Help 1Password support Adults with Learning Disabilities

FSsite01We like to help people here at AgileBits, whether or not it involves keeping your passwords and other things safe. When we discovered we will soon have an opportunity to do a little of both, we couldn’t resist, and we wanted to see if you could lend a hand.

Frederick Sarran likes to ride bikes. He also happens to work near Greig Allen, one of our Customer Support Happiness Engineers, for Balnagask Court in Torry, Aberdeen, a complex for Adults with Learning Disabilities (ALD) and Mental Health issues. Balnagask Court helps these adults with activities like outings, arts and crafts, and music. On August 8, Frederick is going to start riding 450 miles all over Scotland, UK to raise money so Balnagask Court can do more. This is where we all come in.

You can donate to Balnagask Court at Frederick’s website and help spread the word with his Facebook Page. Every little bit helps, and his biking trip is fully funded which means 100% of your donations will help Balnagask Court provide better communal rooms, new chairs and equipment, and more activities that do wonders to enrich the lives of adults with learning disabilities.

To say thanks for your donation, Frederick will promote you, your company, or simply your personal Twitter account on his website and on the ride. AgileBits made a donation to sponsor the ride so Frederick will wear a couple of our t-shirts for parts of the trip. We hope you can chip in too.

1Password 4 for Mac is coming – sign up for our newsletter, save the world (from bad passwords)

1P4 Mac beta banner

Do you like 1Password for Mac?

Do you like possibly being picked to beta test incredible new versions of software, finding bugs, and squishing them with impunity?

How about newsletters?

If you like at least a couple of these, there’s a good chance we’ll like you, so why not sign up for our 1Password 4 for Mac newsletter? Soon, we’ll have infrequent news and details to share about what is easily this year’s most widely anticipated new version of 1Password for Mac. We’ll also have a private beta test, which means if you want to help defend the world from bugs and bad passwords, you’ll hear about your chance on the newsletter. Keep in mind, 1Password 4 for Mac will require OS X 10.8 Mountain Lion.

Keep in mind that, once we start looking for beta testers, we won’t have room for everyone and it will be a slow rollout. Hang tight for details on that because we still have plenty of work to do.

Since we announced the 1Password 4 for Mac newsletter on our Twitter and Facebook accounts yesterday, we’ve received over 7,100 signups. I’m no economist, but I think it’s pretty obvious that the following chart makes this number look really awesome.

1P4 Mac newsletter signups

Know what else would be really awesome? You signing up for our newsletter to be among the first to learn about the all-new, utterly gorgeous and powerful, coming-later-this-year 1Password 4 for Mac.

Apps that Love 1Password: iCab Mobile

iCab Mobile - search

iCab Mobile now lets you easily find your 1Password Login for the current webpage

Good news, everyone: the Apps that Love 1Password page has broken into the iOS browser scene, thanks to Alexander Clauss’s iCab Mobile.

This is particularly good news for me, as iCab has been my main iOS browser for quite a while. With the big version 7.0 upgrade Alexander released, iCab Mobile’s action menu now lets you switch to 1Password for iOS and AutoSearch for the Login for iCab’s current webpage. Swipe the Login item, tap the clipboard to copy your password, switch back to iCab, and log right in.

Bonus points: 1Password will erase your password from iOS’s clipboard after 90 seconds. You can adjust this Clear Clipboard option under Settings > Security.

Thanks to Alexander Clauss for making it easier to securely log into webpages with iCab Mobile and 1Password!

Our own Chris De Jabet makes an appearance on Geek Beat TV

[youtube https://www.youtube.com/watch?v=oPv_UTwM3UI]

Chris De Jabet, AgileBits’ own Caffeinated Problem Solver, ran into Cali Lewis of Geek Beat TV fame and got to chat with her about 1Password. She even tried to squeeze out some details on what we have coming next but, remembering that we are indeed a security company, Chris decided to leave the cat in the proverbial bag.

