1Password 8 will be subscription only and won’t support local vaults

https://1password.community/discussion/comment/601917/#Comment_601917

by taxyovio • 5 years ago

577 660 5 years ago

I actually don't have a problem with this, but I do have a problem with press releases that are sprayed with emojis. It's incredibly unprofessional and gives a real amateur flavor to the whole thing, which for security software is really offputting.

bootloop• 5 years ago

Looks like a forum post to me not a press release?

LeoPanthera2• 5 years ago

It's obviously more than that, with titled paragraphs and embedded images, this is a prepared statement pasted into a forum.

cpuguy833• 5 years ago

Maybe ask yourself "Why?". It is a much more fun, not suit and tie kind of announcement.

This is also a consumer product, not enterprise.

netmare2• 5 years ago

It's too much fun for me too. Blushing faces and clapping hands look like kindergarden drawings, not consumer-oriented at all. I guess some people are more serious than others. :-*

HomeDeLaPot• 5 years ago

To be pedantic, it looks like it's actually an official reply on a community forum, not a press release. Also, thinking that the use of emoji reflects the software quality is a mistake in our current culture.

systemvoltage• 5 years ago

Sure it does. It does in the same way if you would use purple bold text in script font. The point is that it’s completely unnecessary.

Imagine emojis in IETF RFCs. No thanks.

lwhi2• 5 years ago

It's not a problem.

They have an established reputation.

vmception• 5 years ago

I love normalizing emoji use. Its actually harmonizing the depictions because they can be wildly different across platforms, and until that occurs its part of an ongoing gag where its funny to imagine how messed up they render on someone's phone.

Like, imagine its only Gen X that complains about this, and they are the equally out of touch blackberry user whose device renders all the emojis in some messed up but hilarious way, then its a great way to make fun of them without saying anything and just keep bombarding them with an incommunicable internet, while the rest of us dont mind and some of us are also in on the joke.

_dot__dot_7• 5 years ago

Another problem with emojis is that it is not clear what it means to different people. Recently read in the WSJ that young people find smiley faces passive-aggressive or patronizing, not friendly or positive.

Admittedly, there is a similar problem with words, but there are at least dictionaries for them. :>

nightski• 5 years ago

I haven't had a single bad experience with Bitwarden. I even pay for it now and still run it locally just to support them. Highly recommended if you don't want to be forced into 1Password's service.

jszymborski• 5 years ago

I use Bitwarden for shared passwords with my family (using an Organisation).

For my personal passwords, I prefer keeping a local KeePass vault (I access over a local network drive, VPN in elsewhere).

I totally agree that primitives are some of the least important parts of choosing password managers, but what I like about KeePass is that you can use Argon2 as the password derivation function and specify your hardness factors. Because my laptop and desktop have a strong-enough CPU and I don't mind waiting 20-or-so seconds before the first unlock, I can set quite high values for this.

slaymaker1907• 5 years ago

I love that KeePass works with pretty much whatever sync service you prefer. Personally, I use it with Google Drive and it even works with Android/iOS clients. However, would definitely recommend KeePassXC for desktop.

pratikss• 5 years ago

+1 for Bitwarden

I used to use Enpass and never had an issue but it's not open-source and you have to pay for Mobile client.

fullstop2• 5 years ago

I'm in the same boat. Password sharing with my wife was a big plus for Bitwarden, and I got my kids in on it as well. I paid for the family plan and can share select items with my kids.

It's honestly fantastic to see how they have adapted to password managers.

newdude116• 5 years ago

I stay with Enpass.

itake• 5 years ago

Bitwarden's UX is so frustrating. The Firefox extension has no memory to it.

For example, if you're logging into your credit card provider from Mint.com, you have to search your card, copy the username. when you paste the result on Mint, you lose the window, and you have to re-search for your card to get the password. Very frustrating.

alyandon2• 5 years ago

Does it still do that if you click the pop-out button so that Bitwarden has it's own window?

thunderbong• 5 years ago

This is probably an edge case where the fields in the browser cannot be identified by their ids/classname. In this kinds of a scenario, you can set extra fields (and their corresponding values) in Bitwarden after inspecting the field elements in Dev tools.

mrbonner• 5 years ago

Been paying since 2017 and it’s totally worth it.

CryptoBanker• 5 years ago

Bitwarden all the way. I've never had a single issue at all with them, and it always just works which for me is the single most important feature

muzzio• 5 years ago

I moved to Bitwarden from Lastpass also, and I'm definitely happy for the most part.

The chrome extension leaves a tiny bit to be desired, but definitely still usable:

* Not as good about determining correct sign-in URL and lots of times will send me through the auth redirect from registration

* Launching sites without mouse isn't possible (shortcut exists to open extension but can't select site to launch it using arrow keys, for instance)

* Button locations aren't consistent between search view and opening it on a site you have a password on

Definitely still the best for me though. It's frustrating, though, that I don't feel like the paid plans really give me anything useful, so I'd be paying basically just to support the product (which I'm happy to do!). It's a weird spot for sure, I feel like table-stakes for a free password product is infinite devices + usable browser extension + phone apps + password generation. But figuring out what to add on top of that is always either directed at businesses or families, or things I don't care about like 2FA or an authenticator. I want to support you, damnit!

philliphaydon• 5 years ago

I don’t have issues with the URL, there’s lots of options for how the matching works. I found it to be superior to 1Password (tho I haven’t used that in a few years so I donno if they improved it)

kureikain• 5 years ago

The paid plan support OTP token and allow big file so you can embed stuff like google cloud json token file. The free has 1000character limit(per field) if I remember correctly.

Bitwarden run so much faster than 1password despite being a browser extension.

The CLI is great too. I pretty much use it like a cheap version of Vault to feed secret into K8S.

jabroni_salad• 5 years ago

One other thing I do not like about BW (but not enough to switch) is that when you click out of the bitwarden window, it disappears and loses your place so you have to navigate to the secret again. Kind of annoying if you are on a website that resists autofill or want to copy something from custom fields.

stereoradonc3• 5 years ago

I use chrome shortcuts. In extensions, look at the option to assign keyboard shortcuts. I have set it Alt+D combination. The 2FA codes are copied in the background, and when the screen comes, ctrl+v does the magic. Simple.

distances• 5 years ago

What's the main point of Bitwarden or competitors over traditional password managers such as KeePassXC? Better autofill features?

nirvdrum• 5 years ago

Multi-device access, browser integration, mobile platform integration, and sharing with spouse or team members. I know there are solutions to some of those based on some variant of KeePass, but using something like Bitwarden is very easy. Bitwarden is really nice in that you can host the server yourself (or use bitwarden-rs), so you're not having to mess around with WebDAV or some other storage sharing mechanism.

vetinari2• 5 years ago

Advantages of bitwarden:

- conflict-less sync; with KeepassXC, I learned to live with keepass-diff, once the inevitable sync conflict happens

- no need to have entire app running, or even installed; in browser, the extension is enough. KeepassXC was a kind of annoying to launch.

- password sharing

Advantages of KeepassXC:

- can autofill http auth dialogs; bitwarden still cannot do this

- can serve as ssh agent, so synced database takes care of your ssh keys too

mfer2• 5 years ago

What caused me to not consider Bitwarden was the way it handled iframes. It could send the parent sites credentials to an iframe even if the iframe was on a different domain. This is a big no-no in my book.

This was a discovery in a security review they did and choose not to change.

This was some time ago so things may have changed. But, that red flag kept me away.

pushrax2• 5 years ago

Most likely because credit card forms are very often served in iframes. 1Password fills iframes too (though maybe only for cards, not sure).

bennyp1012• 5 years ago

I have bitwarden for my company stuff, and I find it .... very clumsy. The interface is nowhere near as polished as 1password IMHO

weaksauce2• 5 years ago

yeah the interface is crap compared to 1password but i do find a bit of comfort that even though it's not the best interface it's fully opensource unlike 1password.

superasn• 5 years ago

Yes it has been a breeze to switch to it, especially with their native import of Lastpass logins.

Lastpass frequently messed up the autologin and injected a lot of ugly css/html in the forms which Bitwarden doesn't.

Also it works really well as a chrome extension with Kiwi browser on Android.

tluyben2• 5 years ago

Bitwarden and KeePass here, bitwarden is very good. I do not use browser plug-ins so both are kind of the same but bitwarden just wins on the little things.

threatofrain• 5 years ago

May I ask why do you use both Bitwarden and KeePass? Do they have some kind of story of working together?

DavideNL6• 5 years ago

You might want to check out the Strongbox iOS app if you don't use Desktop, it's also really good. It uses a Keepass database also.

yakz• 5 years ago

I'm also happy with Bitwarden--I switched from 1Password a while ago when 1Password started the push toward subscription (which involved dropping support for features that I used, and dark UI patterns around pushing the subscription version as well as getting and using the non-subscription version).

I had bought several versions and both the Mac and Windows editions of 1Password over time, none of which were what I would consider inexpensive for a password manager. I consider their treatment of me as a customer to have been terrible.

I wouldn't be so pissed off about it if they had just dropped the product and started a new one, but slowly turning something paid for, used regularly, and liked into something different that I didn't want at all tells me that they are absolutely not worth doing business with again. They're not trustworthy.

drums8787• 5 years ago

+1 on Bitwarden. UX is perhaps not perfect. I've had some IOS sync issues but that seems to have gotten much better. Use it in Firefox every day and have no complaints.

I convinced my wife to pick it up and we now share a bunch of stuff and she loves it. And she's low tolerance for UX issues.

l72• 5 years ago

Is there a good command line client for bitwarden. I recently moved from keepass (using kpcli) to bitwarden (so I can share passwords with my spouse), but am so far, very unhappy with the command line tools.

The official command line tool is way too clumsy. I've tried rbw and rbw-fzf which are ok. rbw doesn't let me view all properties of an entry (attachments, notes), and rbw-fzf has issues if things have spaces in them and is limited to only passwords, not other info.

forrestthewoods• 5 years ago

Same. Left 1Password for Bitwarden and have zero regrets.

Seb-C• 5 years ago

I'm a happy and paid user of bitwarden too. On top of being open source, what made me choose it is that the desktop client downloads my vault locally in an open and secured format. So I can make an automated backup of this file wherever I want.

askvictor• 5 years ago

Mostly the same; but the only thing I miss in Bitwarden compared to Lastpass is, if the vault is logged out, it doesn't prompt me to log in (to the vault) when it finds a login prompt for a site I have saved in the vault.

mackrevinack2• 5 years ago

i switched from lastpass to bitwarden for about a year or so and its what i recommend to most people.

i would be still using it myself but i also wanted to login to desktop applications so ive been using keepassXC since.

keepass's auto-type feature is also a great way of autofilling passwords without having to give your browser access to your password vault

s_dev• 5 years ago

https://clipperz.is/ is so much cooler and free. Best of Luck 1Password.

vezycash• 5 years ago

Thanks for mentioning this. It was the first password manager I ever used before switching to lastpass and then to bitwarden.

ipaddr• 5 years ago

"Do not trust us! Trust our code and the Clipperz community of users and developers!"

Last github update 657 days ago.

comeonseriously• 5 years ago

Last github update 657 days ago.

Maybe it's done.

tectonic• 5 years ago

Well darn, I guess I have to find a new password manager. 1Pass + Dropbox sync was so good.

djkorchi• 5 years ago

KeePass + Dropbox works, and you can sync to Android from Dropbox with KeePass2Android.

baal80spam• 5 years ago

The real advantage of KeePass(XC), at least for me, is that it can be used to store so much more than simply user/password.

I use it to securely store notes and important files.

avelis• 5 years ago

I have used the Dropbox sync for a long time.

foogazi• 5 years ago

That’s my setup too - but now I’m running into 1Password changes and the Dropbox free tier restrictions

art-vandelay• 5 years ago

Same situation here. I guess my setup will break once they remove dropbox sync from the android app.

frosted-flakes3• 5 years ago

Just save your vault as a local folder and sync it yourself. I use SyncThing.

netmare2• 5 years ago

I've been using KeePass with Syncthing for some time. No problem if you only need to update the database from a single location and access as read-only from the rest, but there are also solutions for shared updating.

frosted-flakes3• 5 years ago

Unless they remove support for local vaults from their mobile apps, you can continue using the classic self-synced method. I sync my 1Password vault across Android and Windows using SyncThing, using 1Password 7 and the legacy browser extension in Firefox. I don't get the inline 1Password prompt in password inputs, but that's the only disadvantage (Ctrl+Alt+\ brings up the password selector anywhere in the OS, not just the browser).

