Frequently Asked Questions
Endpoint Takeover Prevention (ETP) uses digital signatures to authorize security-sensitive operations and objects, including scripts, data sources, software application versions, and automations.
Getting started and administration
Who can configure the ETP-enabled deployment of Action1?
The Action1 user must have the Enterprise Admin role to configure ETP in the Action1 enterprise. Make sure the role has the following new permissions assigned:
- Manage Signatures – allows you to create signatures for some objects in the specified scope.
- Manage Keychain Store – allows you to save keychain records in the specified scope. Implicitly includes Manage Signatures permission.
Can I opt out of using ETP?
This functionality is rolled out in stages and may not be available in your region yet. After the rollout, ETP becomes a required security configuration for new customers.
Existing customers can postpone enabling ETP until the end of the transition period.
What will I do after ETP is enabled?
- Create your Action1 Key and passphrase, and complete the applicable key approval process.
- Sign the security-sensitive objects you use, including automations, scripts, software application versions, and data sources.
- Ensure there are at least two Enterprise Admins with active Action1 Keys to support key approval and recovery.
See “Signing objects and operations” and “Passphrases and key recovery” below for details.
Should we have more than one Enterprise Admin?
Yes. We recommend having at least two Enterprise Admins with active Action1 Keys. This allows another Enterprise Admin to approve a replacement key if one loses access or leaves your organization.
For possible scenarios, see the “Passphrases and key recovery” section below.
Signing objects and operations
Will an unsigned automation run after ETP is enabled?
No. An automation must have a valid signature to run when ETP is enabled. Sign unsigned automations before running them.
Do I need to re-sign objects after replacing my security key?
After replacing your security key, use the new active key to re-sign objects previously signed with the old key, such as scripts and automations.
Passphrases and key recovery
What should I do if I forget my passphrase?
Your passphrase cannot be recovered. To sign protected operations and objects again, you should create a replacement security key and passphrase and ask an authorized Enterprise Admin to approve the replacement key.
1. Go to Security | My Account | Action1 Key Settings.
2. Select Change Action1 Key.
3. In the Key Change wizard, select I forgot my current key passphrase.
4. Create a new Action1 Key and passphrase.
5. Have another Enterprise Admin with an active key approve your replacement key.
6. When your new key is active, use it to re-sign objects previously signed with the old key.
If no Enterprise Admin has access to an active security key, see the next question.
What happens if no Enterprise Admin has access to an active Action1 Key?
If none of the Enterprise Admins has access to an active Action1 Key, you cannot complete the normal replacement-key approval process. Action1 cannot recover a lost passphrase or replace the existing Action1 Key if its passphrase is lost.
Contact Action1 support for assistance with restoring access. Recovery in this situation requires reinstalling all Action1 agents. This also applies if the only Enterprise Admin leaves and their key is no longer available.
What should I do if my Action1 key or passphrase is compromised?
Replace the affected Action1 key and revoke the compromised key. After the replacement key is active, use it to re-sign objects previously signed with the compromised key.
To start replacing a key after a compromise, go to Security | My Account | Action1 Key Settings, select Change my key, and select the corresponding reason in the Key Change wizard.
Can I change my passphrase?
Yes. You can change your passphrase using the Key Change wizard. Go to Security | My Account | Action1 Key Settings, select Change my key, and select the corresponding option in the first step.
Do security keys expire automatically?
No. Security keys do not expire automatically. You can replace a key when required by your security policy or if it is compromised.
Key storage and ownership
Who generates and controls my Action1 Key?
Your Action1 Key is generated locally in your browser. You can store the encrypted private signing key in Action1 cloud storage or locally. In either case, your browser uses your passphrase to decrypt it. Action1 does not receive the unencrypted private signing key.
How is my Action1 Key protected in Action1 cloud storage?
Your browser encrypts the private signing key before uploading it to Action1 cloud storage. When you need to sign an operation or object, the browser retrieves the encrypted key and decrypts it locally using your passphrase.
Action1 does not receive your passphrase or the unencrypted private signing key. For the encryption method, see the “Cryptographic details” section below.
Is the same passphrase used for local and cloud copies of my Action1 Key?
Yes. The same passphrase protects local and cloud copies of the same Action1 Key.
Cryptographic details
How are security keys and passphrases generated?
Your browser generates the signing key pair and passphrase locally using the Web Crypto API.
- The signing key pair consists of a private key and a public key.
- The passphrase protects the private key; it is not part of the signing key pair.
The generated passphrase contains 20 random characters drawn from a set of 88 characters.
Which algorithm and key size are used for signing?
The default signing algorithm is EdDSA with Ed25519.
Ed25519 uses a 32-byte (256-bit) private key seed and a 32-byte public key.
For Ed25519 key generation details, see RFC 8032, section 5.1.5.
How does my passphrase protect the private signing key?
1. PBKDF2-HMAC-SHA-256 derives a 256-bit encryption key from your passphrase. The configured defaults are 600,000 iterations and a randomly generated 16-byte salt.
2. AES-256 uses the derived encryption key to encrypt the private signing key locally in the browser.
The encryption key is separate from the signing key. PBKDF2 makes each passphrase guess more computationally expensive, slowing attempts to guess the passphrase.
For the AES algorithm specification, see the NIST AES standard. The Action1-specific settings above describe the product implementation, not the requirements of that standard.