Why is my outbound firewall reporting a connection from 1Password – are you ‘phoning home’?
1Password for Mac does not ‘phone home’ to check on you. It does however make outbound connections for things you’ve asked it to do, and that are enabled by default.
Software Updates (Version 3.8 and below only)
One of the many settings (1Password > Preferences Updates pane) you can set is if, and how often, 1Password will check for new versions of the software. Each time you run the 1Password application, based upon these settings the 1Password application may connect to one or more remote server to:
- Compare your current 1Password version and operating system to see if a newer release is available for your environment.
- Retrieve the associated Changelog information (including CSS files for formatting) for any newer release(s) that it detected.
- Obtain ‘signing’ information to verify the download is valid.
You can also ask the 1Password application to perform a new version check at any time through the 1Password > Check for Updates… menu option. The same steps happen then that happen if the checking is done automatically at launch.
The names that may appear as the domain we are trying to reach for software update checking may vary over time, and sometimes even appear to be non-AgileBits domains. This is perfectly normal in the modern world of network-based server resources.
Browser Extension Updates (1Password 3.6 and above)
Your web browser has a mechanism to update browser extensions, including the extensions that we use in 1Password. These are distributed through the Amazon’s Cloudfront Content Distribution Network (CDN) and will have URLs that look something like https://d13itkw33a7sus.cloudfront.net/dist/1P/ext/1Password.safariextz
. The domain, d13itkw33a7sus.cloudfront.net
, part refers to AgileBit’s CDN within Cloudfront. Because this is a CDN, the actual IP address associated with that domain may depend on your particular location.
The 1Password.safariextz
part of the URL will differ for extensions for other browsers and for Beta versions of our extensions. To ensure that you are getting the extension from the correct source the extension is fetched using SSL.
Downloading of icons and previews for Logins items
1Password can build helpful icons for quick recognition of web sites, and generate previews of the entire page for your saved Logins items. This can be controlled via the 1Password > Preferences Logins pane.
The 1PasswordAgent is a background process for 1Password that kicks off another process called 1PasswordThumbs. It’s 1PasswordThumbs’ job to create a miniature thumbnail preview picture of the screen as you yourself would see it of any web page that you have saved as a Login in 1Password, including any backgrounds, images, etc. This thumbnail capability can be turned off in 1Password’s Preferences, but it’s perfectly expected that the 1PasswordAgent or 1PasswordThumbs process may “get the attention” of any outbound connection firewall software.
The web page that you have saved a Login for also may refer to other in-line images. So for instance, when you go to http://agilebits.com/products/1Password the header image is pulled from http://aws.cachefly.net/aws/images/1password/home-header-v3-3.png and the thumbnail process will attempt to load that image also while building the thumbnail for the agilebits.com page.
Your actual Login credentials are not being provided to generate these previews – they are as if you just visited the web page for the first time in a browser.
The icons available in 1Password’s Shelves layout (View > Layout > Shelves) are also obtained through this same 1PasswordThumbs process.
Local network connections
1Password on the Mac manages the data exchange between itself and the browser extensions through “WebSockets”. This allows for 1PasswordAgent (1Password version 3.8 and below) or 1PasswordHelper (in 1Password version 3.9 and above) to communicate with each other while still respecting the sandboxing rules enforced by web browsers. Although these appear as network connections they are limited to your local machine. They neither accept nor provide information to any process not on the machine. These localhost connections are also encrypted and authenticated. The ports used for these localhost connections are 6258, 10191, 14821, 24861, 25007, 38151, 46360, 49801, 55730, 59483
.
Wi-Fi Sync
When a mobile 1Password app is setup and ready (unlocked) to use Wi-Fi syncing with 1Password for Mac, it makes an Apple Bonjour network “broadcast” to its local network to announce its readiness – including the mobile device’s network address and a random port number. If 1Password for Mac is running and currently unlocked, it will see this broadcast and attempt to communicate outbound to that address and port.
Dropbox Sync
1Password for Mac and Windows do not communicate directly with Dropbox. They simply read and write files within your Dropbox folder on your local machine. The communication with Dropbox servers is all be done by the Dropbox client application running on your Mac or PC.
1Password on iOS, Android, and Windows 7 Phone systems will communicate with the Dropbox servers using the information that you have provided the mobile app as your Dropbox credentials. If you have set up automatic Dropbox syncing then 1Password will work to ensure that the data on your device and the data stored on the Dropbox servers are in sync. Without the mobile apps accessing the Dropbox servers, the data you’re attempting to sync from 1Password for Mac would not stay current.
Approving connections
The connections for update checking are generally less often and less intrusive than the ones by 1PasswordThumbs, but they must be approved if you want the feature to actually work. Denying a connection here means you may not be told about an important update, or you may not see what the update actually offers before being asked to perform the upgrade.
We do from time to time change which server(s) are used for update checking so even if you’ve approved in the past, you may find that you’re being asked to do so again if such a change happens.
Because the sites that 1PasswordThumbs wants to access are the same ones (and just as varied) as you use in your browser, it is simplest to tell your outbound firewall to approve all these connections, otherwise you’ll be prompted for each one (your choice of course!).
Here are specific instructions for some commonly seen outbound connection firewalls (in no particular order).
Little Snitch
When prompted about connections from 1Password for software updates or “1PasswordAgent via 1PasswordThumbs”, click on “Any Connection”, “Forever” and then “Allow”.
The default setup for Little Snitch provides for unrestricted “local network” traffic to “All Applications” on all ports and protocols, so unless you disabled that default rule, any 1Password Wi-Fi sync connections will not be blocked and you won’t be asked about them.
Little Snitch doesn’t restrict inbound connections so Wi-Fi sync “broadcasts” won’t be impeded by it.
TCPBlock
You will need to use the TCPBlock Preferences pane to add 1Password and 1PasswordThumbs to its “white list”. If they aren’t currently blocked and have recently made outbound connections they will appear in the network activity listing and can easily be added: select the entry in the listing and click the “Insert into Application List” button.
TCPBlock doesn’t restrict inbound connections so Wi-Fi sync “broadcasts” won’t be impeded by it.
IPNetSentryX (included as part of IPNetRouterX)
By default, outbound connections are not blocked. If you’ve added an outbound direction rule, you’ll need to manually adjust your firewall document(s) to include exceptions for the 1Password originated connections. Since our outbound connections are not limited to specific ports and the rules don’t take into account which application is making the connection, this may require you to choose if you want 1Password to be able to perform its features or to have the firewall rule in place.
Inbound UDP protocol port 5353 traffic must be allowed for the Wi-Fi sync facility to “broadcast” its availability.
VirusBarrier X6
By default, outbound connections are not blocked. Since our outbound connections are not limited to specific ports and the rules don’t take into account which application is making the connection, this may require you to choose if you want 1Password to be able to perform its features or to have the firewall rule in place.
Inbound UDP protocol port 5353 traffic must be allowed for the Wi-Fi sync facility to “broadcast” its availability.