11 ms·
Tell HN: 1Password shares passwords you don't want shared
I mentioned this in a comment [0], but given how serious this potentially is I thought it might warrant a Tell HN.
Only tested on a Mac with 1Password 7 using Agile Bits' sync.
If you have shared and private vaults on 1Password, using the Generate Password button in 1Password Mini doesn't let you select which vault that password should be saved in until it becomes a login, however, at that point it has already saved the password you generated in your shared vault, and anyone who you share that vault with can see both the password, and the site that it was generated for. This has obvious security implications but also, maybe less obviously, privacy implications as you may not want your entire company to know that you just generated a password for a jobs site.
[0] https://news.ycombinator.com/item?id=30370947 https://news.ycombinator.com/item?id=30370947
- seanosaur 5y agoYou're right that you can't change the default vault for Generate Password but you _can_ set the default in the Preferences pane. My default, for instance, is my private vault. Anything I create goes there and if it warrants sharing to other vaults, I do that manually.
- drcongo 5y agoUpvoting because you're correct, changing this does change the save location, so thanks. Seems mad that it defaults to the shared vault though.
- Nextgrid 5y agoIt presumably defaults to whatever first vault that code path sees, so because of a race condition the shared vault could appear before the private one and thus becomes the default.
- throwaway894345 5y agoMine defaulted to private vault, which is a little frustrating because I'd like it to share everything by default (only other person on my account is my wife). Glad to hear it can be changed.
- wanderer_ 5y agoI use 1password, and I have always had a mild distaste for its 'vaults' UX. I live with it though, and since I'm only creating logins every once in a while I just leave it be, and shake my head every time do use it. On the whole, the service could be better, but for the price it's not too bad :)
- manicdee 5y agoThe multiple vaults are extremely useful to me since I only have to sync my work passwords with my work computer, not my entire password collection. There’s no reason for my HN, Reddit, TeslaFi or PlugShare account details to be on the work computer regardless how supposedly secure 1Password might be (I don’t own the hardware and I know it has surveillance software installed).
- wanderer_ 5y agoTangentially, I seem to recall recently (2020 sometime) where someone made custom firmware for a laptop's wifi card that, since the computer was set up with a central hub for most of its peripherals, could sniff data flowing from things like USB stuff and, more interestingly, its keyboard. It ended up as an extremely elegant keylogger. Cool stuff.
- robbedpeter 5y agoIt'd be worthwhile to create a fresh account and screenshot the defaults. Maybe you set your default manually at some point and weren't aware, or there's an easy way to slip up? Nice catch, though!
- roustem 5y agoIt has to be a private vault by default, unless we have a bug in 1Password 7. There were years of internal discussions about how and where the new items should be saved. When it comes to generated passwords, we had this implementations since 1Passwd 1.0 and it was always a bit kludgey. I believe the redesign in 1Password 8 completely solves this problem by using a special system vault to store the generated values. -- Roustem 1Password Founder
- sleepybrett 5y agoUnfortunately you alienated a significant portion of your userbase who will not be moving to 8. That said, because my breakpoint was 'i don't trust your fucking cloud with my passwords and i won't be forced to use it', this particular bug does not affect me.
- drcongo 5y agoI'm stuck with 1Password because the alternatives, if they meet our company requirements, are so much worse. But the web app is unusably slow and every release is worse than the last - eventually I expect 1Password to sink to being even worse than the competition.
- nvr219 5y agoRude.
- coldtea 5y agoBut also true for many.
- e40 5y agoI have it running on many computers and have never seen it default to a shared vault.
- fragmede 5y agoThe people you are sharing vaults with a going to be trusted people. Where tus factor for and individual's life is going to be low, having passwords shared, whether they're for Netflix or bitcoin private keys and such is simply more convenient and in some cases, desirable, eg a married couple with finances mingled together.
- drcongo 5y agoOne of that married couple might not want their Tinder password popping up in the shared vault.
- jb1991 5y agoI just checked, running the latest version, which I just signed up for, and the default vault is Private. I have never touched that setting and it was always set to Private. So either the behavior has changed or it is incorrect that it ever defaulted to Shared (which wouldn't make any sense whatsoever for a company this focused on privacy).
