5 ms·

1Password Watchtower Mac App Integration

34 points by ryanseys 12y ago

bluetidepro 12y ago
This is a neat integration by 1Password! 1Password is probably my favorite Mac/iPhone app that I use. Their product is always top notch. Great work guys!
- infra178 12y ago
  How do you get around the lack of bookmarks in the 1password browser for ios?
  - erikcw 12y ago
    I often just copy and paste the passwords from 1Password into Chrome for IOS. Chrome sync is the one feature that prevents me from using 1Password's IOS browser for anything but the most casual use. Now if AgileBits could figure out a way to integrate with Chrome Sync, that would be something...
    - AGKyle 12y ago
      Do you mean strictly for bookmarks? I'm not sure how feasible this is, having never looked into it, but I can certainly pass this along as an idea if you can confirm the request for only bookmarks. Again, no promises because it might be locked down pretty heavily. Kyle AgileBits
      - erikcw 12y ago
        No, not bookmark syncing (although that is something that is included in the Chrome Sync service). I mean syncing the open tabs across devices[1]. I use iOS Chrome over Safari (and 1PW Browser) exclusively for this feature. Any tab I have open on my desktop is synced to the cloud and available to access from my iOS devices. Any tabs open on my iPhone are also available from my Desktop copy of Chrome. So yes, similar to bookmarks -- but for currently open tabs. https://support.google.com/chrome/answer/2591582?hl=en https://support.google.com/chrome/answer/2591582?hl=en
  - leejoramo 12y ago
    My personal solution is to use https://pinboard.in https://pinboard.in for all of my bookmarks. The thing this doesn't provide me are bookmarks (such as banking, servers, etc) that I need to keep more secure than a public site (even with privacy settings). However, most of these types of items are saved in 1Password.
  - AGKyle 12y ago
    [I work for AgileBits, makers of 1Password] You could use the Favorites section. I favorite my most frequently used sites and use that for most logins that I access often. Would that work? If you have a particular use case that you can run me through that would be wonderful. Also, user gwkoehler, currently above me in this thread, suggests the ophttp:// http:// and ophttps:// https:// in front of users to open in 1Password. There is a bookmarklet for this here: http://www.macstories.net/links/1password-4-1/ http://www.macstories.net/links/1password-4-1/ Kyle AgileBits
    - infra178 12y ago
      My wife bookmarks like a dozen tumblr pages, Reddit posts, fanfic stories, random websites a day on her iPhone and then reads them in bed on her iPad at the end of the day. She's not real tech savvy so I've got her using Chrome which syncs them up to all of our devices: 2 iPads, 2 iPhones, a PC that boots osx and windows, and a Nook. She can pick up any device and her bookmarks are there. It would be difficult to get her to give up that functionality or have to switch browsers depending on what site she's on. Even the bookmarklet that switches you to 1Password isn't intuitive. I wish 1Password would manage bookmarks and sync them between devices like Chrome does.
      - AGKyle 12y ago
        Thanks for this information! I'll take this feedback and see if there's anything we can do in future updates to try to come up with a solution. I can't make any promises, but I'm sure you're not the only one with a similar type of use case. That said though, I don't think we'll be able to integrate with Chrome Sync, pretty sure that's closed up pretty tight. Personally, one of the things I'd love to see is the ability to save a page to Pinboard, which is what I use for bookmarks that I want to read later or reference later. Not sure if that would be of any real use for you though. Thanks! Kyle AgileBits
  - gwkoehler 12y ago
    My method: use mobile Safari, and when I need to log in, put "op" in front of the URL (so it looks like "ophttp://" http://" or "ophttps://" https://"). Press Enter, this launches 1password and points its browser at the URL, ready to autofill.
    - thebranman 12y ago
      great tip, thanks for this
- AGKyle 12y ago
  [I work for Agilebits, makers of 1Password] Thanks for the positive feedback! It really does mean a lot to us to hear that our users are happy. We have more fun things to unveil in future versions so keep your eyes peeled for more down the road. The really neat thing about Watchtower is that we don't send customer data out in order to tell them that their password needs to be changed (or that the site is still vulnerable). We download a database to the user's computer and the data in the user's database is checked against that. If you ever have any questions, comments, or suggestions please let us know! Kyle AgileBits
ColinDabritz 12y ago
