1P4 Android bot

Avoiding the clipboard with 1Password and Lollipop

Copy & Paste clipboards (or “pasteboards” as they are called on Mac and iOS) can be dangerous places for secrets if you have malicious software running on your device. On most operating systems – mobile and desktop alike – most running applications can read from the system clipboard. When you copy a secret to the system clipboard, a malicious process may be able to read and steal that secret.

This, by the way, is not news, but it is good that it has made the news. It helps people be aware of clipboard usage, and it gives me the opportunity to talk a bit about what we have been doing over the years about this.

We have always worked to reduce how much people need to depend on system clipboards when using 1Password. The details differ from system to system, and each operating environment gives us different ways to help reduce clipboard use. On the Mac and Windows PCs we have the 1Password Browser Extensions communicate with 1Password so that web form filling can avoid the clipboard. 1Password for Windows also uses auto-type to reduce clipboard activity. 1Password 5 on iOS offers 1Browser and integration with other apps through App Extensions

1Password Android browserBut today I will reveal a few things that our 1Password for Android beta testers know.

Aside: Before I get to that discussion, I should point out (as I often do), that the single best defense against a malicious program running on your machine or device is to keep your systems up to date with all software and system updates. It is also important to be careful in what you install on your system. 1Password can offer some significant defenses against malware on your system, but you have to help keep your systems free of malware.

1Password 4 for Android already has a simple built-in browser. This allows you to go directly from your Login item in 1Password to the web page, filling the data without the clipboard. Our iOS users are already familiar with 1Browser, and this is shaping up on Android.

Lollipop provides clipboardless sweetness

Of course, web pages aren’t the only thing that people need to fill passwords into, and sometimes people may wish to use something other than the browser built in to 1Password. In the current Beta release of 1Password for Android, we used the latest security and accessibility features in Android 5 (Lollipop) to allow 1Password to fill into other apps without making use of the clipboard.

Starting with Lollipop, we have a way to fill password data into other apps without using the clipboard. Perhaps it would be best to just quote what Nik, our Happiness Engineer, had to say in the beta newsletter just a couple of weeks ago:

Wondering why app and browser filling requires OS 5.0? Me too! So I asked our developers. It turns out that the only way for us to do this in earlier versions of Android OS was to use copy/paste accessibility APIs, meaning that any clipboard manager or malicious app could listen to clipboard events and collect login credentials as they were filled.

In Lollipop, 1Password can fill your information directly, without using the clipboard. Therefore, it isn’t possible for a third party to obtain your passwords by snooping on what 1Password’s doing.

Prior to Lollipop, it would be possible to get this kind of app-filling, but it would have relied on the clipboard under the hood. Because using the clipboard involves known risks, we feel that we should make it clear when copy/paste is being used and minimize it’s use wherever possible. As a result, we decided to focus on a Lollipop-only implementation of our filling feature

If you have an Android device with Lollipop installed and would like a sneak peek, I invite you to sign up for our Android beta.

Clipboards may always be with us

As you can see, we are working to reduce dependency on system clipboards when using 1Password. This is an on-going process. Browser integration on the desktops was something we started with back when the very first versions of 1Password was released for the Mac nearly eight years ago. Later, we introduced our own browser into 1Password for iOS, and much more recently encouraged 1Password integration for other iOS 8 apps using App Extensions. Along the way, we introduced auto-type in 1Password for Windows and a web browser into 1Password for Android. As you’ve learned here, we have in-app filling in our Android Beta, making use of the latest features of Android 5.0, Lollipop.

But while we are progressively reducing the need for copy and paste to a system clipboard, we are a long way from eliminating the need to use these. This is why I must repeat my advice to keep your system free of malicious software.

What I would like to see is a clipboard that could only be read when the user explicitly chooses to paste. This is something that has been suggested a number of times before, but has not be implemented on the most popular operating systems. I suspect that there is a reason for that, but if you know, I eagerly await your insights in the comments.


1P4 Android bot

1Password 4.1 for Android is coming, we extended the freemium date and have a price!

1Pa premium featuresOver the past six weeks, we’ve seen a tremendous response to the all-new 1Password 4 for Android and our free trial experiment. Our team has been hard at work on a number of updates and great new features, and today we’re happy to say that v4.1 is coming soon, we extended the trial date, and we can now announce a price!

v4.1 for Android

Coming soon, 1Password 4.1 for Android will allow new users to create their first vault right on the device, no existing sync or vault required.

We added localizations for German, Spanish, Portuguese (European and Brazilian), Romanian, Russian, and Swedish. We are also finishing up translations into Chinese, Japanese, French, and Italian. Finally, we added some fixes and improvements that lay the groundwork for goodies that are on their way.

Free trial deadline extended, and a price!