- drcongo 5y agoThat's not at all what's described in the OP. > If you have shared and private vaults on 1Password
- jb1991 5y agoThat’s right, I have a shared and private vault on 1Password. The default is the private vault, not the shared vault. Appears a few sibling replies are noting a similar understanding, so I’m not sure where the confusion is.
- PikachuEXE 5y agoI am using 1PW on iOS (1PW latest) & Windows (1PW 8) & Mac (1PW 7) I have shared and private vault (the default Private + other new shared) I have checked on Windows & MacOS again and I remember that option has always been set to the default private vault.
- sundaeofshock 5y agoif I’m not mistaken, the default setting is to save it to your private vault. This doesn’t sound like a bug, but rather an error in user behavior.
- drcongo 5y agoI'd never change that setting, so mine definitely defaulted to the shared vault. There could be any number of possible reasons it set that as the default, but my guess would be the order I migrated vaults over from the good old days where we could choose how we shared and synced. The fact that it is even possible still seems like a bug to me.
- concinds 5y agoI'm absolutely glad that the Shared vault can be set as the default one; it's great to be able to troubleshoot family members, check if 2FA is on, etc. without having to visit them in person and use their laptop. Doesn't seem like a bug at all, and in fact I would likely switch to iCloud Keychain if this behavior went away (which doesn't support default-shared but is free). There seem to be 2 problems here: Generate Password not telling you which vault it will be saved in, and the Shared vault being set as default (presumably) without user input.
- lupire 5y agoIt warrants extra care -- every time you save a password to Shared, it should give an explicit visible warning.
- the_arun 5y agoIn a tool like 1Password, they need to do enough to avoid user errors (I'm sure they are). That is the responsibility of these tools. In other words - there is no such thing as user errors for these tools.
- weisnobody 5y agoI have different experience with v 7. Vault for Saving in preferences is set to Primary. If I select a specific vault to view in 1 password, then end up on a website and create a password, 1Password mini has the viewed vault as selected when it asks to save the password, not the vault I've specified as where to save new passwords. This has been long standing behavior in 1 Password. Still on 7 because I'm using a mix of vault locations and while I'm using both teams and personal 1password, I have other vaults in other locations.
- deleted 5y ago[deleted]
- ddtaylor 5y agoKeePassXC.
- eole666 5y agoExactly. I never understood why tech-savvy people pay for some private closed-source password-manager while there are some great free and open source alternatives. I also heard good things about Pass "the standard unix password manager". Great for those wanting to use the command line and git to manage their passwords. A more accessible solution is Firefox password manager : it works rather nicely and at least it's not owned by a company trying to make money on password management.
- quartz 5y agoSeems like the responsible move would be for you to submit this to their bug bounty before disclosing to the community? https://bugcrowd.com/agilebits https://bugcrowd.com/agilebits
- akerl_ 5y agoWhy is that more responsible than telling users?
- jmull 5y agoMaking it public before there's been a chance to fix it gives attackers a chance to exploit it. Now, those so inclined know to monitor shared vaults.
- akerl_ 5y agoAttackers don’t have to wait til it’s public to exploit it.
- quartz 5y agoThere's a whole concept of responsible disclosure[1] in white-hat security research that involves notifying the company and then notifying the public after giving the company a chance to fix the bug. It's generally understood to be the most ethical approach. [1] https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure https://en.wikipedia.org/wiki/Coordinated_vulnerability_disc...
- akerl_ 5y agoEven that page points out that “coordinated disclosure” is a more accurate term for what you’re describing. There are a wide variety of opinions in the industry about the merits of coordinated vs full disclosure. Calling one option “responsible disclosure”, or suggesting that it’s generally understood to be the most ethical, is outlandish.
- drcongo 5y ago
- jtbayly 5y agoYou can still specify your default vault, though, to be your private one, right? (I say this as somebody who is looking to get off of 1P.)
- jrochkind1 5y agohow come you're looking to get off? I have been looking to get ON!
- natch 5y agoSubscription fees / rent seeking?
- kevindong 5y agoCan you expand on what you mean by "rent seeking" in this context? Regarding subscription fees, there's nothing wrong with paying for software.
- npteljes 5y agoEspecially that one pays for a service in case of 1P.