Understanding Sharing

1Password 4.2 for iOS has been released with a really nifty sharing feature. This allows you to conveniently share items with other people and keep them updated. Before getting into the details, it is important to know that the data is well encrypted within 1Password, but it is not encrypted when it is not in 1Password. In other words: share over secure channels and be sure you can trust your recipients. More on that later.

The overview

share-transparentIn 1Password 4.2 for iOS you can share an item (a Login, a Credit Card, or anything else in 1Password) by tapping on the share icon. You can then share the item by Mail or by Message. The recipient will just have to tap on the link in the message or email to easily import or update the item into their own 1Password keychain. It’s remarkably easy and convenient. It’s great for families, whose members need to share certain Logins and other 1Password items.

Just be sure to share with care. When you send one of these messages, anyone with copy of 1Password can import the item into their own library. So you will need to find a “secure channel” that is sufficiently secure for your needs. More on this, and so many other things, in the somewhat roundabout article below.

Even dogs can learn to share

Login for NewBarkTimes

Patty (one of my dogs) and Molly (the other) have a subscription to the New Bark Times.Patty set up the account and put the Login Password into 1Password. She uses it when she wants to read up on the latest techniques of how to steal the human food without getting caught. Molly – as a member of the same household – is also entitled to read the online edition. She likes to sniff the comics, which are mostly just depictions of dead squirrels. They are funny because the squirrels are dead.

Ways of sharing

So how do Molly and Patty share the Login information for the New Bark Times? I’m going to run through some sharing options, starting with the most cumbersome and finishing with the most convenient.  You can jump ahead to the section on using the new feature in 1Password 4.2 for iOS, but it is easier to understand what is going on and find what works for you if you follow along.

(Pass)word of mouth

Patty can simply tell Molly the password, and Molly can use that information to create an entry into 1Password. Note that Patty telling Molly the password and account details while they are both hiding under the bed constitutes “sharing over a secure channel”. They do so where Mr Talk (my neighbor’s cat) can’t listen in.

The advantage of this method is that it is the most secure. It is easier to arrange a secure channel for whispering something into someone’s ear than for transferring a data file with sensitive information. At least it’s easier for members of the same pack or household.

Any time Patty updates the information, she’ll have to tell Molly, who in turn, will have to edit her data. Likewise if Molly makes changes, Patty will have to manually (“pawually”?) edit her own 1Password data.   Wouldn’t it be nice to avoid all of those manual edits?

1PIF, two PIF

Before they got their paws on 1Password 4.2, Molly and Patty had worked out another way to share the New Bark Times Login. They didn’t like all of the manual editing, so they managed to share the Login by exporting and importing a 1PIF (“1Password Interchange File”) file with that Login. 1PIF files can be imported and exported to and from 1Password on Mac and Windows.

Patty would select the item and  use  File > Export Selected …  >  1Password Interchange File from the menubar. All Molly needs to do is import that 1PIF into her 1Password data, and not worry about manual editing.

1PIF files are not encrypted, so Patty and Molly need to use a secure channel to exchange them if they don’t want Mr Talk getting that data. They might use some file sharing over their local network, and they should remember to securely erase the 1PIF after it is done.

Sharing updates: Unique in all the world

There is another nice features about using 1PIFs this way. Every item created by 1Password has a Universally Unique Identifier (UUID). If Patty and Molly each create their own separate Logins for the New Bark Times, they will have different UUIDs even if their content is identical. But if Patty creates the item and exports it as a 1PIF for Molly to import, they will end up having the same UUID.

Here is where the magic comes in. If you import an item with a UUID of something that already exists in your data, 1Password updates the existing item instead of just creating a new one in your keychain (I’ll save the explanation for how we make sure that the UUIDs really are unique as a birthday present). If Molly modifies the New Bark Times Login, she can export it it for Patty to import, which will update the item in Patty’s keychain.

