Why 1Password might not lock

peterport

<div class="IPBDescription">Playing videos can prevent auto-lock</div>Hi



I've been using 1Password for a couple of years now & am a very happy customer. It's always worked seamlessly, until this week when I encountered an unusual problem. After some digging around, I think I have isolated the cause & can replicate it on my other machine. I don't understand it, though. So, I decided to raise it here to see if it's just me or if there are wider implications.



I'm using Snow Leopard on my 2010 iMac & all software is up-to-date.



Previously, I could leave Safari running, with many tabs open, & have 1PW open as well. I would walk away from my machine. After 3 minutes, the screen saver would kick in. When I returned to my Desktop, 1PW would now be locked. That was all fine & as expected.



Earlier this week, I left my machine, confident that within 3 minutes it would lock itself. I returned in the evening to find the Desktop still visible & 1PW still open. I could sit down & access both as if I'd been at my desk all day. This continued all week.



By a process of elimination, I worked out that it I had a particular website open, then the iMac's screen saver & subsequently 1PW's auto-lock would never kick in (however, my iChat status would change to "Away" & swap to "Available" upon my return). Close that Safari tab & everything worked as normal. I looked at Safari's Activity window for that tab, but could see nothing obviously wrong.



The website is this page: [url="http://illusioncontest.neuralcorrelate.com/cat/2011/"]http://illusioncontest.neuralcorrelate.com/cat/2011/[/url] . The website seems legit. Can anybody replicate this behaviour on their machines? I have performed it on two Macs. The tab does not have to be visible. With this tab open, Safari, & subsequently 1PW, remain active. Close it & 3 minutes later the screen saver starts as normal. The same behaviour occurs if I use Firefox 4.



I know that 1PW bases its activity on the iMac itself & not just within 1PW. This normally works well. Does anyone know what this webpage is doing that makes my computer act as if there is someone sitting & working on it, when it's left alone in an empty room all day?



I know some might say that you should never walk away from your machine without locking 1PW, but when I'm the only one in the building, I'm used to relying on auto-lock.



Presumably, if it happens with this website, there will be others. I would guess that many 1PW users feel reasonably confident about walking away from their machines without locking them, secure in the knowledge that the auto-lock will kick in after a few minutes. It was fine for me to return to an empty room hours later to find all my passwords still on display, but I could imagine that causing concern if it unexpectedly happened to someone else in a different environment.



Any thoughts?



Thanks

djshack

Seems like something you're doing (or running or visiting) is keeping your computer from going idle. This likely would affect LastPass and any other programs that have an "idle" timer as well. If this is the case, then 1Password won't lock, because it locks based on how long your computer has been idle for (default settings).

khad

Hello Peter,



Thanks for taking the time to bring this up.



While I believe the simple answer is that the site is using the QuickTime plugin which is one of the reasons Apple lists in it's "[url="http://support.apple.com/kb/HT1776"]Why your Mac might not sleep or stay in sleep mode[/url]" article, I would like to add a few points.



[img]https://img.skitch.com/20110521-td7k8tut8grh3parr4c2g154ru.png[/img]



First, you correctly point out that 1Password's own internal timer is based on computer activity rather than 1Password activity. I often simplify this to "mouse/keyboard activity." Though, as we see in this case, that does not tell the full story.



Regarding the screen saver itself, we are at Apple's mercy.



There is always internal discussion here at AgileBits regarding the security settings, and I will bring this up with the team to see how we can improve in these kinds of situations. There are technical hurdles, of course, which may make it difficult or impossible to measure inactivity apart from what is reported by the OS.



To "hurry along" the auto-lock process you might consider the following.



1. Set an Active Screen Corner for you screen saver and activate the screen saver when stepping away from your Mac (System Preferences > Exposé and Spaces > Exposé > Active Screen Corners).



2. Close the lid of your Mac laptop to put your Mac to sleep.



3. Activate the login window when stepping away from your Mac (System Preferences > Accounts > Login Options > "Show fast user switching menu as…")



The above three options will also secure your entire OS X login if you have enabled "Require password … after sleep or screen saver begins" (System Preferences > Security > General). I never walk away from my computer without locking it myself. It is just part of my own personal "best practices" for security. There are many variables to keep track of even for me. I think a some "normal users" would be best served adopting a similar policy.



I don't mean to sound dismissive in any way. I really do appreciate your concern here. I just don't think there is a simple solution at this time.



What do you think?

peterport

Thanks for the link Khad



I'm sure you're right & it is an OS X thing, rather than a 1PW one. It is curious, though. I regularly visit websites that include video on them, yet this is the first time in two years that I've noticed such an effect. I'm guessing there's something atypical about this webpage design. Fortunately, it's not a problem for me, as my work environment is secure & if that's not the case then I use an Active Screen Corner to bring up the screen saver myself. The auto-lock is a useful backup though, as none of us are perfect.



Thanks for your help

khad

I don't believe Flash video will keep OS X from going into sleep mode, but I do believe QuickTime playback will. The site to which you link includes the QuickTime plugin for video playback. Perhaps that accounts for the discrepancy. It's hard to say for certain.



Anecdotally, I will say that I just had trouble last week with a Mac not sleeping after a [i]clean Snow Leopard installation[/i]. It was perplexing to say the least. I also discussed a similar situation with a customer via email. It may be nothing, but I wonder if there isn't something in the latest 10.6.7 update that adversely affects sleep mode. It is a long shot since it has certainly not been reported widely.



All that to say: I don't necessarily have the answer. We will monitor the situation and see if there are more reports of "unusual" behavior (though it is often difficult to measure). Sometimes we only notice certain behavior when we are paying attention to it even though it has been like that all along. Out memories can play tricks on us. <img src='http://forum.agile.ws/public/style_emoticons/<#EMO_DIR#>/skype_smile.png' class='bbc_emoticon' alt=':-)' />



Regardless, I will see if there is anything further we can do in this situation in order to align 1Password's behavior with understandable expectations.



If there is anything else we can help with, please let us know.



We are always here to help!