Do you know what would be amazing? The ability to change all vulnerable passwords, automatically as a group. I know it's very challenging because password change/reset procedures vary widely, but that part of the process is still manual. 1Password already automates logins almost entirely successfully. Perhaps password changing can be automated as well? If it were robustly automated, you cold easily rotate your passwords once a month, with very little fuss, for example. This is really something that authentication schemes could benefit from supporting an automated API for. Good work on the service. I suspect that heartbleed was the current use case, but this service will be very helpful for future breeches and issues. For example they could alert you that XYZ Service had a data breech, it's fixed, and you should rotate your password. Great work.
- jfb 12y ago
  As a half-way step, they could aggregate and normalize the various stupid rules that sites impose and then automatically generate valid, maximally secure passwords by default. Eventually, 1Password (or similar) could handle e.g. changing them all on a given schedule. I already try to have no passwords older than three months, and it's a PITA.
  - r00fus 12y ago
    Problem: Aggregation and normalization might result in an empty set as contradictory rules prevent harmonization.
    - jarrett 12y ago
      I think the parent comment is saying that 1Password would record the rules per site, not maintain a global list of rules that satisfies all sites. The latter would indeed yield an empty set, as some sites require a special character and some require no special characters.
      - jfb 12y ago
        Yes, exactly; for each site that 1Pwd can recognize as distinct, record the restrictions. Even share these restrictions. And perhaps people could put attributes on their password entry elements (or header metadata) that would describe the limitations of their password systems, so it wouldn't be specific to any one password manager; then, too, they could retire their terrible, terrible, terrible client-side strength checking crap.
jhgg 12y ago
Kyle, Are there any plans to update the Android version of the app? I love 1Password on my mac, but on my nexus 5, the experience sucks! Anything in the pipeline on that? Or is agilebits just focused on OSX/iOS for now? Thanks!
- AGKyle 12y ago
  Hi! Absolutely, we've posted a bit about it on our blog: http://blog.agilebits.com/2013/11/15/1password-4-for-android-the-beta-like-winter-is-coming/ http://blog.agilebits.com/2013/11/15/1password-4-for-android... The beta is coming along nicely, you can still sign up for the beta if you wish to try it out. Let me know if I can do anything else to answer any of your questions or concerns. Kyle AgileBits
  - kolev 12y ago
    For months, autofilling doesn't work on Mac. Neither on stable, nor on development releases. Firefox and Chrome complain about browser signature.
    - AGKyle 12y ago
      Sorry to hear you're having trouble. Please email in to support @ agile bits . com, and mention my name please and that I asked you to email in. I'll get this all fixed up for you. Give a brief description of the error to jog my memory. Kyle AgileBits
davak 12y ago
AGKyle: Since the update, I've spent the majority of the day updating zillions of passwords. As other users have mentioned, bulk updates would be amazing, but I can't imagine how complex that would be. Even trying to "open and fill" is frequently wrong because 1password has saved the webpage as the new user registration page instead of a true login. Small pain for the amazing product you have. I would recommend one thing very highly. Please give the user some information why there is a vulnerability. I've noted some of them are marked from previous large user/pass dumps that are available. If the user knows this, she will know to never use that user/pass combo again. If the user is unaware, they may rotate to another common user/pass that has also been released. Thanks for considering my thoughts...
- AGKyle 12y ago
  Hi davak! We've made some improvements to the new user signup form end of the spectrum in the latest beta version of our extension. You can install the beta by visiting the page below: http://www.agilebits.com/browsers/index.html http://www.agilebits.com/browsers/index.html Make sure you click "Enable Betas" below the Download button before installing. This should improve things quite a bit in most cases. If you run into any sites with issues please email us with the URL so we can test (support at agile bits . com). If we don't know about the site having problems we can't fix it. If you're viewing a login that has a known vulnerability, you see a red bar at the top that says: "Vulnerability Alert - Change Password..." If you click this, it shows a popover, that popover displays a bit more detail with a "Learn More" link. That sends you to the Watchtower site with a lot more detail about why and what to do next. I suppose we could be better here and tag it differently saying it was part of heartbleed, but not all vulnerabilities will have such a memorable name (CVE-2014-0160 is hardly memorable, agreed?) Does that explain things a little more? Please let me know if you have any trouble with the beta extension, too. Thanks! Kyle AgileBits