1Password 4 makes sharing even more convenient

Exporting and importing 1PIFs is fine as far as it goes for 1Password 3 for Mac and 1Password for Windows, but until now, 1Password for iOS didn’t have an import or export mechanism.

1Password 4.2 for iOS gained just such a sharing system, and it is extremely convenient.

Sharing a Login by MessageWhen Patty looks at the Login item in 1Password for iOS, she can tap the Share icon, then select “Message” or “Mail”. After that she should select “Message Login” or “Mail Login”.  These options share the 1Password item in a form that isn’t fit for humans (or dogs) to read. Instead, it uses an obfuscated format that your recipient can easily import into 1Password.

But note again, even though it isn’t designed for humans to read, its contents are still exposed to anyone, including the nefarious Mr Talk, who has access to 1Password. This is another reminder that Patty and Molly need to find a secure channel for sharing 1Password items.

The alternative Mail and Message format, “Mail/Message Clear Text”, puts the Login’s details in a human readable format. And it’s not just Logins that can be mailed or messaged. You can Mail Software Licenses, Message Credit Cards. Almost everything in 1Password can be shared this way; attachments are the only thing that don’t make the trip.

NewBarkTimes-import2When Molly receives the email or the message, all she needs to do is tap on the included link. At right, you can see what this looks like if the Login was sent by Mail.

The import will add a new item if the received item has a UUID that isn’t already in the recipient’s keychain. All Molly needs to do is approve the import of the new Login.NewBarkTimes-import1

Sometime later, Patty may update the item. She might add in a Note to the Login with the answer to a security question (Q: “Favorite pet”, A: “Me”).  Though of course, Patty should know not to give predictable answers to security questions, either.

NewBarkTimes-import3

After Patty has made some changes, she can just send the item to Molly again.

This time, 1Password will see that an item with the same UUID already exists in Molly’s data, so it will prompt Molly to see if she wants to update the item. Molly, of course, can also make changes and send the updated item to Patty.

This makes it really easy for Patty and Molly to share these items between their iOS devices via iMessage, which can provide a sufficiently secure channel for most purposes.

Finding a secure channel

As with 1Password’s other sharing methods (including word of mouth), Patty and Molly need to make sure that they have a secure channel. That is, they need to know that the message is going to the right person (don’t accidentally send it to Mr Talk); they need to know that it is coming from the right person; they need to know that nobody can listen in on the channel; and they need to know that nobody can tamper with the channel.

iMessage probably provides a secure enough channel for most people for most cases, though it may not be sufficient if you are trying to keep secrets from Apple or from law enforcement agencies. Even if you don’t anticipate attacks from those sources, there are a few cautions:

  1. It’s not always clear when a message will be sent by iMessage or via the much less secure SMS. Unfortunately, we haven’t (yet) found a way to make it clear from within 1Password when a message is going out over iMessage or not.
  2. It is often a bit too easy to accidentally send a message to the wrong recipient. So please take care that you really are sending it to the correct address.
  3. After a message or email has been sent and received, you should look at ways to delete the messages. For email, this is particularly difficult to do thoroughly, as most email servers create backups.

Molly and Patty might be willing to use one channel for sending their New Bark Times Login that they wouldn’t be willing to use for sending their First Bank of Canis Major Login. These are choices that only Patty and Molly can make for themselves.

1Password 4.2 for iOS gets huge update to browser, sharing features

Sometimes there’s an app. I won’t say hero, because what’s a hero?

But sometimes, there’s an app. And I’m talkin’ about 1Password for iOS here. It’s the app for our time and place, and we just gave it a huge, free 4.2 update.

 

1Browser

How huge is this update? Well, for starters, we added our Strong Password Generator to the 1Browser on iPad (yes, the all-new Web Mode is now the much snappier and pun-ier “1Browser”). Go & Fill Bookmarks are now in 1Browser on iPad too, so you don’t have to switch back to Vault Mode to find a Login to open and fill automatically. We also added the option to AutoSubmit after using AutoFill for a Login.