In fact, if you're okay with only editing/creating password entries on your phone, you don't even need to pay for the desktop app, because you can use it in read-only mode. The Android app has no limitation to editing local vaults, and it's pretty rare for me to actually have to set up new accounts these days, so I'm fine doing it on my phone. I considered paying for 1Password X (their online offering), but it's simply not worth $45 per year for that minor convenience. I can't complain at all, because I use 1Password completely for free.

pianoben• 5 years ago

They have, as far as I can tell. Last month I tried to set up a new 1PW installation and exhaustively searched through the app menus - no sign of standalone vault support anywhere.

It's possible that it was hidden because I had previously signed in to my work's 1PW account, maybe, or that it's hidden too well for me to find. I don't know, and would be happy to learn either way.

rcarmo• 5 years ago

I fully expect that to happen. And it will catch many people unawares when their iOS app automatically updates and prompts them to "upgrade" to the sync service.

samgranieri3• 5 years ago

I might just hold out with the 1password 7 and dropbox for as long as I can...

shadowtree• 5 years ago

I have been using pwSafe across iOS, macos and Windows for years now, the file db was stored in Dropbox, now I moved it to iCloud.

https://pwsafe.info/ for Mac and iOS https://pwsafe.org/ for Windows

The underlying file format is opensource and developed by Bruce Schneier.

majjam• 5 years ago

Ive been using enpass for a while, I really like it but I dont see a lot of love for it on HN which worries me a bit…

wkirby• 5 years ago

Nah. I'm good. See ya 1password.

JohnWhigham2• 5 years ago

Yup, I'm out of here as well. Been using them since 2014, been frustrated since they heavily push you toward using their cloud, and now this shit happens.

maxharris3• 5 years ago

1Password used to be native on the Mac, and now it's an Electron app. I'm not going to be using 1Password for this reason, and I encourage you to do the same.

Subscription business models and non-native apps are hallmarks of rot by VCs. Dump them!

sammorrowdrums• 5 years ago

Well they’ve released a Linux app built in Rust, so maybe there’s hope?

selykg7• 5 years ago

The Linux app is electron as well.

They just like to say that they use Rust for the backend code. Rust for the backend of the client apps, React for the UI, wrapped in Electron.

bibinou• 5 years ago

It's electron-based too, Rust is used in a backend lib with FFI: https://dteare.medium.com/behind-the-scenes-of-1password-for...

_2d30• 5 years ago

How does one check if an app running on a mac is native or electron?

philwelch2• 5 years ago

If it looks identical to the web app and consumes half a gig of RAM, it's probably electron.

Klonoar• 5 years ago

Generally a massive bundle size, and/or inspecting the bundled frameworks themselves (right click on app -> show package -> browse folders for frameworks).

scoopertrooper• 5 years ago

Usually evident from Activity Monitor, if you see <App name> Helper (GPU), then you have an Electron app running.

gumby• 5 years ago

If you can’t tell the difference it doesn’t matter and I wouldn’t worry about it.

Electron apps typically don’t work for me because they don’t integrate with the rest of the system cleanly, and so once you stray off the designers’ happy path it becomes clumsy to use the app. This isn’t an esthetic or ideological argument; simply for my usage an electron app can rarely be as convenient as a native app on the Mac. Things like input integration, system service integration, selection, and responsiveness are much harder to do when you are fighting the electron abstraction, so no wonder devs leave those things out.

cormacrelf• 5 years ago

Show package contents, check if 'Electron Framework.framework' is in Contents/Frameworks.

wpm• 5 years ago

Poke around the application bundle or its supporting files directories. On macOS, the Electron.framework folder will typically be somewhere inside of the .app bundle.

JohnWhigham2• 5 years ago

It is native, what are you talking about?

hoppyhoppy2• 5 years ago

https://news.ycombinator.com/item?id=28143563

kevinherron• 5 years ago

It's still native as of version 7.

edit: apparently 8 will be electron-based. So... no standalone subscriptions AND they've moved from native to electron :/

yesimahuman• 5 years ago

This is ridiculous. Electron works great, and if this leads to more frequent updates and a more consistent experience across platforms, that's a win for users. 1Password's Windows client, for example, has always felt behind the Mac edition, and if this brings parity and a higher feature and update velocity, that's a win. I have at least three Electron apps open right now and they are all great experiences that the vast majority of users of those products love.

This has nothing to do with VC and everything with trying to build a better product for users that is easier to work on for developers.

evgen2• 5 years ago

Electron is a pile of shit and _every_ Electron app I am forced to use should be a source of continuous shame for any dev who actually worked on it. This has nothing to do with improving features or service and is completely about increasing revenue and improving the sort of numbers investors like to see -- driven entirely by the fact that AgileBits has recently closed a B round and needs to show more revenue to justify that $2B valuation.

As a long-time 1password shill I have hit my limit and will slowly start migrating to BitWarden and iCloud Keychain.

yssrn• 5 years ago

A password manager doesn't need frequent updates. Instead, the priorities should be reliability, UX responsiveness, and light resource usage.

handrous2• 5 years ago

I have to treat each Electron program as having ~5-20x the system resource footprint of an equivalent native program—because they do. So they're going to get cut, or I'm going to pick a competitor to begin with, more often than a native app. That goes especially for anything I open often, or for anything it'd be convenient or necessary to leave running most or all of the time. Rarely-used programs, I mostly don't care, and Electron's fine.

jurip• 5 years ago

It may be a win for some users. I can’t see how switching my perfectly fine, frequently updated native app for a memory hogging web browser wrapper is a win for me. I’m actively looking for alternatives now.

leetcrew• 5 years ago

I think it's reasonable to complain about the loss of the native app when one of the key selling points (imo) is the pleasant UI. I don't really understand the almost-automatic hatred of subscriptions.

if an app has ongoing development that you benefit from, it seems entirely fair to pay a subscription. the fair alternative is a one time payment for a lifetime license with few patches priced in. I would probably prefer the latter for something like a word processor, but would you really want to use the same version of a security-critical program like a password manager for the rest of your life? if not, how do you expect them to fund development/maintenance indefinitely?

Karunamon2• 5 years ago

The hatred comes from their proliferation. With what seems like damn near everything moving to a subscription model, it's more money out of my pocket for usually what amounts to rent-seeking (i.e, demanding more money, more often, whilst providing no additional value).

That last bit I don't believe applies to 1Password, because there are certain things you can't do without some kind of centralization, and the article makes that case.

...but look at something like Adobe CC, what exactly does moving from a purchase to a subscription benefit me? And let's not forget about the more subtle effects, like losing the right of first sale, silent T&C changes, mandatory updates, etc - things that are only to the vendor's benefit.

Uupis• 5 years ago

if an app has ongoing development that you benefit from, it seems entirely fair to pay a subscription.

Agreed. Though, this latest development – the move to Electron – is a negative for me, so it leaves a part of me wondering what kind of development I have been paying for. I imagine I am not alone with such a sense of disappointment.

ddingus• 5 years ago

For this use case, a subscription makes a lot of sense. I have no complaints, though I currently do not subscribe to this application. I would, if I felt the need.

My take on the hatred boils down to these things:

Utility type applications built as a service offer an inexpensive purchase of some kind, or are AD driven, etc... Then, features are changed, roadblocks added, user experience degraded to create problems that subscriptions pay to remedy, often poorly.

Noisy subscriptions. It's not enough to send a few bucks a month. ADS, various pitches, in app sales happening, all contribute to what might otherwise be a simple, worthy experience and solution.

It can be hard to cancel. -->if this happens to someone even once, the hate can be visceral afterword. Everyone else, no matter how well they do business is impacted to a degree.

Subscription apps / services going away on short notice. What were people paying for?

Domenic_S• 5 years ago

I don't really understand the almost-automatic hatred of subscriptions. if an app has ongoing development that you benefit from, it seems entirely fair to pay a subscription.

I don't _want_ the ongoing development. Photoshop from 5 years ago is perfectly fine for me. Same with Lightroom, etc. I mean, I've only paid Apple _once_ for Logic Pro and have been getting upgrade after upgrade for no cost -- a nice bonus, but I'd be perfectly happy if logic's code had been set in stone at the moment of purchase, too.

The consumer-friendly option is to let the consumer decide if they want upgrades. Or for a security-focused app like 1password I'd have believed something like "we don't want to be responsible for security problems if you decide not to upgrade, thus you must buy a yearly license" but that wasn't the message at all.

aclsid3• 5 years ago

If every single utility and app start charging $3 or $5 per month then it becomes a problem. Software as a service is a good concept for something that is truly changing all the time, but I find it absurd that a Photoshop subscription or a huge IDE cost as much as these utilities thst used to be shareware in the past.

The old business model works but you have to keep innovating and diversify your product line. Microsoft was the best example with things like Encarta, Age of Empires and other tools like Project.

This new trend of doing these apps once, with far easier programming languages in a connected environment with plenty of docs, crash report data and things like stack overflow really makes it look that we are talking about cheap people trying to make a quick profit not unlike those free to play games.

jonpurdy• 5 years ago

I recently cancelled Evernote after 12 years of paying for it due to their new Electron client.

I've been using 1Password since 2008 and I'll be doing the same thing. I have tolerated the UI regressions and even subscription with version 7, but Electron is just unacceptable for what was once an amazing Mac app that put Apple's apps to shame.

selykg7• 5 years ago

I hate Electron as much as the next guy, but man have I been enjoying Obsidian. I mention this only because it has changed the way I write notes and manage them and I've been through the path of Evernote > Apple Notes > Bear > Obsidian.

janfoeh• 5 years ago

Exactly the same here. I've had three software subscriptions until this year, mostly begrudgingly — CreativeCloud, Evernote and 1password.

I got rid of two of them — Evernote for exactly the same reason.

1pwd going the Electron route would have put me close, but not over the edge — but the fact that they seem to have willy-nilly removed local vaults does.

These days it sometimes feels like one has to write all essential software oneself. Or go back to DOS and plain text files.

xseparator• 5 years ago

Oh so THAT'S why the Evernote update sucks. The Android client is terrible, it dumps me to the useless Home whenever I scroll to the bottom. It's now unusable. I've begun transitioning to Notion because of it.

2pEXgD0fZ5cF• 5 years ago

Similar here, I started using 1Password pretty early too. One of the main selling points for me: The nice, fast and native UI and the ability to keep my store local and sync it however I want.

The only wish I had over the years(and I would have gladly paid for an additional license): a linux client, even CLI would have been fine. I'm not sure which year they started, but what they pushed instead was the announcement of online sync and other things I did not care about, at some point it became hard to even find the regular version on their website.

This was when I slowly started moving to alternatives. With the move to electron and this anouncement here I'm happy that I moved away a few years ago and their clear signal that I am not the kind of customer they have any interest in anymore.

tablespoon• 5 years ago

Subscription business models and non-native apps are hallmarks of rot by VCs. Dump them!

Can you go more into how non-native apps are a "hallmarks of rot by VCs"?

I hate them too, but my impulse is to blame MBA thinking (build once, less investment, who cares if it sucks) than VCs specifically.

afarrell6• 5 years ago

Subscription business models and non-native apps are hallmarks of rot by VCs. Dump them!

The costs of developing and maintaining software are recurring -- especially for security-critical software. Subscription business models align incentives towards ongoing maintenance.

fortuna8614• 5 years ago

Where they going out of business before offering stand alone licenses? If no, this is a money grab.

postalrat• 5 years ago

Many applications choosing to use eletron instead of building native apps is the hallmark of failure of platform developers.

tonyedgecombe2• 5 years ago

I think there is an element of truth in that, especially on the Microsoft side.

trimbo• 5 years ago

When I was 18, I wrote some shareware and asked for $10 from those who used and liked the program. Lots of nice people from all over the planet sent in some money, and sometimes with letters. Most often it was a thank you note. Sometimes people requested more features in return for paying the requested amount. And occasionally they'd tack on whatever extra they thought those features were worth to them. (That amount was less than minimum wage, if I took the time to implement those features for them and release the software.)

I recently visited my friend from our programming club who saved these letters and was reminded a couple people wrote additional angry letters years after paying for the shareware. They demanded support in return for their one payment. (Of course, not only had I moved on to other projects, but I had long sold the type of computer the shareware was created for!)

So I learned early on that people unreasonably expect support for no additional cost. Or they believe the amount they paid is for support in the future, not work done in the past. It doesn't work that way economically. A constant flow of additional money has to come in the door to pay a team to do the actual support.

