Okay... help me with the concept of "Generated Passwords"

jemenake

Okay... I guess I must not be "getting" the intended workflow of using 1Password in this respect.



When I first started using the password generator in my browser, I'd use the "Fill" button, and it would fill in the password field on the web form, I'd click submit and then, my password would be changed, but I wouldn't know what the heck it [i]was[/i]. 1Password didn't add it to my "logins" like it automatically does when I actually login.



So, what I ended up having to do is use the password generator, [i]copy[/i] the password to the clipboard, and [i]paste[/i] that password into the fields of the change-password page [i]myself[/i], and [i]then[/i] go to the site's login page, and [i]paste[/i] that password into the login page and [i]then[/i] 1Password would ask if it should save that as a login item.



And now, on 1Password for [i]iOS[/i], I notice that there's a "Generated Passwords" section, but I couldn't make sense of it, because there were only 10 passwords in it, and I've used Password Generator to generate over a [i]hundred[/i] passwords. So, something isn't making sense, here.



Now, since then, I've discovered that Generated Passwords is [i]also[/i] in my PC version (it was turned off, somehow... probably when I was first exploring the program), and I've also discovered that I can access a password history with the button at the bottom of the Password Generator.



[u]But that still doesn't explain why there are only 10 passwords in my "Generated Passwords" section. My first hunch is that this section [i]only[/i] includes passwords which were pasted by clicking the "Fill" button, is that correct?[/u]



Second question is: How is the "Password History" button (in the browser plugin) different from "Generated Passwords"? Does it include passwords generated while at a site but not "Fill"ed? What if I delete an item from Generated Passwords; does it remain in the Password History? I've noticed that Password History only seems to show those associated with the site I'm currently visiting. Is there a way to see the [i]entire [/i]history?



- Joe

Penelope Pitstop

[quote name='jemenake' timestamp='1355411724' post='65010']

Okay... I guess I must not be "getting" the intended workflow of using 1Password in this respect.



When I first started using the password generator in my browser, I'd use the "Fill" button, and it would fill in the password field on the web form, I'd click submit and then, my password would be changed, but I wouldn't know what the heck it [i]was[/i]. 1Password didn't add it to my "logins" like it automatically does when I actually login.



So, what I ended up having to do is use the password generator, [i]copy[/i] the password to the clipboard, and [i]paste[/i] that password into the fields of the change-password page [i]myself[/i], and [i]then[/i] go to the site's login page, and [i]paste[/i] that password into the login page and [i]then[/i] 1Password would ask if it should save that as a login item.



And now, on 1Password for [i]iOS[/i], I notice that there's a "Generated Passwords" section, but I couldn't make sense of it, because there were only 10 passwords in it, and I've used Password Generator to generate over a [i]hundred[/i] passwords. So, something isn't making sense, here.



Now, since then, I've discovered that Generated Passwords is [i]also[/i] in my PC version (it was turned off, somehow... probably when I was first exploring the program), and I've also discovered that I can access a password history with the button at the bottom of the Password Generator.



[u]But that still doesn't explain why there are only 10 passwords in my "Generated Passwords" section. My first hunch is that this section [i]only[/i] includes passwords which were pasted by clicking the "Fill" button, is that correct?[/u]

[u][/quote][/u]

Sort of. It also contains anything you generate from within the app itself. But if you just click the password generator without filling, it does not save the password (what would be the point?).

[quote]

Second question is: How is the "Password History" button (in the browser plugin) different from "Generated Passwords"?

[/quote]

Generated Passwords are all the passwords you've generated and filled for any site plus those you have generated within the app. This is done so that you never lose a password (provided you don't delete them from there of course).

[quote]

Does it include passwords generated while at a site but not "Fill"ed?

[/quote]

No, I think you have to fill before it makes it there otherwise they aren't really generated.

[quote]

What if I delete an item from Generated Passwords; does it remain in the Password History?

[/quote]

I don't not 100% sure on this because I haven't tested it but I doubt it.

[quote]

I've noticed that Password History only seems to show those associated with the site I'm currently visiting. Is there a way to see the [i]entire [/i]history?

