The 1Password 7 Beta for Mac

https://blog.agilebits.com/2018/03/28/the-1password-7-beta-for-mac-is-lit-and-you-can-be-too/

by uptown • 8 years ago

41 73 8 years ago

blog.agilebits.com

iBelieve• 8 years ago

Nice to see it will still support standalone licenses without needing a subscription.

two2two• 8 years ago

I’m not even that old and the use of “Lit” and “fam” kept me from continuing to read whatever this was about.

lsaferite• 8 years ago

What, you don't want a "Grab bag of lit-ness"?

alphabettsy2• 8 years ago

Guess you’re not fam.

aerotwelve3• 8 years ago

Yeah, it's annoying that they feel like they have to try so damn hard all the time.

They run a brilliant service though that I can use on my OS X & Android daily drivers, their Android app is top notch -- which even supports fingerprint authentication -- so I can't complain.

gnodar• 8 years ago

It doesn't even make sense. Their customers must cover a wide age range, so why use language directed at only their youngest customers? Not to mention any one who actually uses "fam" and "lit" is going to cringe at this post. The whole thing belongs in r/fellowkids.

dwb• 8 years ago

It's a (low quality, but still) use of irony. Come on, people.

roustem5• 8 years ago

Yeah, we also get dinged for putting extra effort into release notes :)

ceocoder• 8 years ago

Hey Roustem,

First off - thanks for making 1Password, I've been an unpaid brand ambassador since 2011. I've successfully converted over 5 users (rather lit if you ask me fam).

I was wondering if you can comment on plans for 1Password standalone (non-cloud) version. For me (and few others I'd imagine based on[1]) it is a must have feature. I'd be happy to pay subscription fee of using your software - just that I want absolutely nothing to do with hosting my passwords in 1Password Cloud - this was the argument I used to use during LassPass vs 1Password debates - "with 1Password, you can sync your vault any way you want (rsync/dropbox/lan sync)".

[1] https://discussions.agilebits.com/discussion/76885/1password...

r00fus• 8 years ago

I'm probably 2x your age and I shrug it off. It's not like you can't actually understand the text.

watersb• 8 years ago

I am old, this sounded like my kids, made me smile. Sure, it is silly. But was okay for me.

atonse• 8 years ago

Been a happy paying user for nearly 4 years now (still standalone though).

I like how this team keeps iterating and tweaking things, even though they've largely already solved the issues with password management for me. And they aren't just adding superfluous features.

I am most excited about markdown in notes!

tonyedgecombe• 8 years ago

I am most excited about markdown in notes!

Is that the new version of Zawinski's Law:

http://www.catb.org/jargon/html/Z/Zawinskis-Law.html

cdumler• 8 years ago

I understand that apps expand, but I've come to move specifically to applications that support markdown. Like Bear, Slack, Trello, etc. Being able to have light-duty text formatting while not being dependent on RTF interface means I can port the text around. Markdown is really gaining steam.

latexr3• 8 years ago

I think there’s a version of this law (not sure if it’s named) that says that in the case of mobile apps they expand until they have chat.

paulgb• 8 years ago

I recently switched from LastPass to 1Password and was surprised with what a bad user experience I'd gotten used to from LastPass. The attention to detail (down to designing their own font!) from the 1Password team is impressive.

rconti2• 8 years ago

Yeah, I tried using LastPass for 6 months or so but never really got into it. The browser integration (at least 3 or so years ago) was pretty janky. Switched to 1Password and never looked back. I've been very happy so far, so hopefully you continue to be as well.

Exuma3• 8 years ago

Can someone help me with 2 questions:

Question 1: Can someone comment on the actual severity of them storing all my passwords remotely? I don't like the idea of it, but it seems like they're a reputable company so I assume they have good systems in place. I have the standalone right now but it's getting to be a pain to move from computer to computer, and I don't trust dropbox sync.

Question 2: Lets say the online version gets hacked... and they steal all the vaults, does that mean they only need my master password to get in? What about people who have weaker master passwords. Can people brute force the password vault in the same way that someone can if they have a hash database of passwords?

ttul• 8 years ago

Your passwords are encrypted using a master password that you enter in the desktop app. They do not know your passwords.