AFAICT, the only feasible models for supported software seem to be subscription, microtransaction or advertising. Any one-time-up-front price means it's abandonware. Which is fine for some types of software, of course, but probably not as often as users expect support.

afarrell6• 5 years ago

One could argue that their support team has handled this change unskilfully and that Agilebits should have hired a larger and more skilled support team before having a way to pay that team.

One could argue that.... but one would be silly to do so.

mirkules5• 5 years ago

Subscription models make sense for something that needs to stay evergreen.

Why does a password manager need a subscription? My password should never touch a 3rd party’s server, I don’t need extra features, I don’t need a login, I don’t need long-term or even short-term support.

What ongoing development does a password manager have? Is it that buggy from the get-go to need constant updates?

noobermin• 5 years ago

I don't know how subscription fixes your problem. Now people will still yell at you, even once you've moved on to other projects, and even more people will do so since they actually pay and assume that it is your obligation. You haven't fixed the "people are assholes" problem.

A better solution honestly is just to accept some percentage of people will be little assholes but hopefully, as you remembered before your friend brought it up, that most people are gracious and kind. Focus on those people.

PragmaticPulp3• 5 years ago

So I learned early on that people unreasonably expect support for no additional cost. Or they believe the amount they paid is for support in the future, not work done in the past.

If I buy a piece of software, it's not unreasonable to expect it to work for some period of time after the purchase. This is especially true on the Windows side, where Microsoft has gone to great lengths to keep old APIs around and support most (but not all) old software within reason. I have engineering software programs that are a decade old that still run fine on my Windows 10 machine.

macOS has been less shy about deprecating old APIs and forcing software updates. I probably spend $500-1000 every year just upgrading a certain few software packages that charge for a new version every time a new macOS comes out, and I hate it. I don't mind paying for new versions of software, but it's becoming saddening to watch all of my macOS software rapidly decay away with each macOS upgrade unless I buy the newest version.

xanaxagoras4• 5 years ago

Umm, the thousands of successful software companies before subscriptions, microtransactions and advertising were common in the software industry would like a word with you.

rubyist5eva• 5 years ago

1Password on Linux is electron, and works wonderfully. Though, it's kind of sad for Mac users as they have been spoiled with native experiences for a long time.

sleepybrett12• 5 years ago

Is that "spoiled" or jsut the way things should work?

aeturnum4• 5 years ago

Subscription business models

I think a subscription business model is the only honest way to sell software that will require ongoing support. If you're comfortable with a snapshot w/o updates, then by all means buy once, but I think coming to terms with the demands of ongoing support also means coming to terms with continuing to support the product in some way.

That said, I wish there were more variations in the way to pay - a long term license with a high upfront fee and a low monthly, an immediate access option with a high montly and no up-front fee, etc.

sleepybrett12• 5 years ago

why does 1password need ongoing support? Take these strings, encrypt them. Let me decrypt them using a password i specify. Let me search for them and sort them.

Done.

_dot__dot_7• 5 years ago

I don't quite see why free bug fixes/minor features + paid major upgrades model should be any different from subscription model for developers, except giving the users control over when to upgrade. Control that is essential for apps that contain critical data.

BTW, I think they do have an option that you pay for 3 years upfront. At least, that was one of the options they mentioned when I complained about the lack of the option to buy a license. To me that did not seem an acceptable solution because you pay upfront and still have all the drawbacks of the subscription model such as being dependent on the trustworthiness of a quite obviously untrustworthy company. Add to that the removal of local vault option, and it becomes even less acceptable.

jl_agilebits17• 5 years ago

Hi. I'm a feature developer for 1Password, and I want to clarify a few things. I've already posted this elsewhere, but I've seen multiple threads spreading misinformation that our technical decisions are being driven by VC funding. This could not be farther from the truth. We have been working on these changes long before we received any form of outside investments.

Over the past few years, we've been working on consolidating 1Password's business logic into a single Rust-powered core that could be shared across all our apps. This has many advantages: feature consistency across platforms, faster development cycles, and better security. When building the front-end for the desktop platforms that would take advantage of this new core, Electron suited us perfectly, since we could write our UI code once and make it consistent across Linux, Windows, and Mac. We actually did build a native Mac app initially alongside the cross-platform Electron app, but we eventually decided that having two separate versions of the macOS app (one in Electron, one in SwiftUI) would cause a lot of needless development churn and hassle for both customers and our support team.

I can understand your frustrations about Electron and our subscription-based model, but I hope you find my explanation reasonable. Please stop spreading misinformation.

Mindwipe6• 5 years ago

I've already posted this elsewhere, but I'm seeing some misinformation that our technical decisions are being driven by VC funding. This could not be farther from the truth. We have been working on these changes long before we received any form of outside investments.

That's worse, not better.

At least being forced to by investors makes sense. The current direction of travel being voluntary means you've just got a bad nose for building security.

neon_electro2• 5 years ago

Hi, long-time user, customer, and word-of-mouth recommender of 1Password for the nine years my Hacker News account has been active (give or take a few months). This is a big announcement that I'll have to chew on to understand what this means.

Can you quantify the "needless development churn and hassle for both customers and our support team" in some way? Presumably, 1Password 7 and its ancestors used native macOS APIs, which meant some degree of that given you had to do something different on Windows and/or Linux. I don't know what your support team has had to endure, but as a long-time sample size of 1, I've been incredibly satisfied with the way you've designed and engineered the macOS application (and the iOS app too!) to date; I'd be hopeful that whatever tradeoffs y'all will be making moving to Electron, the "native" feel of the macOS client wouldn't be sacrificed. Is there anything you can speak to there that I should prepare for with 1Password 8?

mirthflat832• 5 years ago

I am very unhappy that 1P is moving to Electron for macOS for the reasons people here have reiterated a million times. I am actively looking for alternatives now.

Syzygies• 5 years ago

I'd like to believe this isn't primarily profit motive. What gives me pause is how I write regularly asking for separate vaults for trivial passwords and passwords that could lead to financial ruin. The profit motive wants to keep 1Password simple to use, at the expense of security. I've been forced to buy a second password manager for sensitive passwords.

fortuna8614• 5 years ago

So the user hostile changes aren't VC driven, they are internal choices. Ok. How does that change anything?

erichurkman• 5 years ago

Does that new "core" prevent you from syncing via iCloud?

swiley2• 5 years ago

would cause a lot of needless development churn and hassle

The hassle of doing what your users are paying you to do? Any child can hack a UI together in HTML but there's a reason no one (usually) pays for that.

chrisfosterelli5• 5 years ago

This makes sense to me. Lots of other products have head in the same direction over time (e.g. YNAB) for similar reasons.

SaaS is familiar to consumers and ultimately a nicer business model for most products. If you support SaaS for new customers, maintaining the old product / pricing model indefinitely eventually stops making sense. At some point you have to make a move like this.

It is probably particularly timely to do this because Lastpass recently changed their pricing model (whether deliberately aligned or not). It's no longer possible to use the free plan of Lastpass and use it on both desktop and mobile: you have to pick one or the other. For many use cases this is effectively a requirement to use the paid plan. So now 1password has the opportunity to push legacy users to a paid monthly subscription knowing that some portion who may have switched to Lastpass to avoid a monthly fee now won't be able to do so, and will probably just pay the monthly fee to 1password instead.

smnrchrds2• 5 years ago

I will run the installed version of YNAB as long as it runs on my computer, and after that I'll probably run in in a virtual machine until the end of time. I am not comfortable with my financial information being on the cloud in the hands of a third party, much less so when it is not the likes of Google and Apple with armies of security engineers and can be hacked much more easily.

chrisfosterelli5• 5 years ago

Yeah I can totally understand that. I'm similar with the sync feature: the last thing I'm going to do is give them (or their 3rd party provider) my actual bank credentials. I would feel better if they supported some type of end-to-end encryption. I can also understand how, at least from a business perspective, most users probably don't care enough to not use it.

dangus• 5 years ago

Your bank is already a third party with its hands on your financial information, likely stored "in the cloud."

Check out Chase's privacy policy as an example:

https://www.chase.com/digital/resources/privacy-security/pri...

A number of information sharing activities cannot be limited. This is typical of any bank or financial institution. Your bank has its own vendors, many of them are themselves SaaS and cloud hosted!

Even large, sophisticated banks can be hacked:

https://www.nytimes.com/2019/07/30/business/bank-hacks-capit...

My point isn't to say "Why care at all? Just open the floodgates!" Instead, my point here is that trust and security in our society is only as good as the people and institutions that back them up. We don't use bank vault doors for our front doors just because we have the knowledge that anyone with simple tools can defeat a home lock.

Therefore, I think that the choice of more inconvenient solutions made just to avoid some nebulous what-if scenarios involving privacy is often (but not always) the wrong way to go.

monocularvision2• 5 years ago

I held off on the new YNAB for a very long time before switching about a year and a half ago. I absolutely love the new version and the syncing works so much better than before. And the new iOS client is loads better.

miika2• 5 years ago

Still using v6 and not planning to upgrade

cpuguy833• 5 years ago

I was pretty stubborn at first, but honestly 7 has a lot of nice features, especially for families. You can also continue to use your old vault, though the announcement here seems kind of vague if this will continue to be true.

miika2• 5 years ago

Thanks for tip, I might upgrade.

I was just disappointed that I would have to buy the app again in order to upgrade.. because I just couldn’t see why it wasn’t free update.

g19fanatic• 5 years ago

app.keeweb.info with drive sync... good way to go

eloeffler• 5 years ago

I've never tried 1Password but I've seen many here who endorse it. Does anyone have experience with both 1Password and KeepassXC? Especially with 1Password local vaults...

aniforprez• 5 years ago

I've only briefly tried Keepass but the UI, the general clunky nature of the UX and such turned me off. To be completely fair, this was 3 years ago when Lastpass was becoming more and more useless and unreasonable. I tried out Dashlane and ended up using 1Password and have been a very happy customer since. I'm not particularly concerned with self hosting or syncing personally

mdaniel4• 5 years ago

I used KeePassXC as the Linux client for 1Password before there was one from AgileBits, and stopped short of implementing _write_ for the opvault format because that wasn't in my use case (and I also had some non-trivial concerns about KeePassXC accepting the PR, so I was trying to pitch it as a way to get more people to import 1Password opvaults)

I would be on-board with implementing the write side to opvault if they'd accept the PR, and would also implement the browser extension protocol server if 1Password would specify it, since as others have pointed out the KeePassXC browser extension is suboptimal

Then again, with all the massive outpouring of Bitwarden support in every single one of these threads ever, I am pretty sure the real solution is just to bite the bullet and jump ship to Bitwarden/vaultwarden like everyone else seems to be doing

I'm willing to stick around long enough to see if AgileBits makes good on their local vault something something, but given the past few years of activity, I'm going with "they're bluffing" or "it'll be a horribly hobbled implementation"

mdaniel4• 5 years ago

Then again, with all the massive outpouring of Bitwarden support in every single one of these threads ever, I am pretty sure the real solution is just to bite the bullet and jump ship to Bitwarden/vaultwarden like everyone else seems to be doing

To follow myself up, I seem to have found another "those people don't know what they're missing" situation because I actually did try Bitwarden (Premium) this weekend and what a dumpster fire compared to 1P

I thought about writing up all the shitshow, but ultimately it just boils down to them not caring about their product or users

For some of the platforms, I would actually be on-board with jumping in to fix the innumerable bugs, but with them being a mixed setup (open and "premium" features), the fact that so much fundamental behavior has been broken for so long with no obvious mitigation strategy makes me question whether this is something I would want to invest in

matthoiland• 5 years ago

Anyone have good/bad experience moving from 1Password to Apple' iCloud Keychain?

I've recently been using keychain for new accounts, but not sure I wanna bite the bullet and go all in - just need a nudge.

jw12242• 5 years ago

I thought about it, but decided I’d miss 1Password’s 2FA auto-fill too much — it’s a huge timesaver for me.

frou_dh• 5 years ago

Never had any reliability issues with iCloud Keychain since switching over 2-3 years ago, but obviously it's less featureful than 1Password. I liked how 1Password had a dedicated section for software licenses, but now just use a Notes note for that.

kstrauser• 5 years ago

The most valuable parts of 1Password for me are storing non-password stuff like license keys, secure notes, random security question answers, and the like.

kergonath• 5 years ago

I’ve always used secure notes in the Keychain app for this. Not as smooth as 1Password, but it does the job when I need a licence number (when I get a new computer, so once every ~3 years) or an answer to a security question (can’t say how frequent that is; certainly not more than 1 every other year).