- evanb 5y agoI _bought_ 1P way before it was a service. I continued to pay for upgrades. I don't want a subscription, and I don't want to be forced into their black-box syncing. I've been migrating to the free software pass [0]. [0] https://www.passwordstore.org/ https://www.passwordstore.org/
- npteljes 5y agoI see, I wasn't aware that they are / were doing a standalone software version too. I always knew about them as a web service.
- paiute 5y agoI have a problem with it showing my passwords in plain text. So when I'm doing a demo where I share my screen everyone can see my passwords. I absolutely hate 1password.
- cityzen 5y agowhere does it show passwords in plain text? Mine has never done that on any version of 1password (ios, mac, multiple versions).
- paiute 5y agowhen I'm using a new user on a web site. This is a problem for me everyday. I searched through every setting.
- yawnxyz 5y agodon't you have to click "reveal" to show the plaintext password? Oh, you mean for new generated passwords
- PontiacParade 5y agoThis is not a problem I have, this may be helpful: https://1password.community/discussion/30903/how-to-reveal-passwords-by-default-resolved-select-setting-in-view-menu https://1password.community/discussion/30903/how-to-reveal-p...
- krautsourced 5y agoCheck this setting (in the Desktop App): Settings > Security > Display > Always show password and full credit card numbers
- mafriese 5y agoUse Bitwarden instead. fixed. https://bitwarden.com/ https://bitwarden.com/
- deleted 5y ago[deleted]
- fortuna86 5y agoStill has a yearly fee for needed features.
- NylaTheWolf 5y agoMay I ask what premium features you feel are needed? I feel like Bitwarden is extremely generous with its free tier.
- fortuna86 5y agoI believe it was the browser extension to copy passwords irrc.
- NylaTheWolf 5y agoLike copy the password from your vault? Because that is a free feature haha
- fortuna86 5y agoNot as a browser extension.
- NylaTheWolf 5y agoI've been able to do that with the BitWarden browser extension and I don't have premium... Was it a bug for you perhaps?
- stelgard 5y agoLoved 1password. It was my first password manager and for years I've bought it, and was happy to pay for such a great app. However they've recently switched to subscription. They've done it gradually to not let people run away. Ty 1password for all ur help in these years, but I will not use u anymore. I sincerely cannot accept these kind of things. I've bought an app, and the developer turned it to subscription based. Ok. It's your choice. But you've lost me. :)
- smt88 5y agoThis is a weird hill to die on. Yes, you "bought" the app, but it gets constant updates. It's not like 1990s desktop software, where version X was some static thing that didn't require maintenance as long as it worked. 1Password needs constant, expensive maintenance even if it has zero bugs because they have to keep pace with potential attackers. They're spending a stream of money to keep the app updated and secure, so why shouldn't they ask for a stream of money from users? Also, comparing to Dashlane and LastPass (both of which are train wrecks), I would pay a lot more for 1Password. It's one of the best-designed, best-UX apps I've used in years. I'm kicking myself for only switching from LastPass a few weeks ago.
- b3morales 5y agoSpeaking for myself, not parent, but one of their key justifications for the subscription was their cloud storage, which is a feature I do not want for my personal password store. I would actually be okay with a subscription (as long as I didn't lose read access on cancellation), if it didn't have that forced misfeature.
- stelgard 5y agoAs I said, they can do what they want, and I'm not asking for a refund. But I can (also) choose. And I can choose if to continue to buy their service or not. I will not. :)
- smt88 5y agoI don't care what you do. I'm obviously not saying you should be forced to use it. I was just disputing this sentence: > I've bought an app, and the developer turned it to subscription based. A one-time payment usually doesn't cover on-going costs, to "bought an app" is a concept that doesn't apply neatly to security-related software.
- illuminated 5y agoI'm in no way affiliated with them, but as a very happy user I can recommend you to try BitWarden [0] instead of 1Password. It doesn't have the bug you have described, nor it shows passwords in plain text by default (you can also copy a hidden password to clipboard - useful when you share a screen with someone). [0] https://bitwarden.com/ https://bitwarden.com/
- barbazoo 5y agoDoes 1Password show the password in plain text by default somewhere? I haven't noticed.