Exuma3• 8 years ago

But can you brute force my vault using similar techniques as just brute forcing a stolen DB of hashed passwords... in other words, if your vault password is < 6 characters are you screwed? Or are the vault passwords more 'battle hardened'

roustem5• 8 years ago

The key used to protect the data (before it is sent to 1Password.com) is generated as 100,000 iterations of PBKDF2-HMAC-256(Master Password + Secret Key).

The most important part here is the Secret Key which provides additional 128 bits of entropy.

https://1password.com/security/

zie3• 8 years ago

According to a comment on the blog we get yet another data file format, and still looks like nothing to replace sudolikeaboss (https://github.com/ravenac95/sudolikeaboss), despite them saying they were working on it.

Mostly it looks like new eye candy, and apparently some speedups, not that it was slow before.

nothrabannosir2• 8 years ago

This is incredibly frustrating, to be honest. They offer a CLI tool but it's completely separate from the GUI session, which means juggling envvars and typing your master password many times.

Apple's keychain, while uglier than a Fiat Multipla and harder to use than a Wiimote on a CRT, at least does get this right.

But apparently bold text and 21st century 1337speak sell better than a CLI integration. Unfortunately, I can't say I'm surprised.

I guess the silver lining is: this can only mean password managers are not just used by security professionals anymore, and are actually becoming mainstream. Hurray :/

zie3• 8 years ago

Agreed 100%.

aerotwelve3• 8 years ago

Out of curiosity, do you use the CLI tool for feeding private keys and/or passwords into scripts, environment variables, or other software that you write?

I had no idea they had a CLI implementation, and I've been looking for something that manages server/api keys as well as cloud service passwords. I imagine there's a better way to do this using enterprise key management software, but I no longer work for a place w/ this kind of budget.

rconti2• 8 years ago

OOH integration with the pwned password database.

However, it looks like it pings Troy's service to do its magic so not everything is kept locally. (I don't blame them, for speed, and for not needing a many-gig database download for each client.

Still, a cool feature, but something to be aware of.

https://blog.agilebits.com/2018/02/22/finding-pwned-password...

crazysim• 8 years ago

You lose about 5 characters of the SHA1 hash to the remote service. Pretty acceptable.

ArmandGrillet• 8 years ago

Allowing Markdown in secure notes is a great new feature!

I've recently set up 1Password for my parents and it works fine. The applications are still a little too complicated for them though, the gap between a physical notebook containing passwords and 1Password is large. Thankfully the UX on iPhone/iPad with TouchID is simple enough.

et2o• 8 years ago

Love my 1Pass subscription. Hope more iOS apps keep integrating it.

Interesting they intentionally moved from multithreaded to singlethreaded.

hunter232• 8 years ago

I had no idea there was app integration! which apps are integrated with the ios app?

kemayo• 8 years ago

There's actually a system-level thing, where password manager apps can register an extension to provide password form-filling, and then apps just include a button (generally a keyhole one) which you tap to trigger the relevant extension sheet from which you can choose your password app.

Here's the first screenshot of the flow I found: https://releasenotes.docs.salesforce.com/en-us/winter17/rele...

iOS11 added a new variant on this, with a little key icon in the keyboard when you're in a password area, but it's only filling from the system keychain and isn't open to third parties. (Yet?)

See: https://techcrunch.com/2017/06/08/ios-11s-new-password-autof...

AGKyle8• 8 years ago

We have a full list from all developers who have informed us they have integrated here:

https://blog.agilebits.com/1password-apps/

There are likely other apps that are not on this list, but if they don't tell us they have added support it's difficult for us to add them.

You can request your favorite app add support, often times it only takes a developer 15 minutes or so to add it. Details in our github repo here:

https://github.com/agilebits/onepassword-app-extension

Let me know if you have any questions! I handle all of our app extension customer support and code maintenance.

Kyle

AgileBits

roustem5• 8 years ago

Not single-threaded, single-process. It would be really hard to use a single-threaded app :)

The 1Password mini used to be a separate process and it was using XPC to communicate with the main app.

_jordan• 8 years ago

One of the highest quality software projects I've ever seen. It just works so well.

teddyfrozevelt• 8 years ago

Wow. 1Password 7 for Mac looks quite a bit better than 1Password 7 for Windows. I wish they put an equal amount of effort into all platforms but I do understand why the develop the way they do. I just hope I can get that new sidebar.

pbowyer• 8 years ago

Yes. 1Password if you're reading this: your Windows users love you. We need some love in return :)

AGKyle8• 8 years ago

Have you seen the latest beta? It was announced last week:

https://blog.agilebits.com/2018/03/20/introducing-1password-...