I’ve been doing that for more than a decade (more like 2 actually) without a hiccup.

sfotm• 5 years ago

I don't recommend Apple's keychain. It's smart enough to track usernames and passwords and feels very satisfying to use on an iPhone, but doesn't capture some other parts of authentication. This includes security questions, OTP, capturing notes around how sign-ins can be weird (HSAs and other portals rife with redirects), and non-iOS devices (as well as non-safari browsers).

Bitwarden is fantastic. I pay for the OTP features, though I feel keeping the codes alongside my passwords weakens my security posture. That's my choice, though.

lotsofpulp5• 5 years ago

I use Apple keychain in conjunction with KeePassX. Apple keychain for the convenience, but KeePassX is the master storage.

feifan• 5 years ago

I've used iCloud Keychain for all my personal stuff since it existed. It's pretty bare-bones, but the built-in integration into Apple's software makes it a no-brainer for me. It's worked great!

ValentineC7• 5 years ago

My daily drivers are a MacBook Pro and an iPhone, but I'd go with a 3rd party password manager every time for the ability to access passwords on a non-Apple device if I want.

vishnugupta• 5 years ago

I know what 1Password is but haven't used it.

Are there advantages of using it over Apple's built in keychain?

Would appreciate if someone who has used/uses 1Password could comment on this.

cpuguy833• 5 years ago

Not tied to Apple.

I don't think Keychain (up to but not including iOS 15 beta) supports OTP.

On macOS, not much other than Safari seems to use it, I think?

xondono5• 5 years ago

-Multiplaform support

-Password sharing

There’s some nice “sanity checks” on all passwords, manual or generated, like reused password warnings and by default it checks your logins at haveibeenpwned, which is a nice to have.

horsemans• 5 years ago

It has a built in 2FA generator.

It supports many more kinds of secure data than passwords and credit cards. It has specific entry types for bank accounts, passports, reward programs, software licenses, and so on.

It also has lots of built in analysis tools for determining: - which of your passwords are reused, weak, or present in online password dumps - what websites can have 2FA enabled on them

As well as the ability to store entire documents in vaults.

Been using 1Password since 2008 and it's the only software of its kind I recommend to anyone on any platform.

ChrisMarshallNY2• 5 years ago

I like it for a number of reasons (other wallet apps can meet these bars, as well):

1) It is very cross-platform. It works on iOS, Android, MacOS, and Windows. I believe that it is also Linux-ready.

2) It has the ability to sequester groups of passwords into "vaults," that can then be assigned in different configurations, for different accounts. This way, the Treasurer gets the banking login, and whatnot, but the Webmaster never sees them, and Treasurer never sees the CP login.

3) It seems to support a whole bunch of TFA.

4) It syncs over everything, and helps to enforce password hygiene.

aborsy2• 5 years ago

Keychain is not quite a password manager.

It has a field for user name and password, both mandatory.

A password manager offers a lot more, including a field for notes or credit card numbers.

LgWoodenBadger• 5 years ago

FWIW, Keychain Access supports secure notes as well.

monocularvision2• 5 years ago

For me the most important features are 1. Family support and 2. Cross platform (see #1… we have some Windows machines in the family)

If it were just me, the iCloud stuff would probably be enough.

nonameiguess• 5 years ago

I'm glad I've been using Bitwarden anyway, I guess, but to me, this is totally unacceptable for security-critical software. You absolutely need to make it possible to self-host. If you're content to only ever be available to low-information, low-effort individual consumers, fine, I guess that's a market, but you've locked yourself out of ever being able to sell to high-security organizations that can't use public cloud services.

puttycat3• 5 years ago

I highly recommend Enpass -- solid UI, single purchase, local vault, and a very handy option to sync via Dropbox (and probably through other services as well).

canadaduane2• 5 years ago

Thanks for this! Looks interesting. I feel like I should have heard of it before... any idea why it's under the radar?

puttycat3• 5 years ago

I'm not sure it's that under the radar. It's often recommended here in similar discussions.

chumsong• 5 years ago

Sounds terrible. Doing fine with keepass + dropbox.

InTheArena3• 5 years ago

I am a big fan of 1password. I was very unhappy with the transition to subscription only, and tried bitwarden. After months of futzing around with it, I went back to 1password.

I did so after reviewing their audit results, awhat they documented about their architecture, and after they added great support for Linux. At the end of the day, not everything is a conspiracy - and their model appears to be incredibly secure.

I would like the self-hosting option (that like Bitwarden, will still require a subscription), but a big part of what I am doing is sharing credentials with family. 1Password does a great job there.

Honestly at the end of the day, everything else is about your value proposition. I didn't know or realize that 1Password had shifted to electron as asserted elsewhere. I guessed that there was a new version given that linux was supported but it made no difference for me. Great for them. Likewise, they are far more secure then me editing a password file. Eventually the market will decide here. If people really care about swift versus javascript, then it will penalize them eventually.

That said, people arguing that dashlane and others are better then 1password, given that dashlane has access to your passwords, I can't imagine that this is a choice that makes any sense given the basic requirement of a password manager (keep my passwords safe).

-- edited correction - dashlane, not lastpass.

Justsignedup• 5 years ago

I did not realize LastPass has access to your passwords...

InTheArena3• 5 years ago

sorry, quick correction. It was dashlane. https://blog.dashlane.com/virginia-tech-passwords-study/

xondono5• 5 years ago

That said, people arguing that lastpass is better then 1password, given that lastpass has access to your passwords

Don’t get me wrong, I hate Lastpass with an unprecedented rage for something that should be a simple utility (I’m forced to use it at work and it’s a time sink), but I don’t know where you get that and would like a source.

InTheArena3• 5 years ago

sorry, quick correction. It was dashlane. https://blog.dashlane.com/virginia-tech-passwords-study/

colesantiago• 5 years ago

where does it say that dashlane has access to your passwords, I don't see them saying this anywhere?

darknavi4• 5 years ago

Please, if you haven't already, fill out this 1Password survey. They are considering self-hosted vaults but want more data on who/how it would be used:

https://survey.1password.com/self-host/

forty2• 5 years ago

Edit: not Dashlane either ;)

Source: I work there :)

xondono5• 5 years ago

I honestly have 0 problems with this.

They’ve gone over and beyond to support old licences far longer than it could be expected, and a password manager is the kind of sensitive and ubiquitous product for which SaS actually makes sense.

Anyone remotely involved in anything similar knows it’s a PITA to keep up to date while keeping device compatibility, and the folks at 1P have been doing great work.

craigc• 5 years ago

Actually a sensitive product is exactly where this does NOT make sense. No matter how good their security is with their cloud version it will still be less secure than having a vault locally on your disk. That is a fact.

Subscription services to me are only justified if they are providing a SERVICE which they are with the web version and ability to sync through their own servers, however, using a local version with your own vault can be done without any service at all.

So to me this looks like them intentionally crippling their own software in order to force people into paying a subscription fee that is not necessary. They already hide the ability to purchase a standalone license for 1Password 7 trying to get people to pay the subscriptions so this is the next logical step.

jl_agilebits17• 5 years ago

Hi, I work for 1Password. I can understand your frustration that we're phasing out local vaults. Luckily, I have some good news: we're currently running a survey to gauge user interest in self-hosting options. If you're interested, go to https://survey.1password.com/self-host/ and let us know your thoughts. Thanks!

xondono5• 5 years ago

Actually a sensitive product is exactly where this does NOT make sense.

The idea that anyone except a tiny infinitesimal minority of all people should self host is ridiculous.

Even a lot of people with IT jobs have not enough time or knowledge to keep services like this working securely in a way that’s competitive with SaaS (i.e. these people are better served by paying others to do the job).

If you need any proof, just wander around any company that works in IT and do a simple check, see who has the latest OS version and who doesn’t.

reilly3000• 5 years ago

I got started with 1Password SaaS based on a work account and added it for my family, so I am not losing anything with this change. I've generally been pleased with the service and its definitely been an upgrade from LastPass in terms of usability and security (no random autofills into hidden forms, no breaches etc...)- that said I'm sad to see this direction. I can't see how this could have been costly to maintain, nor that it would bring them incremental revenue given the backlash and ample competition. Maybe predictable cashflows are worth it, but in principle self-hosting should always be an option.

jrm4• 5 years ago

Paid third party password managers (without indemnification or other real skin in the game) have always been a dumb idea. This just makes it worse.

FreezerburnV3• 5 years ago

I guess I’m the outlier in being very happy with 1Password and fine with paying for the subscription service. Not only is 1Password the best password manager I’ve used, but it makes it seamless to share stuff with my wife. I don’t care if 8 is an Electron app either, considering I usually interact with it via the browser anyway with their extension. (Also I know that the majority of what they wrote for it is Rust and fast, and I generally trust the engineers to do a good job since they’ve done a good job with it in the past) Also they make a CLI tool for accessing passwords allowing you to integrate password management there: https://1password.com/downloads/command-line/

notyourwork• 5 years ago

$20/month seems a bit steep if you ask me. Otherwise I agree with everything you said.

edit: I misread and was looking at the business page. $4.99/month for family and $2.99/month for user is entirely reasonable!

bennyp1012• 5 years ago

For a family (5 ppl) it was $71.82 last invoice (Dec) which is ~£50 a year.

We have me, my wife, my eldest, and my mum on it - and it is indeed super simple to be able to share things around.

I used to have keepas/lastpass/dashlane - but 1password is the only one I've managed to convince family members to use as well

adoxyz• 5 years ago

yeah. and I think its $50/year. It's the one sub that I'm happy to pay.

runlevel12• 5 years ago

I'd be ok with paying an annual fee for the app.

What I have zero interest in is increasing my attack surface solely for their bottom line.

I'm also increasingly uncomfortable with the company handling my passwords engaging in the sort of spin and dark patters we've seen from AgileBits in the past few years.

FreezerburnV3• 5 years ago

I'm curious about how you see the attack surface increasing when using 1Password. My knowledge of how it works is that it always stores your passwords in an encrypted blob that can only be decrypted with a combination of username, "master password", and vault password. So no matter if it's in Dropbox, 1Password's servers, or your own hard drive, if anyone obtains a copy of the password file they still have to crack it before they gain access to anything.

Also I see your reply has been downvoted enough to become grey. (EDIT: Looks like between starting writing this and submitting it, you're no longer in the gray from downvotes!) I imagine it's because you made a blanket claim about spin and dark patterns without any supporting evidence. I'd be curious to know what you're referring to since I don't really keep an eagle eye on this stuff, I just use their product.

The one thing I do remember in the vein of "dark patterns" is how they effectively hid the method of doing a one-time payment for 1Password where you have to manage syncing and backing up the password file yourself. Seeing as I have no reason currently to do anything but make a charitable read of that situation which has been decried more than once on HN, I'd be willing to bet they did so for the following reason: They have had many problems in the past where a customer has lost a password file because they were not a power user and did something such as keep it on one hard drive in their only computer. (reinstalled windows, hard drive died, etc.) So they wanted to make something that would prevent that from happening for the vast majority of their customers that don't really understand stuff like backups, or don't have Dropbox, or who aren't part of Apple's ecosystem and have iCloud, etc. so that their passwords will remain safe and secure. So they made their own sync service and hid the version that would do local-only files so that only the dedicated users who really want to do that would find it and use it.

OR alternatively they're a bunch of greedy people that just want to hoover up dollars from our wallets, as people love to accuse them of here. Maybe a little of column A and column B, honestly. Something something needing to ensure they have a company that stays in the black without wanting to absolutely bloat up their own software so it becomes another useless Enterprise(TM) application with each passing paid version.

Also the only affiliation I have with 1Password is I have a friend I recently learned works for them, otherwise I'm just a customer. I just got into one of my little ADHD focuses where I really wanted to reply with something long and detailed, so please don't assume I work for them or something and am defending them because of that :)

stjohnswarts• 5 years ago

I think bitwarden is much less cringey as a corporation if you're looking for an alternative. I use it and pay an annual subscription and have no issues. You can even self host if you get fed up with pay for a suscription or their free service.

jgimenez• 5 years ago

Agreed. In the end 1Password has always been a subscription, just you paid "one-time" upgrades every two years to stay up-to-date with the latest version.

However the differential factor of 1Password, which was that it _didn't_ provide the storage if you didn't want it, has now gone away. Precisely why I chose 1Password when I started using it. I don't see the difference between this and any other password manager now.

There might be security or technical reasons for removing this option, but looking at how hard they've been trying to get me into a subscription during the last couple of years I just think we're on a bad case of subscription-all-the-things here.

mynameisvlad7• 5 years ago

100% same. I've been a happy subscriber for years now, and recently switched to the Family plan to try and get my parents to start taking security a bit more seriously.

thallavajhula2• 5 years ago

I've been using 1Password for 3 years now. Been paying $35/year and I'm with you on this one. I really like their service. The integrations are great. I rarely use their Mac app. I use my Apple Watch to unlock 1Password in my browser. That for me, is a game changer. It's such a seamless experience. I'm a happy customer and I love the service.

robbiep3• 5 years ago

I didn’t know this is a thing… I’ll have to look into it - thanks

slipperlobster2• 5 years ago

I use my Apple Watch to unlock 1Password in my browser.

Can you point me to where this gets set up? I'd love to do this.

falcolas2• 5 years ago

I come at it from a slightly different angle. I got in when it was syncing via Dropbox and iCloud, and it worked perfectly fine.

The switch to a subscription service is a forced downgrade for me; it's putting functionality I already have behind a subscription.

This is particularly an issue since the old versions (versions I paid for, mind you) are slowly going away (typically as a recompilation and submission is required to keep them available on iOS devices).

city41• 5 years ago

I'm somewhere in between. I also paid for a non subscription version and I also feel like I was forced to upgrade to the subscription. Sadly switching password managers, especially if you share with a family, is really painful.

We now pay the subscription, a tad begrudgingly, but I have to admit 1Password overall does a great job.

andrei_says_• 5 years ago

I only have the iOS non-subscription version and am happy with it. Is this going away?

It allows me to use the vault on all of my iOS devices and that’s sufficient.

jupp0r• 5 years ago

This is the reason I bought my first license of 1Password many years ago. I thought the trust model of one vendor supplying the password manager but not the storage (I was using DropBox sync too at the time) was a great way to ensure that my data is safe.

reissbaker• 5 years ago

Same story for me. I switched to the KeePassXC ecosystem eventually as a result — it's open source, has compatible clients for just about everything, and has one-click import for 1Password vaults.

nswest23• 5 years ago

same here this is when i switched to bitwarden and haven't looked back!

ValentineC7• 5 years ago

I'm perfectly happy with paying a subscription, and think $4.99/month for 5 people is affordable.

What I'm not happy with is the possibility of password access being limited or sync breaking if 1Password servers go down. At least with Dropbox (iCloud, wifi) sync, I have full control over the local vault file.

Ultimately, it might be mostly about ownership and choice for me.

auslegung• 5 years ago

If the servers go down you'll never lose access to anything. You would lose sync while the servers were down but you would be able to access everything you already had on every device.

DavideNL6• 5 years ago

Also I think the "head" of the family can reset passwords of the other accounts...

prepend4• 5 years ago

$4.99/month for 5 people is affordable.

I’m glad you find it affordable but these nickle and dime things add up. Especially when the product fits into $0 software so $4.99 is infinitely higher than $0.

I feel like these small, “affordable,” services are just whittling away the Unix philosophy of do one small thing well. Layering on unnecessary crap just to charge a fee eventually comes home to roost.

Also, passwords is a lifetime need. So 80 years x 12 months = $4,790.4 and that seems like a cost that should be reduced out of one’s lifetime.

Do I want to go to Tahiti once in my life, or pay for password convenience?

Again, glad you’re happy but I don’t want to live in a world where I pay $5/month for commercials versions that crowd out what should be community, OSS tools. I love curl and it’s awesome, but don’t want to pay $5/month/forever.

We forget that taxes are inefficient and should be minimized where possible. A login tax for all eternity sucks.

mst3• 5 years ago

I'd vastly prefer to be able to do 'bring your own storage' but for that price I don't really see a problem with that being a "you can do that, but you pay the same subscription price anyway" feature.

stereoradonc3• 5 years ago

Affordability is a mirage- $5 per month and $60 per year wont break a bank but its a huge amount to justify other geographies where money transactions are NOT in $$

leokennis• 5 years ago

When you have a 1Password.com subscription, you are not "working in the cloud" like with Google Docs or something.

Your vault is local, and synced to/from the cloud.

Basically just like Dropbox. If your internet is down and you cannot reach Dropbox, all files synced to your computer are still there, on your computer. It's just that any changes you make locally or changes made on dropbox.com cannot be synced until your connection is back.

joshstrange• 5 years ago

I agree, I switched about a year or two ago to subscription and I'm quite happy with it. There are some apps/platforms that I believe /should/ be subscriptions and my password manager is absolutely one of those. 1Password has continually added new/better features year after year and the price is tiny compared to the value I get (and then subsequently provide to people in my 'family'). The UI is the best I've seen in a password manager and while design doesn't necessarily affect the ability for a PW manager to do it's core job, I prefer looking at pretty apps. Almost every time I use 1Password I leave with a smile/good-feeling.

MrStonedOne• 5 years ago

I think the issue people have is YetAnotherCompany:tm: forcing you into their subscription walled garden.

And also from a user security standpoint, i don't think we can keep going on making enhancements to user security good practice habits if we gate keep good password habits behind paywalls.

burnte• 5 years ago

I'll be an outlier with you. I install the app where every I am, authenticate, and BAM, I have my passwords. So easy even a caveman could do it. I've been a happy subscriber for years.

hosh• 5 years ago

Same. I share my passwords with my wife and sync them across devices. I also have a license for an older standalone app. I don’t feel cheated. I wanted to be able to share some passwords with other people.

I saw something mentioned about self-hosted vaults. That is something I might consider for my family.

I advocated for the use of 1pass at work precisely because we can share strong passwords with the team. Otherwise, people would just use the same, well-known weak passwords for everything, including business critical ones like domain registrar or Gsuite admin or the root AWS account.

I am not as happy about having another Electron app running on my local box. I hope they spent time locking things down. On the other hand, if it means my wife (on Windows) gets feature parity with my macOS client, that would be good. Even better if the Linux desktop gets feature parity and no longer have to rely on the web or browser plugin.

jw12242• 5 years ago

1Password’s 2FA OTP auto-fill is such a blessing.

It saves me so much time compared to how I used to have to do it — pull out phone, unlock, open Authy, wait forever for it to load, type in code, put phone away…

It’s the little things that all add up. I’m very happy with 1Password — been using it for 10 years, and happy to subscribe, considering it’s probably my most-used utility app.

andrecarini7• 5 years ago

1Password’s 2FA OTP auto-fill is such a blessing.

Until your vault is somehow compromised and your second factor is no longer distinct from the first one...

mvanbaak2• 5 years ago

Authy has a desktop app :)

sylens• 5 years ago

I agree with all of your points - I'm okay with their sub model, I'm okay with Electron and it's the first time I was able to convince family members to use a password manager (because it works so well)

staticassertion3• 5 years ago

Yeah, same. This is fine by me and changes nothing for me as a customer.

munchbunny• 5 years ago

I think removing the self-managed data store feature makes sense even if not everyone likes it. It removes a source of architectural complexity, and most users aren't looking for local storage anyway.

Personally, the problem of managing reliable persistence of my password database just isn't something I want to spend time on, and the incremental difference in security posture is uninteresting to me given that it's encrypted at rest anyway. In terms of waking hours spent worrying about the security of my household IT, the security and persistence of sensitive documents (mainly vs. ransomware) is a bigger problem and I like that my passwords aren't tied up in that mess.

swiley2• 5 years ago

I think removing feature X makes sense, even if people are using it. It just makes the developers job way easier.

And that's why I only use community maintained software with no telemetry or "data driven decisions."

sleepybrett12• 5 years ago

psst i'm not paying for the software to make their lives easier. I'm paying for the software for the features.

ShakataGaNai• 5 years ago

I'm with you. It's seemless, it works (on everyplatform) and it's easy to use.

At the end of the day if you want a password vault that is sync'd across devices, you're trusting someone...somewhere. Be that 1password, dropbox, or even that Linode you manually rsync your data to. You've got to decide what is the biggest risk for your own personal use cases.

For me, I'd rather store my sensitive data with a company that has demonstrated a repeated push to keep my data as secure as possible, even from itself. It's their core business, all they focus on.

gonehome• 5 years ago

Agreed - software like this doesn't exist in a vacuum of frozen dependencies (at least not until Urbit takes over). Subscription models make sense for stuff that requires updates over time to keep it working. Their stuff is reasonably priced and the product has been really good for years (imo).

I suppose they could do something like JetBrains where you get updates while subscribed, but realistically login breaks for users would be a mess to support and a standalone text editor is a different service.

This move makes sense to me given their market. Those that want to run a vault can use an alternative that's more of a hassle to deal with.

cirrus3• 5 years ago

Agree. 1Password is one of the software subscriptions I have no regret paying for.

sanderjd• 5 years ago

Yep, long time 1password user and recommender. None of this bothers me.

xuki2• 5 years ago

The writing was on the wall when they took VC money[1]. Anyone has a good guide to move to Bitwarden/Lastpass?

[1] https://techcrunch.com/2019/11/14/fourteen-years-after-launc...

judge20205• 5 years ago

https://bitwarden.com/help/article/import-from-1password/

I'd only recommend LastPass if you're a fan of LogMeIn, Ltd. and only being able to see your passwords either on Desktop or Mobile (on the free version).

dylan6042• 5 years ago

Sorry, but where else other than Desktop or Mobile are there to view data?

_jal2• 5 years ago

Second vote for Bitwarden.

Lastpass is a bucket of ass.

They've had security bugs in their browser extension before, but it is almost required to use it - the webapp works horribly without it. My least-used browser gets that extension, so it isn't running most of the time, at least. And with it, the UI is still terrible. The app is just awkward and poorly done.

The one good thing I can say is the user/group model is reasonably implemented.

fortuna8614• 5 years ago

I just went through all the trouble of setting up Bitwarden, the built-in 2fa from 1P doesn't seem to transfer over, or doesn't work with the chrome extension at least.

jl_agilebits17• 5 years ago

Hi. I'm a feature developer for 1Password, and I want to clarify a few things. First of all, our decision to built the macOS app in Electron was absolutely not driven by VC money. For the past few years, we've been working on consolidating 1Password's business logic into a single Rust-powered core that could be shared across all our apps. This has many advantages: feature consistency across platforms, faster development cycles, and better security. When building the front-end for the desktop platforms that would take advantage of this new core, Electron suited us perfectly, since we could write our UI code once and make it consistent across Linux, Windows, and Mac. We actually did build a native Mac app initially alongside the cross-platform Electron app, but we eventually decided that having two separate versions of the macOS app (one in Electron, one in SwiftUI) would cause a lot of needless development churn and hassle for both customers and our support team.

I can understand your frustration about Electron, but I hope you find my explanation reasonable. Please stop spreading misinformation.

bgentry• 5 years ago

Electron suited us perfectly, since we could write our UI code once and make it consistent across Linux, Windows, and Mac.

This is the source of your mistake. Users don't desire to have the same UI across different OS environments, it's only an app's developers that care about that. Cross-platform UIs are inarguably a worse user experience than UIs tailored to the conventions and designs of each OS.

A Mac app that doesn't actually feel or behave like a Mac app is not a good Mac app. The same is true with tvOS apps like YouTube and Prime Video that don't actually feel or act like good tvOS apps.

nothinggoesaway• 5 years ago

This would be an appropriate riposte to [1], a vitriolic comment that draws the line between VC money and Electron, but not to parent.

Parent makes a lot of sense, actually, in context of the submission headline. There was no misinformation here at all.

[1] https://news.ycombinator.com/item?id=28145755

dak1• 5 years ago

But how can you justify removing the ability to have a local vault?

Why would anyone think for a second that it would be a good idea to force people to store every password for everything in their life in your cloud without an opt out?

That, even more than Electron and the subscription model (both which do bother me), is an absolutely deal breaker. I've paid for every version of 1Password since v3 in 2009, but I'm done with it now.

john_minsk• 5 years ago

Question: you built it in Rust for performance reasons, right? Wouldn't Electron take it away?

xuki2• 5 years ago

Hi, I didn't mention Electron in my comment, it was purely about the move to remove single time purchase and local vaults. I don't like the direction where the product is heading, therefore I want out.

Groxx2• 5 years ago

Strong "do not want" for lastpass. Run far, far away.

