Trusted Devices: Unlocking a Password Manager without a password

The talk tackles a practical design question for password managers: if a user signs in with single sign-on or a passkey, where does the key that unlocks the vault come from? The speakers, both from 1Password, explain that federated identity supplies a strong assertion of who someone is but no cryptographic material. Their answer pairs that assertion with a key stored on the user's device.

The middle of the talk covers the mechanics. New devices must be approved by a trusted device already signed in. A short code shown on both screens feeds a balanced password-authenticated key exchange, which lets the server relay messages without being able to read the credentials passed between devices. Device keys cannot decrypt vault items directly, so an intermediate layer of keys sits between them. Offline unlock depends on platform secure storage: iOS, Android and recent macOS offer hardware-backed options, while Linux and Windows keep material in kernel-protected memory. Windows TPMs were described as poorly documented and sometimes unreliable for this purpose.

The closing section weighed trade-offs. A copied device credential can be reused elsewhere, a risk businesses already accept with single sign-on, and admins want per-vault rules that limit access by hardware quality. The speakers' takeaway is that removing the master password moves the security question onto the device, so passwordless designs need strong device controls, careful fallbacks and clear policy choices.