34 points by ryanseys 12y ago

This is a neat integration by 1Password! 1Password is probably my favorite Mac/iPhone app that I use. Their product is always top notch. Great work guys!

infra178 12y ago
How do you get around the lack of bookmarks in the 1password browser for ios?
- erikcw 12y ago
  I often just copy and paste the passwords from 1Password into Chrome for IOS. Chrome sync is the one feature that prevents me from using 1Password's IOS browser for anything but the most casual use. Now if AgileBits could figure out a way to integrate with Chrome Sync, that would be something...
  - AGKyle 12y ago
    Do you mean strictly for bookmarks? I'm not sure how feasible this is, having never looked into it, but I can certainly pass this along as an idea if you can confirm the request for only bookmarks. Again, no promises because it might be locked down pretty heavily. Kyle AgileBits
    - erikcw 12y ago
      No, not bookmark syncing (although that is something that is included in the Chrome Sync service). I mean syncing the open tabs across devices[1]. I use iOS Chrome over Safari (and 1PW Browser) exclusively for this feature. Any tab I have open on my desktop is synced to the cloud and available to access from my iOS devices. Any tabs open on my iPhone are also available from my Desktop copy of Chrome. So yes, similar to bookmarks -- but for currently open tabs. https://support.google.com/chrome/answer/2591582?hl=en https://support.google.com/chrome/answer/2591582?hl=en
- leejoramo 12y ago
  My personal solution is to use https://pinboard.in https://pinboard.in for all of my bookmarks. The thing this doesn't provide me are bookmarks (such as banking, servers, etc) that I need to keep more secure than a public site (even with privacy settings). However, most of these types of items are saved in 1Password.
- AGKyle 12y ago
  [I work for AgileBits, makers of 1Password] You could use the Favorites section. I favorite my most frequently used sites and use that for most logins that I access often. Would that work? If you have a particular use case that you can run me through that would be wonderful. Also, user gwkoehler, currently above me in this thread, suggests the ophttp:// http:// and ophttps:// https:// in front of users to open in 1Password. There is a bookmarklet for this here: http://www.macstories.net/links/1password-4-1/ http://www.macstories.net/links/1password-4-1/ Kyle AgileBits
  - infra178 12y ago
    My wife bookmarks like a dozen tumblr pages, Reddit posts, fanfic stories, random websites a day on her iPhone and then reads them in bed on her iPad at the end of the day. She's not real tech savvy so I've got her using Chrome which syncs them up to all of our devices: 2 iPads, 2 iPhones, a PC that boots osx and windows, and a Nook. She can pick up any device and her bookmarks are there. It would be difficult to get her to give up that functionality or have to switch browsers depending on what site she's on. Even the bookmarklet that switches you to 1Password isn't intuitive. I wish 1Password would manage bookmarks and sync them between devices like Chrome does.
    - AGKyle 12y ago
      Thanks for this information! I'll take this feedback and see if there's anything we can do in future updates to try to come up with a solution. I can't make any promises, but I'm sure you're not the only one with a similar type of use case. That said though, I don't think we'll be able to integrate with Chrome Sync, pretty sure that's closed up pretty tight. Personally, one of the things I'd love to see is the ability to save a page to Pinboard, which is what I use for bookmarks that I want to read later or reference later. Not sure if that would be of any real use for you though. Thanks! Kyle AgileBits
- gwkoehler 12y ago
  My method: use mobile Safari, and when I need to log in, put "op" in front of the URL (so it looks like "ophttp://" http://" or "ophttps://" https://"). Press Enter, this launches 1password and points its browser at the URL, ready to autofill.
  - thebranman 12y ago
    great tip, thanks for this
AGKyle 12y ago
[I work for Agilebits, makers of 1Password] Thanks for the positive feedback! It really does mean a lot to us to hear that our users are happy. We have more fun things to unveil in future versions so keep your eyes peeled for more down the road. The really neat thing about Watchtower is that we don't send customer data out in order to tell them that their password needs to be changed (or that the site is still vulnerable). We download a database to the user's computer and the data in the user's database is checked against that. If you ever have any questions, comments, or suggestions please let us know! Kyle AgileBits