I switched to KeePassXC a while ago due to the increasing hostility over local stores. Looks like I was right on the money.

KeePass has served me pretty well - it's not as polished, but it works absolutely everywhere due to the numerous client apps on many OSes, and it syncs normally. Toss on something like Dropsync for mobile, and it's pretty streamlined: https://play.google.com/store/apps/details?id=com.ttxapps.dr...

samgranieri3• 5 years ago

Damn. This is a huge mistake. I've used 1password for over a decade. I will happily buy an upgrade license. I just don't want another subscription to my credit card. This is rent seeking!

Maybe I'll try bitwarden.

WillPostForFood2• 5 years ago

People are said to seek rents when they try to obtain benefits for themselves through the political arena. They typically do so by getting a subsidy for a good they produce or for being in a particular class of people, by getting a tariff on a good they produce, or by getting a special regulation that hampers their competitors.

You may not like the subscription business model, but it isn't rent seeking. Monthly payment != rent seeking.

criddell2• 5 years ago

From Wikipedia:

Rent-seeking implies extraction of uncompensated value from others without making any contribution to productivity.

I think the rent seeking comment was about removing the option for (free) Dropbox sync and only supporting the subscription-based plan. They are asking for more money for less product.

samgranieri3• 5 years ago

I was wrong to use the phrase rent-seeking. My mistake

devnulll• 5 years ago

I use 1Password, and migrated over to their subscription service some time ago. A password manager seems like the best overall option at this time.

However, given they have all the password for many people, how are they not one of the biggest targets in the world? In their old Dropbox model, I understood the security model. In the service model it's moved to "Just Trust Us".

Is there anyone who can help me understand how this model is secure?

judge20205• 5 years ago

https://1password.com/security/

It's basically E2EE (where the encryption key is your master password + secret key, which looks similar to a guid), with the caveat being that 1password is still accessible via the browser so you do have to trust they're not compromising you by saving your secret key + master password separately (that is, unless you're auditing the login page every time you open it).

djrogers2• 5 years ago

Err, have you checked with them?

https://support.1password.com/security-assessments/

They've gone pretty far above and beyond what we're used to seeing wrt sharing security details, audit results, and architecture information.

cgb223• 5 years ago

As long as 1Password keeps their policy of not selling usage data to 3rd parties like LastPass does, I’ll keep using this service

Self hosting would be nice to keep though. Been thinking about setting up a server to hold all that stuff

Cd00d• 5 years ago

I've been a long time user of LastPass, and have never heard anything about them selling usage data.

This is both upsetting and disturbing.

mackrevinack2• 5 years ago

do you have any links or a quick summary of what lastpass is doing? i hasn't used that in years but i would be curious to know anyway

brandonarnold• 5 years ago

The argument they're making in this longwinded post applies to most software today. Standalone licenses made sense when your life revolved around one PC saving data to its own hard drive. Today, if you want that, there are great free/DIY options.

avidiax• 5 years ago

Subscription based licensing is mostly rent-seeking.

The cloud storage, compute, and egress for a password manager is fractions of a penny per year per user.

Yes, engineering and upkeep and new features costs money. If those features are truly valuable, then the market would bear paying an additional one-time fee, just as photoshop 8 had to be better than photoshop 7 in some way to justify the purchase.*

But what new features could a mature password manager possibly have? Support for newer version of IOS and Android is the only must-have that comes to mind.

* File format changes not-withstanding.

thatswrong02• 5 years ago

Subscriptions are not rent seeking.

paulryanrogers• 5 years ago

Having dabbled in productizing desktop software I think it's more because of API churn on modern OS's. It used to be you only need to buy once, and things work for years. Maybe a modest paid upgrade after a major OS upgrade.

Now OS's evolve continuously. Semantic versioning be damned!

acdanger• 5 years ago

Does anyone have experience migrating from 1Password to an alternative? Hoping there’s an export data from 1Password solution at least.

rvz• 5 years ago

First Electron and now it is subscription only with no support for local vaults. That is a definitive scam and it turns out I was right again [0], when they added Linux moved to Electron and that was a hint in itself of where 1Password was going. [0] [1]

I'd rather use a standalone extension as a password manager than use a heavy Electron app that will run my Macbook to the ground.

It is either Bitwarden or Dashlane at this point.

[0] https://news.ycombinator.com/item?id=27194871

[1] https://news.ycombinator.com/item?id=27195834

0x5f3759df-i• 5 years ago

Standalone user for about a decade now. I find this incredibly disappointing.

I don’t mind paying a subscription fee if that’s what makes the business work and allows continuous updates.

But either they give us a self-hosted option or I’m done with 1password. Keeping my passwords in someone else’s cloud is a red line for me.

darknavi4• 5 years ago

If you're actually interested in a self-host option I implore you to fill this survey out for them:

https://survey.1password.com/self-host/

pearjuice• 5 years ago

The only fear I have with 1password (or any password vault for that matter) is that one day they disappear or see great malfunction losing my data. The thought of having to reset my password everywhere is gut wrenching. Some accounts I don't even remember I have them yet sporadically use them. Losing all of it would be a problem.

djrogers2• 5 years ago

I've been a happy user for over a decade (with a little break in there when I relied on iCloud Keychain), and happily transitioned to the subscription model when it came out. Frankly, it just made more sense - I use it on a ton of different devices, and buying a standalone version for each one cost more than the sub does.

I'm also not worried about the Mac app moving to electron - I interact with 1password via my mobile or browser plugin 99% of the time anyway, so I just don't really care.

_dot__dot_7• 5 years ago

I'm also not worried about the Mac app moving to electron - I interact with 1password via my mobile or browser plugin 99% of the time anyway, so I just don't really care.

The main 'customer benefit` claim for the electron switch (as opposed to the 'developer benefit') they are pushing is 'consistent UI across platforms` so your view exemplifies that, at best, there is really no customer benefit to the switch.

vbezhenar• 5 years ago

I'm considering to buy macbook soon and I was thinking about moving from KeePass to 1Password, as KeePass sync between Linux and iPhone was not very nice, but reading those news I'll keep using KeePass. I hate subscription software and I'll avoid it whenever possible. Also $3/month is just too much for such a simplistic service.\

Edit: if it's an electron app, my comment does not make sense, sorry, I'd never buy it anyway.

dschuetz2• 5 years ago

Oooh, I see, my passwords are far more securely secured in The Cloud then?

How do they plan to stay in business? "We have your passwords now! You would not want to lose them unless you agree to our new pricing policy now, would you?"

fortuna8614• 5 years ago

"Our prices have gone up, you don't want to lose access, do you?"

dschuetz2• 5 years ago

This is exactly what happens with Office 365 now lol

sam0x17• 5 years ago

There's nothing better for orgs right now. Every startup I know of uses it heavily internally. 1Password is here to stay, though this opens up the market a bit for a free competitor or open source project to come in and really disrupt things.

rkagerer2• 5 years ago

Between this and the Electron news, is Troy Hunt (haveibeenpwned creator) still going to endorse 1Password as his recommended password manager?

arepublicadoceu3• 5 years ago

Well, it would be really strange if he didn't endorse his sponsor.[1]

[1] https://www.troyhunt.com/have-i-been-pwned-is-now-partnering...

rkagerer2• 5 years ago

More recently, he also joined their board of advisors last year[1].

Have a TON of respect for the man, just a little surprised/disappointed these recent moves happened under his watch and would love to hear his unedited take on it all.

[1] https://www.troyhunt.com/ive-joined-the-1password-board-of-a...

arthur_sav2• 5 years ago

Next "feature".

We'll scan your passwords so we know you're know a terrorist

wink wink

politelemon• 5 years ago

That should fit perfectly into the iphone ecosystem. (considering the recent scanning news)

0x000000001• 5 years ago

They already do this, it's called Watchtower

https://support.1password.com/watchtower/

arthur_sav2• 5 years ago

Yeah but it was opt-in and you could have local vaults only. Not anymore...

donohoe2• 5 years ago

I love 1Password but the subscription-only path doesn't sit well with me. They're intentionally removing key features so they can justify providing a service that I can do myself.

I'm increasingly sick of good standalone software suddenly moving to this model. They are a business, I get it.

However how many subscriptions are we going to have to end up with?

I get it with Slack, Dropbox, Github, etc as they all started with infrastructure to run. But 1Password (and Adobe and others) are pushing profits far far above their users. It's a shame.

berdon• 5 years ago

I agree with these sentiments. I love 1Password and pay for a subscription. But this post is simply trying to gussy up their subscription-only move for maximizing MRR. Call it what it is - don't lie about it by saying you're only doing it because "everyone loves our monthly subscription service".

runlevel12• 5 years ago

The gaslighting also makes me very uncomfortable:

The overwhelming majority of people (97% in fact) choose to subscribe to our new service and many of those who initially purchased a license later changed their mind and traded it in for a membership.

With each of the last two versions, they hid the standalone version more. I'd hardly characterize all 97% of those users as voluntary.

Their PR doublespeak isn't helping either: https://news.ycombinator.com/item?id=28143821

I don't think I can trust this new AgileBits.

judge20205• 5 years ago

I think it depends on how they got 97%. They hide the standard version on the website, but the specific picture they show in-app[0] is pretty clear about the license option, so if it's 97% of people choosing the subscription via that screen i'd believe them.

0: https://com-agilebits-users.s3.amazonaws.com/dave/1password7...

iamdamian2• 5 years ago

Adding to this, they've also left showstopping sync bugs in the standalone version, and the customer support team uses this as a reason to push people to switch to the subscription service.

They were also giving away subscriptions for free for quite a while to get people to move.

So yes, I'm with you in questioning the number.

rockbruno• 5 years ago

I'm one of these people. I didn't even know there was a non-subscription version when I bought it.

TheRealDunkirk3• 5 years ago

However how many subscriptions are we going to have to end up with?

I started making a list to answer that question myself. So far, I'm up to SEVENTEEN, but I'm sure I'm still overlooking a few.

donohoe2• 5 years ago

I remember dropping cable cos of the costs and now we all have 2-5 streaming services we pay for...?

lwhi2• 5 years ago

I've been using it via subscription for some time. Really happy with it.

To be honest, I didn't know it supported local vaults.

Shihan2• 5 years ago

Switched to KeePass when they introduced the subscription model. I believe the only app that I tolerate as subscription is Lightroom CC. I want to minimise subscriptions because otherwise it is 5$ here, 10$ there and at the end it can be a surprising amount I have to pay each year. But yes, for some apps it may be worth it, but for 1Password I found suitable alternatives.

0x49d1• 5 years ago

What subscription model? KeePass has no subscriptions, just local exec app.

bostonpete• 5 years ago

Pretty sure they're saying they switched to KeePass when 1Password introduced the subscription model.

dang• 5 years ago

Ongoing and related: 1Password for Mac Moving to Electron - https://news.ycombinator.com/item?id=28143563

Recent and related: 1password is considering a self-hosted option to store vaults - https://news.ycombinator.com/item?id=28104134 - Aug 2021 (215 comments)

aborsy2• 5 years ago

Keepassxc with Dropbox works good and is super secure!

It accepts Yubikey, is open source, has good reputation and is free.

But please donate. Developers spend a lot of work on FOSS of all kind.

mooman219• 5 years ago

KeeWeb + KeePass + Dropbox gave me everything I needed to emulate 1Password, and I definitely recommend that stack if you're greatly opposed to this 1Password change.

That being said, the thing that got me to change was when I tried out 1Password for a month and ran into a few minor accessibility issues on their web frontend. I sent a support ticket and very quickly got a response back, was told those issues would be fixed, and then notified me several days later when they were. Like I'm paying 2.99 a month and still received some amazing support. I use a lot of open source projects, and if I have an issue then I try to upstream a fix because the maintainers are usually volunteers, but I've spread myself thin. 1Password gave me the impression that it's in good shape and has great support which was a burden off my mind.

mvid• 5 years ago

Oh well. I've been a 1password user for maybe a decade. I don't mind paying for a subscription, but they have become increasingly user hostile over time. Pushing the in-browser versions of the product, hiding the steps to enable local vaults, and now removing local vaults entirely.

Custody of your secrets is something thing a password manager should move away from, not toward.

I moved my data to Bitwarden this morning.

