Comment by tennysont

7 days ago

1Password suddenly offering to save passkeys without mentioning that they can't be exported to other apps (but are seamlessly synced between devices using 1Password) is what lost them "good guys" status in my mind.

It immediately creates a huge lock-in in a hard-to-notice way. Luckily, I did noticed early on and manually removed the 20 or so passkeys I had created.

Earlier this year, I lost my iPhone and restored from backup. I was shocked to see that I could log into my 1Password account using only the master-key, and that the secret-key was not required. 1Password clearly stated that the secret-key was required to setup a new device, but it turns out that they also (perhaps recently) configure it to upload to all devices in your iCloud account[1]. Ever since then, I've lost faith in 1Password's ability to communicate their security model to me and started looking for an off-ramp.

[1] https://support.1password.com/secret-key-security/

13 comments

tennysont

Reply
rufo  7 days ago

For passkey export, there is a FIDO specification for both a format and secure protocol for exchanging passwords and passkey information between password managers, with support on all Apple platforms, and implemented by 1Password, Bitwarden, Dashlane, and more:

https://rmondello.com/2026/09/07/switching-password-managers...

https://fidoalliance.org/download-credential-exchange-specif...

For the iCloud syncing, I believe they've done that since iCloud Keychain/Apple Passwords was first a thing; I've been aware of it since they introduced it, but perhaps that was more explicit when it was first added. The comment below from a now-defunct 1Password employee account describes the thinking there:

> Importantly, the entire role of the Secret Key is to protect you from us and anything that might happen on our end, like a breach of 1Password’s servers. It does not (and can not) protect you from a local attack. This is mentioned in 1Password’s Security Design white paper [ed: on page 74 of an old PDF; I've linked the newer HTML document below], which goes into detail about the locally exposed Secret Key.

https://www.reddit.com/r/1Password/comments/10iqhdp/comment/...

https://agilebits.github.io/security-design/index.html

I do get why that might be surprising. Without going through the whole onboarding process on a fresh device I can't say how well they highlight that or how easy it is to blow past. All I can say is 1) I've known about it for years and 2) having read through the white paper of how iCloud Keychain works I _personally_ trust iCloud Keychain/Passwords about as much as I trust 1Password, maybe _slightly_ more - but I am also not a security professional, so take my word with very little salt :)

  • tennysont  7 days ago

    To be explicit, 1password did not offer passkey export for more than a year after they were introduced. 4 years later, here is 1password's page on exporting your data[1]. It says:

      You can only export passkeys in 1Password for iOS and Android at this time.

    So that's not great. Let's look at their page on the 1pux export[2]:

      Your data is yours. If you want to export your data from 1Password for any reason, you can.

    And the word "passkey" does not appear on that page. Why are these docs still written like this after 4 years?

    And for the record, this is not impossible. Bitwarden does it[3] via the magic of "ignoring the part of the specification that says not to give users their data." Any open source software would do the same. This is why 1Password is no longer the "good guys" despite having rationalizations for their actions.

    [1] https://support.1password.com/export/

    [2] https://support.1password.com/1pux-format/

    [3] https://bitwarden.com/help/export-your-data/

  • someguyornotidk  7 days ago

    > For passkey export, there is a FIDO specification for both a format and secure protocol for exchanging passwords and passkey information between password managers, with support on all Apple platforms, and implemented by 1Password, Bitwarden, Dashlane, and more.

    Does (more) here include free software like keepassxc and friends which don't restrict what key owners do with their keys? Last I heard, FIDO was moving to ban them.

  • secabeen  7 days ago

    > For passkey export, there is a FIDO specification for both a format and secure protocol for exchanging passwords and passkey information between password managers, with support on all Apple platforms, and implemented by 1Password, Bitwarden, Dashlane, and more:

    Note who is excluded from this list: the End User. The protocol only allows exchange between password manager vendors who choose to interconnect.

tennysont  7 days ago

Oh, also, the firefox extension recently rolled out this feature, I think it was default-enabled:

  > Use universal sign in for logins
  > Our next-generation autofill combines all login types into a single sign in prompt.

What the f does 'next-generation' mean? No link for more information. Obviously I have to turn it off, else for all I know it will start setting up passkeys (now or in a future update) or do something else anti-user. And it also means that I need to be careful about updates to 1password. Sad to watch my relationship with my password manager go downhill.

  • simoncion  7 days ago

    > What the f does 'next-generation' mean? No link for more information.

    It means "Just shut up and use it, someone's bonus and/or promotion packet is depending on the usage metrics.". :P

  • oefrha  7 days ago

    For all I can tell it simply moved the popup widget from below the actual input to the top middle of the page, and now preemptively prompts a lot more aggressively, sometimes not even on a sign-in page.

7734128  7 days ago

That's not a "not good guys" event. That's a "lifetime in prison for all people involved" event.

_zoltan_  7 days ago

hmm, I'm sure with a model that is not restricted, one might be able to extract these locally.