How Apple's iOS 12 Password AutoFill Feature Works With 1Password

[spinedoc77]

This is awesome. I don't use 1password because they store the passwords and have already had major breaches. But Enpass, which I use, stores passwords locally only (well really on cloud drives) and they have said they will support this. I don't know why it's taken the industry so long to do this.

[Moderator note: This comment about 1Password breaches was mistaken. See this followup post by spinedoc77 and the other explanations below.]

 

[stars_fan]

Amazing its taken to iOS 12 to get something so useful and basic.

Hey at least we got plenty of emoji updates

You’re confused. iOS has been able to do this for several versions. This just also people who pay for 3rd party apps to have access to the auto fill.

 

[Doctor Q]

Will this work with a password manager app when iTunes asks for your Apple ID password?

 

[jclo]

Will this work with a password manager app when iTunes asks for your Apple ID password?

Yes, it worked in the App Store for me. Let me sign in with the Apple ID stored in 1Password.

 

[Doctor Q]

Yes, it worked in the App Store for me. Let me sign in with the Apple ID stored in 1Password.

Thanks for checking. That's great news.

When a password manager does all of the work, so you never have to type your password directly, there's no reason not to use an extremely strong (long and random) password.

 

[Mcicconi]

Is the saving/generation of passwords also handled by 1Password? My biggest problem is that some logins I create on my iPhone are saved to Keychain but never get remembered by 1P ...

Perhaps even an “Import from Keychain” feature, although I’m sure Apple wouldn’t easily allow that.

Thanks for the guide!

 

[WannaGoMac]

You’re confused. iOS has been able to do this for several versions. This just also people who pay for 3rd party apps to have access to the auto fill.

Ive never had an app username and password filled in or offered to be filled in by iOS. Then again, I use LastPass so maybe thats why... it does work in Safari but not in apps.

 

[cwanja]

I use 1password but the free version on my phone only. I suppose this is not supported?

As others mentioned, this will come to the app through APIs in iOS 12. Should not require a subscription to enable.

This is awesome. I don't use 1password because they store the passwords and have already had major breaches. But Enpass, which I use, stores passwords locally only (well really on cloud drives) and they have said they will support this. I don't know why it's taken the industry so long to do this.

Sources?

 

[lsutigerfan1976]

Hate these subs, no thanks, the built in keychain does a good job for most of us.

I was going to say i dont see why i would pay anyone to do what Safari does for free right now.

 

[0970373]

This is awesome. I don't use 1password because they store the passwords and have already had major breaches. But Enpass, which I use, stores passwords locally only (well really on cloud drives) and they have said they will support this. I don't know why it's taken the industry so long to do this.

I've been w/ 1P for a long long time and I don't recall any breaches to the standalone or the subscription model. Could you point me to where I can find info on this?

I am using the standalone version again/now and my passwords are stored in iCloud. I think Dropbox may have been breached but you'd still need to be able to crack the encryption key in order to get to the passwords if someone chose that but that wouldn't be a 1P security problem.

 

[AGKyle]

This is awesome. I don't use 1password because they store the passwords and have already had major breaches. But Enpass, which I use, stores passwords locally only (well really on cloud drives) and they have said they will support this. I don't know why it's taken the industry so long to do this.

Perhaps you've confused us with other password managers, we have not had any breaches at all.

Even if someone did access our servers maliciously they wouldn't have access to your decrypted data. They would need to guess each individual users Master Password and Secret Key combination in order to decrypt it. This would cost significant amounts of time and money, enough time and money that you'd have to be a specifically targeted person where the payoff would be worth it.

No one at AgileBits has access to any user's decrypted data, our servers don't have access, only you have access to the decrypted data. The only way to get that decrypted data is knowing your Master Password and Secret Key. Neither of which AgileBits has, only you have those pieces of information.

 

[the johnmc]

This is awesome. I don't use 1password because they store the passwords and have already had major breaches. But Enpass, which I use, stores passwords locally only (well really on cloud drives) and they have said they will support this. I don't know why it's taken the industry so long to do this.

Please cite your sources regarding 1Password "major breaches". I've been using their services for many years and have not heard of any.

 

[Orlandoech]

Remove your passwords from 1P and reset all of them, they are not safe with either Apple or 1P. DISLIKE all you want, neither can be trusted.

 

[aardwolf]

LastPass is working on the same functionality. Here is a blog post from June:
https://blog.lastpass.com/2018/06/p...re/detail&utm_content=sf89218322&sf89218322=1

They responded to a comment on their Twitter feed today that they are working on a beta as well, and you can subscribe to their blog to find out more.
https://twitter.com/lastpass/status/1004091282359226368?lang=en

 

[AGKyle]

Please cite your sources regarding 1Password "major breaches". I've been using their services for many years and have not heard of any.

