关于 1passwd bug？

update ：
手机修改 master passwd mac 可以马上生效
只要你在 iphone 不输入新的密码 你都是可以用旧密码登入 然后同步数据的
不明白为什么？
现在 master passwd 都不一样了 为什么我还能新增数据？而且还能同步的好好的
求打击啊！！！不想毁了信仰！！！告诉我 我只是个例！！！

我也遇到过，我也不明白。
感觉有过几次修改发现主密码不同，但依然能同步。有时候感觉是不是 iOS 设备已经有两种密码，已经很安全了。也有感觉是不是主密码绑定在当前设备密码库，然后不同的设备也有不同的主密码。

当然，不同步导致的 iOS 能无限用旧密码打开也是一个很无奈的隐患。

The fact is we don't encrypt your data using your Master Password. Counterintuitive I know but instead what we do is we create a bunch of very long keys. We use each key to encrypt some of your data and their length is partly where the strength behind the system is. Of course we still need a way for you to access your data so what happens is these encryption keys are kept in a small file and we encrypt that file with your Master Password.

So when you type in your Master Password you're actually just unlocking one small file and then we use the contents to retrieve your actual data.

We do have a bug though that if you have a sync in place that a Master Password change isn't being pick up by all devices and that the old Master Password can continue to work. The reason that is possible is because again, the very long encryption keys don't change when you change the Master Password. So if a device for whatever reason doesn't think the encryption key file has changed it will continue to use the locally stored copy of that file which of course, because the keys inside don't change, will still work.

不用 iCloud 或其他网络储存方式保存密码库， MacBook 和 iPhone 、 iPad 同步都是用 Wi-Fi ，好像没有发现这个问题。

同意楼上的， wifi 同步最安全。

要不这样？
先关闭所有同步，手机端清除密码库。
将电脑端的主密码更改，然后再开启同步

1password 现在改成订阅式的，不好玩。。。

@lovelinghan 按这个回复的话，密码库不是直接用 master password 加密，而是别的，不过这样也说不通啊， master password 都变了，那个小文件怎么还解的开，除非是这种小文件是允许多个存在，新旧密码各对应一个小文件，估计很有可能。。。

订阅模式其实还是有他的优势，至少楼主这个主密码的 Bug 就会没有了。

假设被盗。。。。还是照旧能看到密码更新？

@eddiechen 你看看

Your data is encrypted with a randomly chosen encryption key when you first set up your 1Password data for the first time - this is your "master key". Your master key is what gets encrypted with your Master Password. When you change your Master Password, you are changing how the master key is encrypted. You are not actually changing the master key. There are good reasons for designing things this way. You will find that other high security systems, such as PGP, SSH, SSL certificates, and disk encryption systems all work the same way. A random key is generated when the user first sets things up, and then their passphrase is used to encrypt that key.

1Password does not use the sync format directly for its regular operations; instead it uses a local data format (encrypted SQLite database) that is optimized for quick searches and so on. 1Password does "import" and "export" changes to and from this local format to your agilekeychain, opvault, Cloud Keychain, or CloudKit database. The local and sync formats will use different parameters for encrypting the master key that are best suited for their different environments. So the encrypted key can't simply be moved from one to the other.

When you change your Master Password, it will make the change in your local SQLite database, and also in the sync format. It can do this only when your data is unlocked because it needs to re-encrypt your master key with the new Master Password. Roughly speaking, "being unlocked" means that 1Password has your decrypted master key in its memory. The sync format will then have its master key encrypted with the new Master Password. That will spread to other systems that you sync with via iCloud or Dropbox sync. In some rare cases, 1Password may not have "imported" the Master Password change from the sync format into the local format. So what we are seeing if the Master Password doesn't sync after you changed your Master Password on one device is that the local format is keeping the master key encrypted with the old Master Password on another device. 1Password is still able to read and write changes to the sync format because it is able to decrypt the master key (from the local format), even though it isn't able to decrypt the master key in the sync format.

So, since your new Master Password did not sync automatically, simply changing your master password manually on all devices to match should fix the issue.

@lingaoyi 是的，知道你的 old master passwd 就可以看到所有的数据
大前提：本地 ios 没有输入过修改后的 master passwd ，输入完之后就 old master passwd 就失效了

the old Master Password will still be accepted until the new one is entered

@lovelinghan 这个设定有点蛋疼啊，非得手动在 iPhone 上输入新密码，旧的才失效，不知道官方是基于什么考虑这么设定的，确实是有漏洞