[/quote]

Generated passwords in the app.

jemenake

[quote name='Penelope Pitstop' timestamp='1355418340' post='65053']

Sort of. It also contains anything you generate from within the app itself. But if you just click the password generator without filling, it does not save the password

[/quote]

It sounds like you just contradicted yourself. Either it contains all passwords you generate or it contains only passwords you generate [i]and then click "Fill"[/i]. Which is it?



[quote name='Penelope Pitstop' timestamp='1355418340' post='65053']

Generated Passwords are all the passwords you've generated and filled for any site plus those you have generated within the app.

[/quote]

Okay... step me through that second way, whereby I generate a password "within the app" (whatever that means... the iOS app? The PC app? The browser plugin?), and then [i]don't[/i] click "Fill", and have that password show up in Generated Passwords. How does one accomplish that?



[quote name='Penelope Pitstop' timestamp='1355418340' post='65053']

No, I think you have to fill before it makes it there otherwise they aren't really generated.

[/quote]

I think you and I have different definitions of "generate". When I open the password generator, and there's a random sequence of characters in the text box, I consider that to have been "generated". When I move any of the sliders, and the characters all change, I consider [i]another[/i] password to have been "generated". It sounds like you don't consider a password to have been "generated" unless it has been filled into a form.

khad

1Password only saves a Generated Password when you click the "Fill" button in the extension's generator (or the "OK" button in the generator in the main app). Otherwise you would overload your data with millions of generated passwords as you moved the slider. Why save a password that has been generated but not filled?



Generated Passwords are a safety net. You can have several Generated Passwords for a site over the years after changing the password a number of times, but only one is current. That is the one that should be saved in the Login item for that site.



They come in handy when "upgrading" your passwords from poor ones to strong ones. [b]Please follow the steps in the User Guide carefully when changing a password on a site to a generated password.[/b]



[url="http://help.agilebits.com/1Password_Windows/updating-an-existing-password.html"][size=5][b]Changing a Login's Password[/b][/size][/url]



The "Password History" in the extension will show only the [Generated] Password History for the site you are currently viewing. The complete history of all Generated Passwords is in the sidebar of the main app if you have enabled [b]View > Generated Passwords.[/b]



Please let me know if there is anything else I can help with.



Cheers,

jemenake

[quote name='khad' timestamp='1355474747' post='65187']

1Password only saves a Generated Password when you click the "Fill" button in the extension's generator... ...Generated Passwords are a safety net.

[/quote]



Ooooookay! Got it. So, if all of my logins in 1Password are working, then I can delete the entries from Generated Passwords, I guess.



[quote name='khad' timestamp='1355474747' post='65187']

[b]Please follow the steps in the User Guide carefully when changing a password on a site to a generated password.[/b]



[url="http://help.agilebits.com/1Password_Windows/updating-an-existing-password.html"][size=5][b]Changing a Login's Password[/b][/size][/url]

[/quote]



Uhhh... yeah. I read that after having a really frustrating time with trying to use the generator. I didn't know there was a Password History button, so I'd use Fill to fill in a form to change my password on a site, and then... >Poof<... my password on the site was changed, the generator had closed, and I had no idea what the password was.



I quickly realized that the better workflow was to:[list=1]

[*]NOT click "Fill", but just copy the password to the clipboard.

[*]Paste password into the "New Password" field in the webpage

[*]Log out of the website

[*]Go to the login page for the website

[*]Paste my password into the login form

[*]Tell 1Password to save the password (when it shows the little ribbon at the top of the browser).

[/list]

Now... keep in mind that that's the by-hand don't-have-1Password-do-any-of-this-for-me method. Now, let's look at how the User Manual says to do it:[list=1]

[*]Click the 1Password button in your browser’s toolbar

[*]Select the Password Generator (the fourth section from the top represented by an icon of a safe dial).

[*]Click the Fill button to automatically fill the generated password into the website’s “new password” form field(s).

[*]Submit your new password to the site to confirm the change.

[/list]

and then...[list=1]

[*]Click the 1Password button in your browser’s toolbar.

[*]Select the Password Generator.

[*]Click the “View password history” button. Your most recently generated password will be listed at the top.

[*]Click the circled > to the right of the generated password’s title to view its details.

[*]Click on the concealed password field to copy the password to your clipboard. The “copy” label will briefly change to “copied” to indicate that the password was copied.

[*]Select the Logins section (represented in the extension by a keyhole icon) and click the circled > to the right of the Login title you are updating.