Now, I know what you’re thinking, and the answer is yes: the Strong Password Generator and Go & Fill are on their way to 1Browser on iPhone in a future update.

If you’re using 1Browser as, well, your one browser more often these days, you may be pleased to hear that if 1Password sees a URL in the clipboard, it’ll prompt you to open it in 1Browser. There are plenty more 1Browser goodies where those came from, so be sure to check the full changelog below.

Sharing

Yeah, that’s right. You asked, we answered. You can now share 1Password items from Vault Mode via Messages and email in either an obfuscated format or plain text. Your lucky recipient will see an “Add to 1Password” link, and I recommend they tap it; makes the whole process pretty easy.

By the way, here’s a ProTip about sharing: if you use the obfuscated option to share items, the item’s ID is included. This means that, if you share an item and your recipient makes an update—such as add to a Secure Note or update a Login’s password—then shares it back to you, 1Password will actually update your current copy of the item with the changes.

Just be sure to share with care. Using the obfuscated option means anyone with a copy of 1Password for iOS could add it to their library (since we’re using a shared key for these items, it could also be reverse engineered). Make sure you trust your recipient(s) to keep those messages private and, even better, delete them as soon as they’re done.

Search

Search in 1Password usually focuses on item titles. Now we also search URLs for Login items. But if you don’t find what you need on the first pass, you will now see a button to expand search results to all fields.

But wait, there’s more

Honestly, you don’t even need to wait till 3’oclock. Go get the 1Password for iOS update in the App Store right now.

Download 1Password on the App Store

The full 1Password 4.2 for iOS changelog

1Browser

 • Added Go and Fill bookmarks in the 1Browser on iPad.
 • Added the ability to use the Strong Password Generator in the 1Browser on iPad.
 • Added the ability to auto-submit on login filling.
 • Added fill animations to make it easy (and fun) to see where fields are filled.
 • Added Copy to Clipboard in the Share menu to copy the current URL to the clipboard.
 • Closing the last tab will now direct you back to vault mode.

1Browser Settings

 • Added 1Browser settings menu at Settings-> 1Browser.
 • Added the ability to adjust auto-submit and fill-animation defaults.
 • Added the ability to clear the Web Data (eg. Cookies) from the 1Browser.

Sharing

 • Added the ability to share items through Messages or email.
 • Shared items include a special ‘Add to 1Password’ link which allows you to directly add them to 1Password.

Search

 • Added the ability to expand search results across all fields.
 • Search results now includes the primary URL of the item.

Other

 • 1PasswordAnywhere (1Password.html) will now display custom fields.
 • 1Password will prompt to open in the web view when launching 1Password with a URL in your clipboard.
 • Improved translations and the addition of Greek.
 • Improvements to Dropbox syncing.
 • Many bug fixes and improvements.

The top 6 worst passwords from the Star Trek universe [Updated]

You would think that, once we master space exploration and how to replicate the perfect cup of Earl Grey, everyone in the future according to Star Trek would understand the necessity for unique, strong passwords.

Unfortunately, you would be wrong. And no, as we’ll see later, biometrics (like voice authentication) don’t seem to help.

As the following evidence from various Star Trek clips shows, some of the passwords used by Starfleet’s finest are weaker than the passwords stolen from the recent Sony and Yahoo hacks. Clearly, these officers could’ve used 1Password.

1. Kirk, Scotty, and Checkov needed our Strong Password Generator

The longest password needed to blow up the Enterprise in Star Trek III is just five characters. My U.S. social security number is longer than that but, fortunately, I’m pretty sure it can’t self destruct anything.

2. It shouldn’t be this easy to eject the warp core

B’Elanna gets points for getting past five characters (yet she loses points for using her own name in her password). But it’s way too easy to strand a ship in the middle of nowhere with a simple “computer!” callout and what is still a weak password.