TheRealDunkirk3• 5 years ago

I've stuck with 1Password for a long time, because it will work on the occasional Windows machine I need to use. However, it doesn't integrate as well as Apple's native key manager. I've been on the fence about just giving it all to Apple, but it's, like, the one thing out of literally DOZENS of services that I use that Apple does NOT control, and it's kind of important. So I'm really conflicted about the whole thing.

jamil7• 5 years ago

Considering the same but keychain always feels kind of like it’s forgotten about with one person in a dusty basement at apple working on it. Importing is weird and convoluted and requires some third-party scripts. I don’t get why they don’t just leverage their unfair position and access to private apis to make a really polished first party password manager.

latortuga• 5 years ago

I love 1Password and I'm happy to pay a subscription so they can continue to run a useful service! Thank you 1Password team!

evanb• 5 years ago

Also a stand-alone user since 1pw4. This news finally got me to try pass, the command-line utility.

https://www.passwordstore.org/

The format is plain text. You can git control your password repo. You can organize into directories, etc.

It has an extension architecture; you can have it generate otps, for example. You can have specific passwords unlock with more than 1 key, if you want to do eg. family or business sharing.

There are mobile apps, browser plugins. None as smoothly polished as 1pw, but good ENOUGH. There are (imperfect) tools for migrating, but you can write your own scripts.

So far (using it for 48 hours) the worst part was setting up a gpg key.

stuzenz• 5 years ago

I was reading through the comments wondering why so many technically capable people are paying for a password store service when passwordstore works nicely in the space and gives you some comfort in knowing how it works.

I highly recommend pass.

My set up is as follows:

- setup the key, share the private key to other devices who are going to use the same pass store;

- use syncthing to sync my passwords between devices (you can use github - but I just find it works nicely with syncthing;

- all passwords and other content are just gpg encrypted text files;

- use the pass cli utility to read the passwords;

- first line of the text file is the password so the apps and cli will read that into the clipboard (with a time limit to expire if you are on your phone;

- for android phones/tablets I use 'openkeychain' to manage the key and 'password store' as the app to read the encrypted text files and copy the passwords;

There are other browser extensions etc. I just don't find a need to use them though.

It has worked well for me over the years while I have seen the passwords market go more towards a subscription model over time.

My wife uses the same system, I just set it up for her and then it is seamless for her as well.

https://www.passwordstore.org/

vinceguidry2• 5 years ago

I really wish they'd offer other encryption backends than gpg. GPG is pretty long in the tooth. I never have problems with pass, all my problems are with gpg.

seqizz• 5 years ago

I also use and love pass on desktop, even with syncthing and browserpass, all perfectly working. But I am using yubikey to hold my key and that makes it not a good match for mobile setup. Also last time I tried, the mobile apps mentioned were not so easy to use, so I gave up on that front.

e_proxus2• 5 years ago

For me it’s more about trust. I’d rather trust a company with decades of experience this area than a bunch of random developers that published different unvetted apps on various app stores.

And technically, Syncthing doesn’t really seem viable on mobile last time I looked (and also has the problem of 3rd party apps instead of official ones).

j7ake• 5 years ago

I have been using passwordstore for several years now and I wouldn't be able to go back another product, even if other products were free.

Note that the private git repo can be uploaded to the cloud, which allows one to access passwords on multiple computers as well as on my phone.

Also I would like to highlight qtpass client for a very user-friendly GUI interface to quickly access passwords.

In my opinion, anyone that has basic knowledge of the terminal should be able to set up passwordstore no problem. Once it is set up, one can use qtpass or other GUI clients.

Zizizizz• 5 years ago

I've been using it for over two years, I absolutely love it. Check out pass-otp as well as rofi-pass (if on Linux) as I think it's the best way to have password entry on any computer. It sends the keystrokes so I can paste passwords in nested virtual environments where an extension might not be installable

salutis• 5 years ago

Another happy user of “pass” here. The program integrates with Emacs, Firefox, Unix, and Git like butter. No need for any clouds or services. ;^)

ramesh312• 5 years ago

Maybe I'm missing something here, but I've never understood the value of any of these password services. How can it possibly be more secure to have your entire digital life hackable with a single cloud based point of failure? Surely it's safer to simply use an encrypted text file on your local PC.

jl_agilebits17• 5 years ago

Hi. I'm a features developer for 1Password. You raise a very good question (one that I used to have myself, before I started working here). I would recommend you read our security whitepaper (https://1password.com/files/1Password-White-Paper.pdf) if you want details, but the TL;DR is that we don't know your account password and our servers only store your encrypted information (which we cannot read), and communication is done over HTTPS with an additional layer of encryption via the SRP (Secure Remote Password) protocol. You also might enjoy this blog post: https://blog.1password.com/what-if-1password-gets-hacked/

Mindwipe6• 5 years ago

I read the paper when it was published, and wasn't great then and it's definitely not great now.

ramesh312• 5 years ago

the TL;DR is that we don't know your account password and our servers only store your encrypted information (which we cannot read), and communication is done over HTTPS with an additional layer of encryption via the SRP (Secure Remote Password) protocol.

I understand that my data is safe with you guys at rest. I'm sure your security protocols are top notch. But it's all about attack surface. Things can and do go wrong on the internet all the time. Bits get flipped, certs expire, DNS cache gets poisoned, employees get phished, and MITM is an omnipresent threat. I'd just rather avoid all of that.

nicolas_t2• 5 years ago

Well this is the end of the road for me with 1password. I refuse to use anything that doesn't have a local vault. The potential damage if my vault is somehow is accessed is too high, if the vault is stored in the cloud, how can I verify that no one can access it? In that case I have to give access to this app with little snitch since it relies on internet access which means that if I received an update that would disable end to end encryption, I would be none the wiser.

Granted, the chance of attack is small but the consequences are extreme. There's no single file more valuable on my computer than my password vault.

I prefered buying the license compared to the subscription but I don't particularly mind a subscription for a service I use regularly. I mind the risk to my privacy.

yunesj• 5 years ago

the chance of attack is small

Is it? I would be surprised if attacking 1Password wasn’t a priority for governments and hackers. If the encryption used on vaults is ever broken, compromised, or buggy, users are screwed.

perryizgr82• 5 years ago

They don't have to break the vault encryption. They just have to gain access to 1pwd's git and push out a compromised update. And then watch the passwords roll in automatically.

mberning• 5 years ago

Done with them. I have been holding out on 1Password 6 for years. The fact that you can’t get the safari extension without going to 7 has had me considering moving for a while. Now it is without a doubt that I will be migrating to bit warden or something similar. Another great product ruined.

account-52• 5 years ago

What am I missing with these paid/subscription services?

I personally use KeepassXC (Linux/Android). It's shared via cloud, I have a keyfile off device so I'm satisfied it's pretty much completely locked down.

Is it browser integration? Genuinely have no idea why I'd pay for this, or why I'd trust a company with my passwords especially when it's not local.

caymanjim2• 5 years ago

I wouldn't use any password manager without browser integration. It's the single most critical feature to me in a password manager (ok, beyond secure storage/access). I haven't looked at Keepass lately, but unless it has a browser plugin and automatic sync between all devices (multiple computers, phones, tablets) without me having to roll my own sync solution, it's a non-starter for all but the most hardcore geeks.

account-52• 5 years ago

Fair enough, KeepassXC does have an official browser plugin, at least for desktop. Never use them myself, separating responsibilities.

Personally I don't think Dropbox/Google drive is rolling your own and works for me.

caymanjim2• 5 years ago

Is there a single reason to use 1Password instead of Bitwarden? Bitwarden has a better UI, supports all the same platforms (including browser plugins), lets you easily manage true separation between profiles (unlike 1Password, which essentially forces you to use a single master unlock for say work and personal), and most importantly, lets you self-host. And it's free. 1Password is consumer-hostile and an inferior product.

selykg7• 5 years ago

I would not say Bitwarden has a better UI. Though I guess that's an opinion thing, but oof, is Bitwarden's UI bad. It's almost actively painful to use for me some days. The extension isn't as bad as the desktop app, but the iOS app is absolutely atrocious.

I still use it because I'd rather pay $10/yr instead of $36/yr. But I wish Bitwarden would take some time to actually make the app not awful in the UI/UX department.

smoldesu• 5 years ago

And now that we’ve started to roll out the next generation of 1Password apps, it’s time to say goodbye to standalone licenses.

Well, that's the end of my interest then. I had some curiosity after seeing the Rust integration, but I'm not going to pay a subscription fee to sync the smallest part of my day-to-day life. The convenience really just isn't there for me in a subscription. And no local vaults? Double no, please.

politician• 5 years ago

I've been looking for a reason to switch to gopass completely. Thanks AgileBits!

rgovostes2• 5 years ago

Scott Forstall, who led iOS until 2012 and oversaw the creation of the App Store, once said that he installed a new app every day to see what new ideas developers were coming up with.

The mass migration of apps to the subscription model has killed this sort of exploration and discovery of new apps. As one example, I recently looked for a flight tracker and many wanted more than $30/yr for a tool that is (to me) an occasional convenience.

I worry less about how much I pay to use an app than how much I'm paying when I'm not using the app. It sucks when I'm too busy to use my language learning app and yet somehow I still end up owing the app developer every month. By the time I end up canceling I might have wasted $60 or more, which certainly doesn't motivate me to install the next app that prompts me to subscribe.

I don't know the solution to adequately compensate developers for their work but I hope the subscription mania goes away.

jackson1442• 5 years ago

I think the model needs to go back to paying for updates/support. Would be great if this was a native behavior on mobile app stores as well (you can kinda do this with Bundles on iOS but it's still kinda hacky).

Haven't paid for this software in the past 365 days? Go to the community forum. You can pay 60% of the license charge for another year of updates and support.

shapefrog2• 5 years ago

Developers used to be motivated to release the next versoin and make you buy their app all over again. The upside is now you dont have to buy a bunch of applications for $120 (a year if you always want the latest version) and you can just pay as you go. But like you I have had a few subs that ran over and now I avoid where ever possible.

Adobe were the last to annoy me, previously I am sure I had paid up for a few months and then unsubscribed. Now its a 12 month commitment when you take out a subscription.

Off topic; but if you want a flight tracker, and like to tinker, try feeding flightradar24 (or any of the other), while you feed them you get their full membership. A pi and a usb tv card are all you need to get started!

GekkePrutser2• 5 years ago

Or better: support adsbexchange.com instead. They don't introduce the delay that flighttracker24 do and they don't hide military and business jets. They're really non profit.

des1nderlase• 5 years ago

I don't know the solution to adequately compensate developers for their work but I hope the subscription mania goes away.

There are ways, but nobody seems to bother to provide usage-based model. Similar to how cloud providers figured multiple usage plans. I have a feeling that many apps live off people paying but using service really low, so there is no incentive. What's stopping them to offer a different price for 1h - 5h monthly access? They could upgrade to a flat fee automatically if you start using their app every day.

rgovostes2• 5 years ago

Microtransactions were a big craze at one point. I suppose if my my package tracker cost 25¢ per package, I wouldn't be too upset. My ad blocker tells me it blocks about 25,000 resources per month, maybe $0.00005 per ad?

farmerstan• 5 years ago

I have the last non-subscription version on my Mac, PC and phone. They sync through Dropbox.

The chrome extensions stopped working a few years ago so I got into the habit of just manually searching, cutting and pasting my passwords, and saving new ones. I don’t even think about it and it’s very easy. Paying $3/month to have it automatically populate the user name and password fields isn’t worth it for me, especially when the browser does this pretty well once you input it the first time.

jakemauer• 5 years ago

The main 1password extension for chrome stopped working with the standalone app, but the original extension is here under a different name: https://chrome.google.com/webstore/detail/1password-extensio...

I use it dozens of times a day and it works great. It's not as nice as the modern one that works with the subscription/hosted service but it'll certainly be better than what you're currently doing to muddle through.

fortuna8614• 5 years ago

They cut off Brave support but it still works in Chrome on Macs. Just a matter of time before all browser support is gone.

dfdz• 5 years ago

This worked well for nearly a decade but by 2013 the cracks were already showing. By then we had client apps for all platforms, with each one requiring their own separate purchase, often across multiple app stores. And paid upgrades to major new versions were so incredibly painful for everyone involved that we rarely had any.

I think they are being fairly transparent. Starting in 2013 there old business model stopped making sense. They were selling individual products for each platform, while trying to integrate all platforms at the same time. The natural solution was to move to a subscription model for a unified service. This provides a mutli-platform solution and generates a continuous stream of income.