- l30n4da5 5y agoBeen using Bitwarden ever since LastPass imploded themselves with their idiotic policy of no Destkop + Mobile for free users. Very happy with Bitwarden. Has a self-hosting option, too, which I like. been debating setting up a self-hosted server here at home for storing my passwords.
- NylaTheWolf 5y agoI was actually looking for a password manager around the time LastPass introduced that policy. I was considering it but when I saw that I was like, "Okay, looks like LastPass is off the table." I ended up going with Bitwarden and I am very happy with it. Actually, 4 days ago was my official one-year anniversary with them!
- dawnerd 5y ago1pass has excellent support so if it’s a real issue just bring it up with them. They seem to be one of the few companies that’s exploded in growth but managed to keep support quality up.
- eCa 5y agoI would see it more as an issue that secrets are potentially shared with departments that shouldn’t have access to it. > you may not want your entire company to know that you just generated a password for a jobs site. I would not put any personal (as in not work related) passwords and secrets in a 1password account controlled by my employer, on principle.
- princevegeta89 5y agoSwitch to bitwarden and you could have been just the one who fixed it
- dkonofalski 5y agoThat implies a lot of assumptions.
- roustem 5y agoIf I understand the problem correctly, the generated passwords are being saved in the vault that is set as a default vault for new items. It is possible to change it to a different vault and 1Password 7 uses the private vault in the beginning. Still, this is certainly not ideal. This feature is based on something that was in the app from version 1.0. It was important for the app to save all generated passwords so that you never lose them by accident. We had a chance to rethink it in 1Password 8 and build it from scratch. The history of generated passwords is implemented version 8 in a better way. — Roustem 1Password Founder
- aniforprez 5y agoI'm curious about what's changed in 1P8. Can you elaborate?
- roustem 5y agoSure! In 1Password 8 we added system vaults that are only visible to the app. One of them is used to store the generated passwords. This vault is synced across all your devices and you always have access to the previously generated passwords. The app no longer shows the generated passwords in the item list. Instead, they are available in the browser extension: https://cln.sh/YtKtAq https://cln.sh/YtKtAq Systems vaults can also used to sync other data like certain user settings, search history, etc.
- deleted 5y ago[deleted]
- danguson 5y agoThis is a good spot, It would definitely help the future users.
- caymanjim 5y ago1Password has become fundamentally insecure since about a year ago. You used to be able to run multiple instances of it and log into them separately. You could also run the browser plugin in multiple Chrome profiles and they were fully independent. This is the only sensible, secure way to manage something as sensitive as passwords. Now they have intentionally crippled your ability to maintain isolation. They want you to go to "one place" to manage all your passwords, across accounts, and muddle through their clunky UI to change vaults. It's not obvious which vault new credentials are saved in. It will pull credentials from all vaults when you go to fill out forms, so now when I log into the different Google accounts I have to use (various clients), even though I'm using separate Chrome profiles, it's all a single 1Password behind the scenes, so I'm prompted to pick from a list of many accounts. I constantly use the wrong credentials to log into things and have to log out and start over. I'm constantly worried that I'm going to leak client credentials into another client's system. It's a huge anti-security pattern, and they did it on purpose. I went to the 1Password forums to learn more about this, and a representative from 1Password stated this was intentional and was proud of it, stating something to the effect "it wouldn't be 1 password otherwise". I won't use 1Password if I can avoid it, but I'm often required to due to clients using it. I switched to Bitwarden with a self-hosted server for all my personal credentials.
- ShakataGaNai 5y agoThe browser plugins can filter to different accounts. So if you have a work profile and and a work 1password account - you can set the plugin to match. You can then set the plugin on your personal chrome profile to match your personal account. I used to work across multiple customers. One chrome profile for each (so gmail or o365 didn't collide), one 1password account for each. Works really well.
- thatswrong0 5y agoThey also broke the browser extension so it can longer read your personal vault in Dropbox / iCloud, in an apparent attempt to force you to move your passwords onto their servers. Literally removing functionality for the sake of... money I guess. So now I'm stuck copy / pasting all my usernames and passwords. Thanks 1Password. Unfortunately I still haven't found an alternative that works as well, otherwise I'd have switched a while ago.