My free year of 1Password from the GitHub Student Pack just expired, and the renewal is about $50. That forced a question I had been putting off: do I still need it?
To be clear, this is not a complaint about the product. 1Password is excellent, and I enjoyed using it. The question is narrower: am I getting $50 of security out of it, or $50 of polish?
When OpenAI announced that a hardware security key was needed to access daybreak models, I bought two YubiKeys, one primary, one backup. I registered them as passkeys along with the passkey stored in 1Password.
And that left me genuinely confused. Both are “passkeys.” Both show up in the same list in my account settings. So what is the actual difference between a passkey on a YubiKey and a passkey in my password manager?
The answer turned out to be the most useful security lesson I’ve had this year.
A passkey is not just a nicer password. When you sign in with one, you are proving two things at once: that you hold a private key (something you have) and that you unlocked it with a biometric or PIN (something you are, or something you know). That is why so many services let a passkey replace the password and the second factor in one step.
Password managers, e.g. 1Password, iCloud Keychain, Chrome, all of them, do something clever instead. They emulate that secure element in software and keep the private key inside the encrypted vault, so it can sync to every device you own.
The usability win is real. New laptop? Sign in once and every passkey is there. No enrollment ceremony, no backup key to register, no panic when you drop your phone in a lake.
But the security model changed, and it is worth saying plainly what changed. A hardware-bound passkey has a physical limit: to use it, you must physically possess the key. A synced passkey has no such limit. Its security now reduces to the security of the vault and of the devices the vault syncs to.
So if an attacker gets persistent access to an unlocked device, or gets your vault along with the credentials to open it, they do not just steal your passwords. They can move your passkeys somewhere they control. And because a passkey is often accepted as full, sole proof of identity, those stolen passkeys walk straight past the TOTP codes and SMS backups you set up to protect those same accounts.
This is the part I had not internalized: the credential I trusted most was the one stored with the weakest binding. Call it an “exportable leak” : the credential is only as portable as the vault, and the vault is designed to be portable.
I want to be fair here. This is not a flaw unique to 1Password, and it is not easy to pull off. Getting the vault alone is not enough; an attacker needs the master password and secret key too, or a compromised, unlocked device. But “hard” is not “impossible,” and for a handful of accounts I would rather not rely on “hard.”
Not every account needs this. My newsletter subscriptions do not need a secure element.
But a few accounts are different, because they are the accounts that can reset all the others: