Disable the input field after 4th character in Quick Unlock Code or when submitting the Master Passw

jhollington

[b]Is this bug reproducible? [/b]



Yes.



[b]Which devices did this bug appear on and is it reproducible on any devices?[/b]



iPhone 5, third-generation iPad.



[b]A quick summary of the bug:[/b]



This is a relatively minor cosmetic bug. When entering an incorrect Quick Unlock Code, there is a brief delay before the Master Password prompt appears, during which time the keyboard and code entry field remain active and the user can attempt to enter another code. The second attempt will generally be interrupted after the first two characters with a request for the Master Password instead. This creates a confusing and even somewhat jarring user experience. In fact, the first time I tried it I was led to believe there were TWO attempts being permitted before the Quick Unlock Code was locked out (I was typing fast <img src='http://forum.agilebits.com/public/style_emoticons/<#EMO_DIR#>/smile.png' class='bbc_emoticon' alt=':)' /> ).



[b]Detailed Step-by-step instruction on how to reproduce it:[/b]



Enable Quick Unlock Code

Exit 1Password

Launch 1Password

Enter incorrect Quick Unlock Code

MikeT

Hi,



The delay isn't intentional, it's how long iOS takes to redraw that specific field. We'll look and see if we can speed this up.



That's why we clear the field when it changes to the master password field. Hopefully, we'll find a way to fix this.



Thanks for reporting this.

jhollington

It's not so much the delay that's confusing as it is the ability to start entering characters again right away. I think it would be preferable if the app simply refused to accept any additional input until it had finished switching over to the Master Password entry field. The delay is short enough -- and is combined with the "Wrong Passcode" message -- that I think most users would find that to be normal rather than thinking the app is hung.

MikeT

We'll try to disable the input after 4 characters has been entered.



Thanks!

schellack

Is this bug reproducible?

Yes



Which devices did this bug appear on and is it reproducible on any devices?

iPhone 5, iPad 3 (appears to be reproducible on any device)



A quick summary of the bug:

When you enter your master password to unlock 1Password, if you enter an incorrect password there is an expected and noticeable delay before 1Password tells you that the password was incorrect. The bug is that during this delay, you can continue typing and submitting passwords until the first attempt is rejected or until any one of the attempts is accepted. The expected behavior is that you are either forced to wait until the first password has been processed or that the password text entered is not editable (or is cleared out) as soon as the password is submitted. The reason this is a problem is that it allows you to iteratively try different passwords very rapidly until one works, increasing the likelihood that a brute force attack will work or just making it easier for someone to guess the password if they know a part of it.



Detailed Step-by-step instruction on how to reproduce it:

• On 1Password's lock screen, enter your master password but leave off the last character.

• Hit the return key on the keyboard.

• As quick as you can, enter the last missing character of your master password and press the return key again.

• 1Password will be unlocked. If you're on an iPhone, you will notice a late buzz that occurs after unlocking, which was due to the first invalid password finally being rejected.

khad

Welcome to the forums, schellack! Thanks for mentioning this. I've added a couple additional notes to our information for this issue.



Please let me know if there's anything else you spot. <img src='http://forum.agilebits.com/public/style_emoticons/<#EMO_DIR#>/smile.png' class='bbc_emoticon' alt=':)' />

jhollington

FWIW, I think this is probably related to the same problem I reported here with the Quick Unlock Code: http://forum.agilebits.com/index.php?/topic/11276-brief-lockout-delay-after-entering-incorrect-quick-unlock-code/

khad

Yes. Internally this is the same issue. Merging.