3. Honestly, who made it this easy to blow up ships

If it was this easy to blow up ships in the 24th century, I’d probably look for abandoned derelicts everywhere I went and do it as a hobby. Those explosions are totally GIF-worthy.

4. Picard’s authorization is so weak, the computer rejects it

Ok, maybe that torn power conduit had something to do with it, but still. If I were the Enterprise computer, I would’ve locked Picard out a long time ago and made him upgrade to a much stronger self destruct password.

5. Chekov’s ship-wide status update password is laughably short

With a password that weak, officers would break into the internal comms every other day and post Burger King-like prank announcements that the Enterprise was switching teams to the Romulans or launching a package delivery service.

6. The password to our shields might as well be 1-2-3-4-5

In Star Trek II: Wrath of Khan, Kirk and Spock are able to remotely shut down the shields of the Starfleet ship Khan “borrowed” by transmitting nothing more than a five-character “prefix code” of 16309.

I know luggage with tougher combinations than that.

Even worse, they looked it up in what seems to be not much more than an Excel spreadsheet of all Starfleet ship prefix codes. What could possibly go wrong?

The clip here doesn’t include the statement of the code. If you want that, skip to around 6:50 in this longer clip. Thanks to Joe Kissell for schooling us on our bad Star Trek passwords.

Honorary mention: Data’s perfect-yet-flawed password

You might think Data created the perfect password that time he went nuts, took over the Enterprise, and mimicked Picard’s voice (hooray for 24th century biometrics!), all in the name of dropping in to say hi to dad. There’s just one problem: he said it out loud for everyone to hear, or at least for the computer to record and tell Picard later.

Did we miss any great moments in bad Star Trek passwords? Let us know on Twitter, Facebook, or our forums!

Use better passwords than Starfleet

Fortunately, the future isn’t written yet. Let’s change your timeline in online security—get 1Password and follow our guides to use our Strong Password Generator on Mac, iOS, and PC so it’s much, much harder to blow up your ship.

Apps that Love 1Password: MUDRammer

MUDRammer - login, browse

MUDRammer now lets you search 1Password for dungeon logins and open all links in 1Password

The family of Apps that Love 1Password has grown once again! This time it’s MUDRammer, which marks 1Password’s first foray into iOS gaming, specifically the text-based dungeon-y and crawling-y genre of gaming.

MUDRammer is an iPhone and iPad client for MUDs, or Multi-User Dungeon games. They’re online, multiplayer, text-based dungeon games, and MUDRammer gives you a leg up with its new 1Password integration. You can now set 1Password as your default browser for links in MUDRammer, and you can tap the title bar to quickly search 1Password for a Login for the current MUD in which you’re playing.

Thanks a lot to Jonathan Hersh for adding 1Password to MUDRammer! You can grab the update in the App Store now.

Feed Wrangler for iOS debuts with 1Password login support

Feed Wrangler 1P iconGoogle Reader shuts down soon, so avid news readers are searching for alternative services and apps. One such alternative just debuted yesterday called Feed Wrangler, and it has some really clever features, including one that landed it on our Apps that Love 1Password page.

If you have 1Password for iOS installed, Feed Wrangler displays a 1Password button on the login page. Tap it, and you’ll switch over to 1Password with an AutoSearch already filled in for Feed Wrangler. From there you can quickly copy your password, switch back to Feed Wrangler and log in.

Feed Wrangler has some great features worth checking out, like Smart Feeds for filtering out items you don’t want to read, and automatically marking a story as read if it’s already in your Instapaper or Pocket queue. Plus, Feed Wrangler debuted as a paid service—just $18.99 a year with free access to the apps—so you know they’re not looking to sell out to Google, Yahoo, or Facebook and turn it into a social ranking app for crowd-sourcing shopping recommendation ratings.