Master password
I'm sure the answer is "no, your only option is to delete and start over", but I changed my master password this morning (was having issues after recently having to change my secret key and password due to iOS' password section mentioning it may have been compromised, though probably just because the old one had been a reused PW), and thinking that iCloud Keychain caught it when I logged in anew (spoiler alert: it didn't), I am now locked out of my 1password account. I have my secret key and still have 2FA access in my authenticator, but I guess unless I remember the master password, there's no way to get around having to delete the vault(s) and start over?
Cuz man.. 162 passwords... my memory better kick in soon.
Posted Dec 24, 2020, 11:24 PM UTC
Edit: actually, on a similar note, I think the 1P client doesn't protect against repeated bad passwords. You can just manually try all the passwords you can think of (unless you used the word generator)
(now, this is me musing. I seriously doubt 1P will support this suggestion)
Since you have the secret key, and most of the master password, you could try to run your own "credential cracker". Assuming the password stretching and hashing / encryption algorithms are known (or could be extracted from the 1P executable), you could run your own "randomly guess the password until success" script
Edit pt2: actually, if you know your way around Linux, you can download the Linux 1P CLI tool and run a script to try random passwords against it. That way you don't have to recreate the encryption method.
John the Ripper is a well known tool for doing things like this
Sadly don’t really deal much with Linux :-/
I’m just so annoyed with myself because any other time I’ve had to change the PW or anything, I always mark it down on the emergency kit, but stupidly I didn’t this time. I think I was in a rush to then go feed the kiddo her lunch, so got sidetracked before I thought to take care of it :-/
At least I’ve found that all my major passwords I need are also saved into my iCloud Keychain (bonus of doing everything on my iPad/phone and having it prompt me to save), so there’s that. Gonna give my brain a few more days and hopefully remember the first part (it was a random word gen, lol)
Very much appreciate the suggestions!
Edit: and you’re correct, 1P won’t lock the account or shut down after x# of wrong attempts. The support guy mentioned that, at least, so I just need to narrow down the first word. At least I’m pretty sure I remember the first letter and roughly the length. I remember thinking “oh, those 3 almost makes sense together”, so I can only hope my brain tonight kicks in and remembers, even if it’s 3am (which it will be with my luck)
Well, good luck I suppose.
If you haven't already, write down the other 3 words to save yourself even more potential headache
Oh I have, lol
Edit2: If it helps, I could extract the words that start with the letter you think the pw starts with and send them to you. As outlined below, there's a chance that my dictionary is not the same as yours, but you might recognize the word by sight.
Edit3: I have extracted both the dictionaries for Windows and Mac, so if you want, I can PM you a list of words given your starting letter. (I can alternatively send you the entire dictionary, but I'm not sure how the 1P team would feel about me distributing their dictionary like that)
Ok, having done some snooping, I've found what I assume to be the 1P's word dictionary in the .exe file (it's got the words for my master password in it). Assuming they're not doing some dictionary obfuscation stuff (like giving each user a different subset of the actual dictionary, or rotating words in and out periodically), then it would be fairly straight forward to write a bash (Linux) script which just tries each word in tandem with your known password and secret key. (Of course, that'd mean you would be leaving your password and secret key in "plain text" inside the script, but at this point, I would take that risk myself (given the circumstances, it's a low risk option*))
I have no experience with OSX, but I *think* it runs bash. I also might be underestimating the size of the 1P dictionary (meaning even with all of the known info, it could still take a loooong time for the script to run)
* By this I mean, you would have to have either malware on your computer looking for this type of information, or a "malicious user" with physical or remote access who is looking for that type of information, for this to be a problem.
Edit: Actually, I just remembered that the script could be written to not store the half-pw and secret key plain text, but request it each time you run it. Which mitigates most of the risk. You do have to trust the script writer though (and a lot of trust at that).
Anyway, I'm just musing. You probably won't want to go down that route anyway