Paper.pdf https://1password.com/files/1Password-White-Paper.pdf