See my previous post above yours. There have been no breaches of our service or apps. It's always upsetting to see these types of statements get made because it worries people unnecessarily.

If we were ever breached in any way what so ever we'd make it known to our users, why it happened, how we're preventing it from happening in the future, and what your next steps should be to protecting yourself if anything is required.

 

[spinedoc77]

Perhaps you've confused us with other password managers, we have not had any breaches at all.

You're right, I believe I was thinking about LastPass. Although I still prefer to have my passwords stored and encrypted on my cloud server, plus this way it's free versus $2.99 / month.

I don't think anyone is fully secure though: https://www.theregister.co.uk/2017/02/28/flaws_in_password_management_apps/

 

[aardwolf]

Please cite your sources regarding 1Password "major breaches". I've been using their services for many years and have not heard of any.

I don't agree with "major breeches", but they have had their share of flaws. They fix them quickly, but they exist.

https://team-sik.org/sik-2016-038/
https://team-sik.org/sik-2016-039/
https://team-sik.org/sik-2016-040/
https://team-sik.org/sik-2016-041/
https://team-sik.org/sik-2016-042/

 

[RogerWilco]

This does nothing for many sites that have implemented variations in the two-pane access dialog. For instance my bank often breaks up the entry as user ID, sometimes followed by a security graphic, and then the password entry. MacOS and iOS aren't clever enough to keep up. Maybe in iOS 13?

 

[steve62388]

I don't use 1password because they store the passwords and have already had major breaches.

That's not true at all. There haven't been any reports of 1P being breached. Lastpass, yes, several times.

 

[AGKyle]

I don't agree with "major breeches", but they have had their share of flaws. They fix them quickly, but they exist.

https://team-sik.org/sik-2016-038/
https://team-sik.org/sik-2016-039/
https://team-sik.org/sik-2016-040/
https://team-sik.org/sik-2016-041/
https://team-sik.org/sik-2016-042/

Our official response to those is here

https://support.1password.com/kb/201702a/

Note that we fixed those months before they were ever disclosed to the public. It also does not apply to our 1Password.com service and were specific to our Android application. These do not qualify as a breach either.

 

[cwanja]

Thanks @AGKyle for clearing the air on the reported 1Password breaches.

 

[autumnpatchouli]

The way Apple is using the password manager is going to keep a lot of people using Safari. It's brilliant on their part. I've used 1Password for over 4 years, but when they went to a monthly subscription, it was about the same time Apple had beefed up their password manager. This is working great on iOS12 beta. Honestly, I barely use 1Password anymore. I'll keep it around until they don't honor my old license anymore.

 

[aardwolf]

The way Apple is using the password manager is going to keep a lot of people using Safari. It's brilliant on their part. I've used 1Password for over 4 years, but when they went to a monthly subscription, it was about the same time Apple had beefed up their password manager. This is working great on iOS12 beta. Honestly, I barely use 1Password anymore. I'll keep it around until they don't honor my old license anymore.

I use the Chrome app on the iOS 12 beta, and it has the same access to the password manager. I'll have to wait to see if 1Password/LastPass/Dashlane will work in Chrome like they will in Safari, but I would expect them to.

 

[AGKyle]

The way Apple is using the password manager is going to keep a lot of people using Safari. It's brilliant on their part. I've used 1Password for over 4 years, but when they went to a monthly subscription, it was about the same time Apple had beefed up their password manager. This is working great on iOS12 beta. Honestly, I barely use 1Password anymore. I'll keep it around until they don't honor my old license anymore.

To be clear, we still offer licenses for 1Password 7 (Mac and Windows). Don't want to use our subscription service? You don't have to. Just buy a license, they're available in the app upon initial launch when upgrading from a previous version.

 

[Elwe]

Hate these subs, no thanks, the built in keychain does a good job for most of us.

I generally dislike subscriptions, too, but there is a valid reason why it is happening. It does provide a continuing stream of capital to implement new features and products. It does help deal with piracy somewhat. And it is does lower the cost of entry for some people who need the product for a short period of time.

I wonder if they have the pricing model right, though. Lots of people seem to be ok with $.99 but balk at $2.99 for whatever reason. I wonder "if they could make it up in volume" . . . but I assume they know their modeling better than I do. And it does include 24/7 support; is available for Mac, iOS, Windows, Android, and browsers; and has a year's worth of password history you can retrieve.

The "market" will settle the right pricing . . .