v was created by your client when you first signed up, and was sent to the server only at first enrollment. The puzzle is different each time you log in.Īdditionally, the server proves to the client that it knows a related secret, v. Instead the server constructs a mathematical puzzle that can only be solved with knowledge of x. Unlike traditional authentication, x is never sent to the server. So it inherently rate limits guessing, long before a sign in attempt is made to the server. The process of deriving these keys from your user secrets is designed to be computationally expensive. The other is to derive a an authentication key (which I will call x).

One purpose is to derive the keys needed to decrypt your data. Your account password and your secret key are your user secrets that are used for two purposes. 2FA for unlocking encrypted data on an already enrolled device would be security theater. You can enable real 2FA for 1Password, which will require a second factor when you set up a new device. The Secret Key is designed to protect you if your data is captured from our systems. In the instance you encountered, the Secret Key is kinda-sorta acting like a second factor, as you must be using a device which has received it independently of 1Password servers, but it is a mistake to think of it generally that way. It is important that the Secret Key is never handled by our servers, as it is designed to protect you if we were ever to be breached.

And so it made it onto your iPhone where it can be read only by iOS apps signed by AgileBits. Apple’s iCloud Keychain is such a service. We do have the Secret Key sync to other devices through end-to-end encrypted service that don’t pass through us. Your Secret Key is absolutely necessary for you to decrypt your data, so do save a copy of your Emergency Kit. If you generate your emergency kit, you will see your Secret Key in that. When you created your account, a 128-bit random Secret Key was generated in your browser on your machine. Secret KeyĪs 4german correctly pointed out in their answer, your account password is combined on your client with something we call your Secret Key.

The security model has some unfamiliar components, but it is presented to users like a normal login, so it is natural that you might think that this suffers from the security weaknesses of traditional logins.

My1password login