Kyle

AgileBits

AGKyle8• 8 years ago

Our Windows app has come a long way in the ~2 years or so of it's existence. We rewrote everything from the ground up with 1Password 6 for Windows. It has roughly 8 years of ground to make up to our Mac and iOS apps. They've come a long way in a short period of time. And it'll continue to get better, but we had some really big features to implement on Windows that just took a lot of time and effort. Adding in standalone license support and syncing to Dropbox is not a simple process but they're now available there in the latest beta.

We want our Windows users to be happy as well, and if you have features that are vital to you please write into our support. They use these requests to help gauge what to work on next, and the list is long so the more we hear from users about what they value the better we can prioritize that list.

As a Mac and iOS developer on the team I am very impressed by how quickly our Windows team has caught up.

Thanks,

Kyle

AgileBits

rabboRubble2• 8 years ago

Yes, the 1PW7 beta release really raised that version of the software. Thank you for the attention to that platform. Been quite active on the bug reporting forum and I hope you are able to make further improvements. If only the Windows version search capabilities expand, basically the product will be near perfect for me.

Example:

1)search for entries using two or more strings

2)search for entries without two or more certain text. Example, find all entries unrelated to entertainment in "All Items", search for -tag:book -tag:movie -tag:streaming -tag:tv

And saving a search so that I don't have to retype the search language when I QA my 1PW data!

NelsonMinar• 8 years ago

I wish AgileBits put as much effort into their Windows version as their Mac version.

Aaronn• 8 years ago

I don't use Windows so I don't know if there are any particular bugs in their Windows software but they announced the 1Password 7 beta for Windows eight days before they made this Mac announcement https://blog.agilebits.com/2018/03/20/introducing-1password-...

alphabettsy2• 8 years ago

Big fan of this software, have been for using for almost 10 years and love that it keeps getting better. Using family and teams is great too. Even my Grandparents use it on their iPhones.

surfearth• 8 years ago

I've been using 1Password since Version 3 in 2010 and was originally skeptical about the move to a SaaS model. The value I (and now my wife) gets from the Family Plan is easily worth it - it just works and we can easily share some things while keeping others to ourselves.

One pro-tip I learned last year is to replace Google Authenticator with 1Password's 2FA solution. It is really well implemented and copies the 2FA code to the clipboard when you fill in a login, and then removes it a minute or so later. You do need to make sure you're 1Password recovery information is someplace secure because you're in a bad place if you ever lost your devices.

latexr3• 8 years ago

This kind of defeats the point of 2FA. With your current setup, if anyone accesses your vault and gets your password they also get your 2FA key.

At that point it’s no longer two-factor, it’s just two steps in the same authentication.

AGKyle8• 8 years ago

We've written about this in the past, see a blog post by our chief of security here:

https://blog.agilebits.com/2015/01/26/totp-for-1password-use...

Hope that clears things up for both of you. Let me know if you have any questions though!

Kyle

AgileBits

eddyg• 8 years ago

Totally agree on both counts: the value of being able to put certain credentials, documents, notes, etc. in a "Shared" vault is great.

And definitely the TOTP integration. I love how after you hit Cmd-\ to fill in your username and password, it automatically copies the TOTP value to the clipboard for instant-pasting on the nice screen. Such a great feature.

MightySCollins2• 8 years ago

I keep checking these articles in hope they mention Linux. How can a 1Password expect companies to use it when it does not have a cross platform solution...

roustem5• 8 years ago

Did you check 1Password X?

MightySCollins2• 8 years ago

Yep but a Chrome extension is not really a client. Especially when it has no offline support...

benbalter• 8 years ago

Did I miss something? Is there not a way to use 1Password 7 without it automatically uploading your 1Password 6 vault to their cloud as part of the setup flow (as it did for me)? Unless I did something wrong, it looks like a my.1password.com account is _required_ in 1Password 7.

rabboRubble2• 8 years ago

I've been testing 1PW7 Windows beta, and I'm testing against a local vault. Would surprise me if the Mac version only supported 1password.com cloud vaults.

The 1Password 7 Beta for Mac

Related Stories