I used to use LastPass a long time ago, and hence was possibly impacted by the recent breach. Of the 1000+ logins stored in my 1password vaults, I'm not 100% sure which passwords have changed and which have not since the breach occurred, and so the reasonable thing to do is to audit and change them all.
I'd like to write a script that uses op
to handle some of this, but there are some missing pieces. In particular I'd want to hit the following requirements with this script:
- It should be easy to do this in a reasonable order (e.g. by last change time).
- It should be easy to open the site to the correct url to login and change the password
- It should be easy to stop and continue the process later
- User interaction should be minimal
- Password change process should be safe (does not lock out) and secure (does not leak info)
Support Open and Fill from the cli.
The 1Password app / browser extension supports an Open and Fill URL. It would be convenient if the op item
command supported an op item open
subcommand and/or an op item get --open-and-fill-url
parameter. I'm not sure if the username and password are encoded in the url, or if just the instruction on which item to use for login is encoded. If the former, then it's likely this would not be secure enough (as it would effectively leak the password into the command line parameters of the call to open the browser). Right now the workaround for this is to Cmd+click the website from the console for each site I'm processing and then manually find the sign-in link and fill my login info from 1password.
Support getting a password change URL from the cli
It would be nice to programmatically expose the password change urls (e.g. https://github.com/1Password/password-manager-resources#change-password-urls) via the onepassword tool. (This could be worked around by perhaps including that repo in the script). Right now, this involves finding the specific password change url per site (manually navigating the generally random profile/setting/security menus to get there).
Support sorting results by updated date
The op item list
command doesn't support sorting, and the op item get
command doesn't support getting the updated_at
field of an item. It's possible to do this using jq
as a workaround E.g.:
op item list --format=json | \
jq 'map({id, title, updated_at, category, website:.urls[]?.href}) | map(select(.category == "LOGIN")) | sort_by(.updated_at, .title)[0]'
This gets all the items, sorted by updated_at and title (I have a lot of items that share an update time, so this is useful), showing the id, updated time, item type, and websites. This probably needs to filter by category "LOGIN" as well
Password change URLs take some finding
The browser plugin could fairly easily detect and collect password change URLs from user interactions. (i.e. whenever a user changes a password and is prompted with a new secure password, record this, check for a /.well-known/change-password
URL on the site and submit the URL to be entered into https://github.com/1Password/password-manager-resources/blob/main/quirks/change-password-URLs.json if this doesn't already exist. Likely this needs to ensure that no private info is leaked in the URL, so hash the URL until there are multiple submissions with different users before submitting the real url.
What else would work
Building this into the app / browser plugin. There needs to be some sort of gamified restartable change password process that helps users audit and update their passwords when things like this happens. Perhaps build this process into the watchtower functionality?