Starting later this year, 1Password will launch support for passkeys as a more secure and more convenient alternative to traditional passwords.

Using your Google account or social accounts to sign in to other sites is a convenient option, but it can be easy to forget which accounts are using the option. In one of its latest updates, 1Password is now able to keep track of what accounts are using sign-in from Google and other social accounts.

Generally, people don’t often use more than one password management app. With security apps like that, users tend to pick one and stick with it. If you happen to be moving to 1Password, you’ll want to export passwords from other sites like Google or LastPass, bring all of your credentials with you, and import to 1Password. Fortunately, it’s easy and this guide will walk you through it in no time.

Nowadays, having strong passwords is a must online, and password managers make that task much easier. 1Password is one of the best options available, and this week its Android version is getting updated with a dark mode for Android Q and more.

AgileBits has promised to beef up the security of 1Password after a Microsoft software engineer discovered that details of which websites you visit are unencrypted and indexed by Google if you use the 1PasswordAnywhere feature. Dale Myers said that he discovered this by chance after a sync problem led him to investigate the files used to store the metadata.

It turns out that your metadata isn’t encrypted [allowing someone to] go through and find out exactly what shady sites I have accounts on, what software I have licences for, the bank card and accounts I hold, the titles of any secure notes I have, any anything else I’ve decided to store in there.

While passwords remain secure, privacy is placed at risk and the data obtained could, says Myers, be used in a phishing attempt.

Thanks to people having links for easy access to their keychain on their websites, Google has indexed some of these. A simple search brings up results. By looking at one of these it was a simple matter to identify the owner of the keychain and where he lived. I know what his job is. I even know the names of his wife and children. If I was malicious, it would be easy to convince someone that I had compromised their account and had access to all of their credentials.

AgileBits said that the decision not to encrypt metadata was taken back in 2008, when decryption on mobile devices involved significant performance and battery-drain issues, and that it introduced a secure file format in 2012, but that it didn’t want to break compatibility with older versions by making that format the default.

The company said that work on making the secure file format the default was already in hand.

We’ve already started making changes to use OPVault as the default format. In fact, the latest beta of 1Password for Windows does this already. Similar changes are coming to Mac and iOS soon, and we’re planning on using the new format in Android in the future. Once all of these things are complete, we will add an automatic migration for all 1Password users.

For those who don’t want to wait, the company has posted instructions for manually migrating to the new format.

The 1Password Android app was updated in August with a freemium pricing model and the ability to create vaults on mobile. If you’re not yet using a password manager, check out our how-to guide over on 9to5Mac.

Via Engadget

https://vine.co/v/ebTvvF7577K

Earlier today, Google unveiled its highly anticipated Android M update. One of the highlight features of Android M is the support for standardized fingerprint recognition, which Google says developers will be able to take advantage of via new APIs in the operating system.