bwoodruff

<3

I can try. Would you mind elaborating on what the issue is? What are the steps you're taking, and what is or isn't happening as expected? I don't work on our extensions directly, and it may make more sense to put you in touch with the folks who do, but I'm happy to take a look.

Hello!

> - Why does the integration require two servers with exposed ports? The REST API documentation doesn't say which service I need to connect to for the resources, so I assume the answer is the API server, so what does the other server listen for?

The server you'd interact with is the API server. The other server is responsible for syncing. The fact that there are two was a design decision.

> - How do I request a TOTP? In particular, am I correct in my assumption that the implementation is simply providing you with the TOTP seed values, rather than a TOTP?

I don't believe we can provide the current OTP value as it stands. This is something I'd be happy to suggest to the team that we look at for a future iteration.

> - Is there any audit logging whatsoever?

Yes! You can either audit from the container directly, or through the item usage report in the 1Password.com web app.

If you need further assistance please feel free to reach out to us. We'd be happy to help. https://support.1password.com/contact/

- Ben, 1Password

That is a limitation imposed by the App Store's rules. We're unable to use the screen recording system permission to look for QR codes on screen. Otherwise all of the OTP features are there. You can drag and drop a QR code onto the reader to add an OTP to a record, for example.

- Ben, 1Password

It was removed because we needed to change directions on development and continuing to maintain it as well as build out the new implementation was untenable. It came out on Linux first because the Linux app was developed with it in mind, whereas on other platforms we were re-working existing systems to integrate with it. The former materialized quicker.

- Ben, 1Password

> I do wish you'd figure out the Chrome extensions on macOS, though. I don't understand why I have to choose between excellent browser integration OR more seamless integration with the native app and fingerprint support in the browser extension.

We're efforting on that! Thanks for the feedback. We currently have better integration with our 1Password for Linux beta, and that will be rolling out to other platforms as well.

- Ben, 1Password

Hi! I work for 1Password. We have this functionality available in beta with our 1Password for Linux app. It will be available on Mac and Windows in the not-too-distant future, though I can't say more specifically when that will be.

[1] https://1password.community/discussion/comment/591579/#Comme...

These are great answers. Thank you. - Ben, 1Password

If you don't mind sharing: what benefit do you get from this configuration vs using the features of 1Password.com that are included in membership? - Ben, 1Password

You make a very fair point and raise a reasonable concern. We do participate in external security audits, and will be having Cure53 do an in-depth one of 1Password for Linux. https://support.1password.com/security-assessments/

The important bit for us w/r/t making 1Password a better cross-platform citizen is the Rust core. - Ben, 1Password

While I understand where you're coming from, I think "indefinitely" is a fairly impractical viewpoint in the sense of modern computing, particularly in the context of 1Password. Presumably you'll continue to update your web browser and your OS, which will at some point necessitate updates to the 1Password apps. For example, with Safari 13, which came baked in with macOS 10.15, Apple changed their entire extensions framework and retired the old one. 1Password 6 was built around the old one. So even if you have a license, and could theoretically install 1Password 6, if you're a Safari user it doesn't do you much good. Membership on the other hand would've included 1Password 7, where we implemented a Safari App Extension for Safari 13+ support. Just a counter-point for consideration. Also, for what it's worth, 1Password memberships become read-only when your subscription lapses, but you don't lose access. - Ben, 1Password

I really don't think I could've said it better myself. Thanks for the comments. - Ben, 1Password

Thanks for the comments. The crypto is open source. We use the ring library: https://github.com/briansmith/ring - Ben, 1Password

Oof. I'm sorry. :(

You're welcome!

This comes from Electron: https://github.com/electron/electron/issues/21967

OpenGL is included because the UI is hardware accelerated. ffmpeg comes from the toolchain (Electron, specifically). It looks like there is an open issue with Electron for that: https://github.com/electron/electron/issues/21967

Yes and no. A much better explanation than I can give here is covered in our blog post: https://blog.1password.com/totp-for-1password-users/ - Ben, 1Password

The app itself is not open source, though we have built on a number of open source technologies. Arguably the most critical component is open source, and that is the ring encryption library.

That is indeed a big part of it. - Ben, 1Password

This is the correct answer. Thanks! - Ben, 1Password

We're not thrilled about the 17+ requirement either and are evaluating our options there. Thanks! - Ben, 1Password

Thank you! This is correct. We understand there are concerns about Electron (some legitimate and some religious), and we've built this app with those concerns in mind. The backend is Rust, with the arguably most critical components (encryption) being open source libraries (ring). - Ben, 1Password

Have you tried 1Password for Linux? - Ben, 1Password

Have you found either of those applies to 1Password for Linux? If so we'd very much like to hear about it. Thanks! - Ben, 1Password

Just to clarify: the feature is currently in beta. > Unlock 1Password using your Apple Watch on Macs with a Secure Enclave. From the 1Password for Mac 7.7.BETA-0 release notes. - Ben, 1Password

I apologize that we've come across that way. I'm one of the primary contributors on our forum and so I do appreciate the perspective here. The position I try to take, not being a developer or project manager myself, is that I have no power to make feature requests happen other than suggesting them to the team. As such I try to help people best use what is currently available while also passing suggestions along.

As a company we tend to keep future plans pretty close to the chest. There are sometimes things that we know we aren't going to do, and whenever possible I try to be up front about that rather than beating around the bush or giving false hope. List view is one example of this. The intention isn't to be argumentative, but rather to set expectations based on current plans.

- Ben, 1Password

We're not thrilled about the 17+ rating on iOS either, and are evaluating our options there... Thanks! - Ben, 1Password

It is a hybrid. The UI is using Electron. The guts are Rust. - Ben, 1Password