[*]Click the Edit button and paste the newly generated password into the password field then click Save.

[/list]

Seriously? That's 11 steps. That's almost twice as many steps as doing things [i]manually[/i]. For the life of me, since the first day I started using 1Password, [b][u]I've never understood why 1Password doesn't offer to remember the password it [i]just[/i] filled in from the generator for the website it just submitted it to[/u][/b].



Imagine how many steps this would involve:[list=1]

[*]Click the 1Password button in your browser’s toolbar

[*]Select the Password Generator (the fourth section from the top represented by an icon of a safe dial).

[*]Click the Fill button to automatically fill the generated password into the website’s “new password” form field(s).

[*]Submit your new password to the site to confirm the change.

[*][b]When the ribbon appears at the top of your browser asking "Save this password for all logins at { blahblah.com } ?", click "Yes".[/b]

[/list]

Or, it could be like the normal "Save login as { blahblah.com }" ribbon, it doesn't really matter. What matters is that 1Password should, when using the Fill feature from the Password Generator, offer to save the password you just filled over the existing one you have saved for that site (or create a new login if you don't already have a one for that site). And it never seems to do that for me.



Oh, and another thing, while I'm at it...



I've noticed that 1Password sometimes remembers 2 or more logins for a site. This is usually because the url's are a little different (like "http://www.blahblah.com/account_management/login.php/session_[b]JKAFHHAGJHFG[/b]". LogMeIn does stuff like this, incidentally.).



Now, it's pretty rare that you need multiple sets of credentials for the same domain name. There are cases, but they're rare. But 1Password seems to treat this as the default. Here's one annoying thing I've seen 1Password do.[list=1]

[*]I go to [url="http://blahblah.com/order_checkout.php"]http://blahblah.com/order_checkout.php[/url] and enter a username and password, and tell 1Password to remember it.

[*]Later, I go to [url="http://blahblah.com/account_management.php"]http://blahblah.com/..._management.php[/url] and enter the [b]same[/b] username and password. 1Password asks if it should remember it, and tell it to do so.

[*]1Password saves them as separate logins.

[/list]

Why doesn't 1Password... 1) realize that I'm entering the [b]same[/b] login credentials for a different document path at the same domain and then, 2) offer to adjust the saved URL for the login to be the [b]longest common piece[/b] which appears in both URL's (in this case, "http://blahblah.com/")? The thing about 1Password which eats up the most of my time is that I have to, periodically, go through my list of logins, find duplicates, make sure they all have the same username/password, delete all but one, and then change the URL stored in it so that it applies site-wide. And it's silly that I have to do this when, as I said, the vast majority of the time, you only need one username/password for an entire domain name.



One nice thing is that 1Password would only have to ask this once per domain, and then it could save that as a flag for that domain. If you have a login saved for "http://www.blahblah.com/AAA" and, later, you manually enter another username and password at "http://www.blahblah.com/BBB", then 1Password could ask "Use these same credentials for all logins at { www.blahblah.com }?". If you say "Yes", it would mark the login as being "site-wide" and/or adjust the saved URL to be "http://www.blahblah.com/" and update the saved username and password. If you say "No", then 1Password would mark the existing saved login as being for a site with multiple logins, and then offer to save the one you just entered (and will mark [i]that[/i] as being for a site with multiple logins). Then, if you go back to that site and enter a third set of credentials, it wouldn't even have to ask you if you wanted site-wide credentials; it would know that you didn't, and it would just offer to save that username/password as a new login.

khad

[quote]Ooooookay! Got it. So, if all of my logins in 1Password are working, then I can delete the entries from Generated Passwords, I guess.[/quote]

I wouldn't. That sort of defeats the purpose of a safety net, don't you think? <img src='http://forum.agilebits.com/public/style_emoticons/<#EMO_DIR#>/wink.png' class='bbc_emoticon' alt=';)' />



I don't disagree with much else you wrote. There is always room for improvement and combining the "update password on site" and "update local copy" into a single procedure is something we're looking forward to doing. I don't have a time frame, but it is certainly on our radar.



I split the rest of your post into [url="http://forum.agilebits.com/index.php?/topic/11564-why-are-duplicate-login-items-created/"]a separate thread[/url], though since it is a completely separate issue.