Since our experiment is going so well, we extended the final day through Monday, August 18. Now everyone can have a few more weeks to check out 1Password 4 for Android and all its security awesomesauce.

On Tuesday, August 19, our Android version will switch to a freemium model. You can download it for free and use it as a 1Password reader, a great sync companion with 1Password for Mac or Windows, so you can take all your items on the go. To unlock all editing, organizing, and creating features, make a one-time, in-app purchase of just $9.99 USD to get the full power of 1Password right in your hands.

But wait there’s more

Since we’re just that excited about 1Password 4 for Android, we’ll start this off on August 19 with a $7.99 USD Awesome Android Launch Sale! This 20-percent-off sale will run for just two weeks, so when the sale starts mid-August, move fast.

To make sure you don’t miss it and stay in touch with us, be sure to follow 1Password on Twitter and Facebook!

1Password 4 for Android is coming [UPDATE: It’s here!]

1P4 Android bot[Major important update: it’s here!]

We’ve been busy. Not just busy—busy. A while ago we decided that we could rebuild 1Password Reader for Android. We have the technology. We have the capability to build the greatest 1Password for Android the world has ever seen. We then set out to do it.

Now it’s done.

1Password 4 for Android arrives on Tuesday, June 10. It is an entirely new and full-featured app, built for both phones and tablets!

It is also an experiment. All new features will be unlocked and free for everyone to use through August 1, 2014. After that, 1Password 4 for Android will go into a reader mode, and all features can be unlocked for an in-app purchase.

To be among the first to get the whole kit-n-kaboodle about the all-new 1Password 4 for Android, subscribe to our newsletter below (and be sure to respond to the confirmation email!). Press folks who want to give it a look, get in touch with me directly or via the bottom of our Press Room.


We’d like to thank our existing Android users and all 1Password customers for all the enthusiasm over the past year. We can’t wait to show you the incredible new 1Password 4 for Android.

OPa 4 lock screen 2

1Password 4 for Android: The beta, like winter, is coming!

Android Signup Banner

You might have noticed that this summer a couple of interesting screenshots appeared in our Dropbox folder, and then here on the blog.

You also might have noticed that we ran a rather large beta test for our Mac version.

Now those two great tastes will taste great together! We’ve set up a shiny new (if I do say so myself) Android beta newsletter signup page.

If you ever sent us an email or a tweet asking about the future of 1Password on Android, now’s your chance to help shape that future.

It’s an opt-in newsletter, so we’ll send you a message with a confirmation link to click just to be sure you meant to sign up, and to make sure we got your address right.

Join us, won’t you?

AgileBits is now accepting applications to its School of Magic

This image was made by Loadmaster (David R. Tribble) via Wikimedia Commons

Sometimes I feel a bit like I spend my days at Hogwarts. There’s magic happening all over the place, the occasional dragon, and never a dull moment. This has been extra true lately, and as a result, our very own Minister of Magic has declared it is time once again to open applications to Hogwarts! In this case we’re presuming you’ve had a turn under the Sorting Hat, and we’re looking for those who have been sorted into the following Houses:

  • Customer Support
  • Android Developer
  • Windows Developer

As you may have noticed, the iOS version of 1Password got a significant update late last year, and the new Mac version had a dramatic unveiling a couple of weeks ago. For those playing along at home, you’ll recall we have two more versions, and it’s those two we are aiming to transfigure into sleek modern versions. Doing this means we need your help!

And by “you” I mean “a person who is all-around awesome and familiar with 1Password and has excellent communication skills”. We are accepting applications from wherever you are. Yes really! Most of our team works remotely, which is no problem. Our owls can always find you.

You may find it hard to believe, but there’s more awesome involved than just being accepted at Hogwarts. On top of MAGIC, you can also look forward to:

  • An encouraging and cooperative virtual office
  • A healthy pay scale (no house-elf style treatment here!)
  • A flexible schedule
  • Casual Friday…every day! In fact, even more casual, if that’s your thing.
  • Other neato spells and charms that make working for AgileBits loads cooler than whatever you’re doing now.

As for what we ask in return, it’s pretty straightforward:

  • Great work ethic
  • Cool head in a hectic environment
  • Strong communication skills
  • High rum tolerance (ok I’m kidding. It doesn’t have to be rum)
  • Passion for driving 1Password forward to make it the Best App Ever
  • Support members need to be able to help with about 65 email replies a day, ensuring customers get the help they need. No worries though, our Spell books are available for study!

Does this sound like you? If so, please email us with your preferred job in the subject line (Support, Windows Developer, Android Developer). In the email itself, tell us who you would most like to sit next to during breakfast in the Great Hall, and your current favorite app (besides 1Password) on your platform of choice. Also include the answer to this question: What is the motto of the Hogwarts School of Witchcraft and Wizardry?