ColinDabritz 12y ago

Do you know what would be amazing? The ability to change all vulnerable passwords, automatically as a group. I know it's very challenging because password change/reset procedures vary widely, but that part of the process is still manual. 1Password already automates logins almost entirely successfully. Perhaps password changing can be automated as well? If it were robustly automated, you cold easily rotate your passwords once a month, with very little fuss, for example. This is really something that authentication schemes could benefit from supporting an automated API for. Good work on the service. I suspect that heartbleed was the current use case, but this service will be very helpful for future breeches and issues. For example they could alert you that XYZ Service had a data breech, it's fixed, and you should rotate your password. Great work.

jfb 12y ago
As a half-way step, they could aggregate and normalize the various stupid rules that sites impose and then automatically generate valid, maximally secure passwords by default. Eventually, 1Password (or similar) could handle e.g. changing them all on a given schedule. I already try to have no passwords older than three months, and it's a PITA.
- r00fus 12y ago
  Problem: Aggregation and normalization might result in an empty set as contradictory rules prevent harmonization.
  - jarrett 12y ago
    I think the parent comment is saying that 1Password would record the rules per site, not maintain a global list of rules that satisfies all sites. The latter would indeed yield an empty set, as some sites require a special character and some require no special characters.
    - jfb 12y ago
      Yes, exactly; for each site that 1Pwd can recognize as distinct, record the restrictions. Even share these restrictions. And perhaps people could put attributes on their password entry elements (or header metadata) that would describe the limitations of their password systems, so it wouldn't be specific to any one password manager; then, too, they could retire their terrible, terrible, terrible client-side strength checking crap.

jhgg 12y ago

Kyle, Are there any plans to update the Android version of the app? I love 1Password on my mac, but on my nexus 5, the experience sucks! Anything in the pipeline on that? Or is agilebits just focused on OSX/iOS for now? Thanks!

AGKyle 12y ago
Hi! Absolutely, we've posted a bit about it on our blog: http://blog.agilebits.com/2013/11/15/1password-4-for-android-the-beta-like-winter-is-coming/ http://blog.agilebits.com/2013/11/15/1password-4-for-android... The beta is coming along nicely, you can still sign up for the beta if you wish to try it out. Let me know if I can do anything else to answer any of your questions or concerns. Kyle AgileBits
- kolev 12y ago
  For months, autofilling doesn't work on Mac. Neither on stable, nor on development releases. Firefox and Chrome complain about browser signature.
  - AGKyle 12y ago
    Sorry to hear you're having trouble. Please email in to support @ agile bits . com, and mention my name please and that I asked you to email in. I'll get this all fixed up for you. Give a brief description of the error to jog my memory. Kyle AgileBits

davak 12y ago

AGKyle: Since the update, I've spent the majority of the day updating zillions of passwords. As other users have mentioned, bulk updates would be amazing, but I can't imagine how complex that would be. Even trying to "open and fill" is frequently wrong because 1password has saved the webpage as the new user registration page instead of a true login. Small pain for the amazing product you have. I would recommend one thing very highly. Please give the user some information why there is a vulnerability. I've noted some of them are marked from previous large user/pass dumps that are available. If the user knows this, she will know to never use that user/pass combo again. If the user is unaware, they may rotate to another common user/pass that has also been released. Thanks for considering my thoughts...

AGKyle 12y ago
Hi davak! We've made some improvements to the new user signup form end of the spectrum in the latest beta version of our extension. You can install the beta by visiting the page below: http://www.agilebits.com/browsers/index.html http://www.agilebits.com/browsers/index.html Make sure you click "Enable Betas" below the Download button before installing. This should improve things quite a bit in most cases. If you run into any sites with issues please email us with the URL so we can test (support at agile bits . com). If we don't know about the site having problems we can't fix it. If you're viewing a login that has a known vulnerability, you see a red bar at the top that says: "Vulnerability Alert - Change Password..." If you click this, it shows a popover, that popover displays a bit more detail with a "Learn More" link. That sends you to the Watchtower site with a lot more detail about why and what to do next. I suppose we could be better here and tag it differently saying it was part of heartbleed, but not all vulnerabilities will have such a memorable name (CVE-2014-0160 is hardly memorable, agreed?) Does that explain things a little more? Please let me know if you have any trouble with the beta extension, too. Thanks! Kyle AgileBits