As a consumer, I actually prefer this model for a security app since it means that it will continue to receive regular updates. There is lots of competition in the space of password managers so I am not worried about them increasing the cost of the service to more than a few dollars a month (if they did this I would just switch to another service).

mapgrep• 5 years ago

I think one of the best things the U.S. government could do would be to buy and nationalize 1password and give everyone a license. Canadians too, since it was one of your companies :-)

I am being intentionally outrageous but do genuinely feel that a good password manager is foundational to good digital security and I find it baffling that it does not come bundled with operating systems or in some other way offered for free. It's such a basic thing that could be done to increase collective resilience to digital attacks.

(And if 1password doesn't want to sell there should be funding for an open source equivalent with a default server hosted by either the government or a trusted nonprofit.)

Barrin92• 5 years ago

or in some other way offered for free

bitwarden is free (and open source) and it has just about every feature that the paid ones have. Sync across devices, desktop and mobile clients, notes etc. One of the best pieces of open source software of the last few years and I have no idea why people are paying subscription fees.

Osmium• 5 years ago

I appreciate the need for them to do what's right for their business, and that the HN crowd is probably not representative of their broader customer base.

With that said, they've lost a customer here. I would prefer not to pay a subscription, but I might have (though if you do the math, I've had paid upgrades frequently enough I'm not sure they'd have made more money off me with a subscription).

The sticking point is the lack of local vaults and removing the native app. Very disappointing.

The reason I used 1Password to start with and not KeePass was because it was Mac native. It is so deeply depressing to have faster and more efficient computers year-on-year and have all that efficiency wasted by moving to Electron apps. It sounds absurd to say, but there's a real ecological cost to less efficient apps too; it really does add up in aggregate.

The lack of local vault is the ultimate deal breaker, not because I think 1Password are untrustworthy, but because I'm reassured that I don't _need_ to trust them in the same way with a local vault as I need to if they're hosting the vault themselves.

I think what's most disheartening about this is that the customers who dislike this the most are also likely the customers who've been with them the longest and helped them build their business. I know I've been using 1Password since v2.

Given that password management is so central to our daily productivity, jobs, personal lives, I'm not surprised people have some very strong opinions about this. I hope the 1Password management read these threads, but I doubt it.

I will stick with 1Password 7 for as long as I'm able.

lycopodiopsida2• 5 years ago

I am a subscriber, an I was a standalone customer before. I've tried to self-host bitwarden-rs, but found the UX and browser extensions being subpar - and I want my wife and parents to use a password manager, too.

It runs well. However, I do not thrust their cloud (or any cloud) completely. I still have a local vault, which is synced locally on WiFi with passwords to my router, NAS, bank cards and accounts, mail accounts. The idea is that should there be a breach at 1password.com the critical accounts do not leak and the damage is limited.

Edit: Local vaults are not available anymore: https://1password.community/discussion/121638/what-is-the-fu...

I have to look for another solution, then. The all-in-cloud bullshit is not acceptable.

jlhawn• 5 years ago

I'm seeing a lot of "I could do this myself" in this thread.

Okay. Then do it.

Make your own password manager. Make your own browser and iOS/Android keyboard extensions for it. Make your own cloud backup/sync of your encrypted passwords.

Do it.

stakkur• 5 years ago

Bitwarden.

aphexddb2• 5 years ago

Like many others this feels bad to me. I was previously forced to upgrade to 7 so the Chrome extension worked and as a result purchased (again!) separate Windows and Mac desktop licenses. In trying to navigate the site to find out how to buy a desktop only client I encountered the multiple dark patterns to make this nearly impossible. It is no wonder that “97% of people prefer the subscription” since standalone was basically hidden. I love the product experience 1Password provides, I simply prefer managing my own vault (via Dropbox). Based on feedback here I’m going to evaluate Bitwarden. Sigh.

darknavi4• 5 years ago

Please, if you haven't already, fill out this 1Password survey. They are considering self-hosted vaults but want more data on who/how it would be used:

https://survey.1password.com/self-host/

Hopefully they will get the picture.

aphexddb2• 5 years ago

Thank you so much for posting this link! I had no idea there was an avenue for product features.

evo_9• 5 years ago

Obligatory BitWarden link: https://bitwarden.com/

A good open-source alternative, I've been running it for a few years after I grew tired of 1Passwords shenanigans.

Mindwipe6• 5 years ago

Well that's the end of me using one password.

Trying to buy 1password 7 with a local vault was literally the most miserable software experience I've ever had in decades, so I'm not surprised not many people were using it.

Crontab• 5 years ago

I really dislike subscriptionware. I don't want to depend on software that I might lose accept to if money gets tight.

tommypalm• 5 years ago

I gave up with 1Password around version 7 because of the push for subscriptions and switched to Secrets (Mac and iOS) - https://outercorner.com/secrets-mac/

kup04• 5 years ago

I am a 1PW subscription user and am happy with the product (however, seeing they are moving to Electron means that is very subject to change...)

but

Saying that "customers voted with their wallet" and chose subscriptions is disingenous

Ever since they've had subscriptions they've made the standalone license page extremely difficult to find on their site. They really didn't give regular users a "choice"- they dark-patterned them into thinking subscriptions were the only option

As forthcoming / down-to-earth as these posts from the company seem- they are full of spin. Their impossible-to-find standalone license page is a topic they seem to be avoiding.

Edit to add this small addendum: It just really bothers me on an emotional level to constantly run into this juxtaposition as a user of software/hardware: liking a product but being extremely disappointed in the company offering it.

dvcrn• 5 years ago

I fully agree. Been a standalone user for years and a coworker asked me recently how I got the standalone license because he didn’t think it existed anymore.

Even with me knowing it exists, I wasn’t able to find it on their site to send him. (Hint: you have to upgrade within the app, but only if you downloaded from their website, and only if no 1p account or trial is present)

Add other dark patterns like the extension being 1PX only by default and doesn't work with standalone. You have to cram through their website to find the legacy extension and even that isn’t straight forward. They tried very hard to hide all info of a standalone existing.

(Personal annoyance: locking new features like the redesigned autofill overlay to the subscription-only version even though the Safari extension fully supports it for standalone, but not the others.)

hakcermani• 5 years ago

Agreed! Also a standalone user for years. (have about 400 passwords and security Qs in 5 vaults). Can even live with subscription (its just forking out a few bucks more), can even live with electron - at least a Linux client will be avaialable rightaway, but why no local store, Dropbox sync was working perfectly !

kup04• 5 years ago

Yes I also ran into the legacy extension issue. The site was confusing as hell, and it seemed purposely so

PragmaticPulp3• 5 years ago

Saying that "customers voted with their wallet" and chose subscriptions is disingenous

Honestly, I wouldn't mind paying a reasonable price for the 1Password service if it wasn't a step down in value from what I had before.

I have a slightly older version of 1Password and it works fine for my purposes. I've been holding off on the subscription transition because I would derive zero value from switching to subscription but I'd gain a monthly payment I didn't have before.

But the thing that irks me is the PR speak that is trying to spin the subscription change as something we, the customer voted for, when they've gone out of their way to force everyone into subscriptions and hide the standalone version. I know the standalone version of 1Password 7 exists, but I tried to find the price yesterday and gave up after a few minutes of poking around.

"We didn't choose this, you chose this!" is so distastefully dishonest that I have zero desire to engage with this company any more. Once my standalone license of 1Password 6 stops working, I'm upgrading to a competing product.

dkonofalski9• 5 years ago

It's not dishonest. When they launched the service at 1password.com, you could choose which one you wanted when you downloaded and purchased. When they say "you chose this", they're referring to the time when that was on their site and people overwhelmingly chose the subscription. They posted this on the forums after the first year and made a pretty big deal about it and now everyone is acting like they did this in secret. It's in the release notes, it was on the site, and it was in the forums. I think they may have even emailed it to people at one point (I've been a user since v3). To say they're being dishonest is not true.

dkonofalski9• 5 years ago

I disagree. When the subscription service came out, they very clearly offered both options side by side and the boxes were the exact same size, had the exact same button to proceed, and the same coloring. You were given a choice.

Starting with 1Password 7's beta, they "hid" the standalone option on the site and then removed it completely and only allowed for purchasing standalone versions through the app itself but that was announced prior to them doing it.

kup04• 5 years ago

Maybe it was a timing thing, but I strictly remember it being different than how you describe here

The only way I even know a standalone option existed at the time that I moved to 1PW was because of reviews/comments on other sites that then led me to support pages that said "oh yeah, if you still want that version, smirk smirk, then use this special link"

drcongo2• 5 years ago

It was hidden long before the 1P7 beta.

judge20205• 5 years ago

0: https://com-agilebits-users.s3.amazonaws.com/dave/1password7...

RayVR• 5 years ago

I purchased a 1Password license years ago. I knew when I bought it that major version upgrades were not included and my feeling was that I would rather have a subscription so I could just seamlessly upgrade when new versions arrived.

Ever since they released the subscription option my upgrades have been very smooth and the features and improvements keep coming and I don't have to actively go and upgrade/purchase a license for a new version.

I don't know how to feel about switching to electron. I have many applications that are electron based and the quality is generally high but some do cause significant memory pressure on my macbook air.

sleepybrett12• 5 years ago

As a standalone user that uses dropbox sync. I have had 0 problems upgrading from 3.x all the way to 7.x.

akkartik• 5 years ago

The iron law of software products: like the product -> dislike the company offering it -> dislike the product.

justinph• 5 years ago

I've been a happy user of the same version of 1Password 6 for many years, the last non-subscription version. It still works on MacOS Big Sur, and the classic extensions work in Firefox and Chrome (though not safari on the mac). When it stops working, I guess I'll have to look elsewhere.

xanaxagoras4• 5 years ago

The hits just keep coming. First I have to move off the apple ecosystem, now I have to move off of 1password.

fortuna8614• 5 years ago

It's so frustrating. The privacy company and the security app are the betrayers.

therealmarv• 5 years ago

KeepassXC + use your internal browser password manager. Never pay again and comfortable (and secure) on desktop and smartphone.

fortuna8614• 5 years ago

Does Keepass have 1P import and 2fa code output functions ?

frugalmail• 5 years ago

Migrated from 1Password to Bitwarden, much MUCH happier.

stanislavb• 5 years ago

Due to forcing me into the Subscription model, I migrated to Bitwarden recently and never looked back. It’s been working flawlessly for several months now.

bromuro• 5 years ago

I subscribed because I had to. I have no time to follow the last changes of a company and its app.

The current app is already bloated by features I don’t use, so I hoped for another evolution of this software.

(i also don’t like the web platform with all those emoji and cheesy design)

kabdib• 5 years ago

Three bucks a month?

They just committed suicide.

KiDD• 5 years ago

I absolutely hate that it moved to subscription and have since migrated completely to Apple iCloud Keychain since it now supports OTP 2FA.

js2• 5 years ago

For folks looking for a pay-for-it-once app with Mac, iOS, Android and Windows clients, that can sync via Dropbox or Webdav:

https://www.passwordwallet.com/

I've been using this for probably a decade now. The UI is ugly as sin, but it works well. I use the Apple Keychain for almost everything, but for my critical passwords, I have copies in PasswordWallet.

PasswordWallet has one feature on macOS that I've not seen in any other app: auto-type, for those times you can't paste into a password field. I use it rarely, but it's nice to have when I need it.

(I have no idea if the Android or Windows clients are any good. I use it only on macOS and iOS.)

fortuna8614• 5 years ago

For folks looking for a pay-for-it-once app

That's what the folks at 1P told us all too..

lowbloodsugar• 5 years ago

I am fine with the subscription but I need local vaults. That said, macos has been making 1Password less and less differentiated, so guess I wont be renewing my subscription.

tuxone3• 5 years ago

Got 1Password 6 full license for OSX and loved it. Of course I bought also the Android app. Then switched to an iPhone and bought the app again, peanuts. Then I had to start using again PCs and bough the windows full license for 1P 7.

I still use 1P 6 on macOS even though the missing support for Safari sucks (that actually made me switch to Firefox!)

My point is, there is literally zero added value with the subscription, it’s like buying cars with loans, in fact by buying full licenses I saved money.

I hope that 1P 6 and 7 will last me as long as possible, I don’t see any alternative at the moment. IMHO all other options are less secure and/or less convenient.

dkonofalski9• 5 years ago

there is literally zero added value with the subscription

Hard disagree. Any security-focused software will have plenty to keep up with between OS changes, browser changes, site changes, new UI patterns, and even simple bug-fixes that you don't get from single purchases.

tuxone3• 5 years ago

1P 6 running pretty well on last macOS makes your statement wrong.

The fact that you pay a monthly fee doesn’t guarantee you anything you described. In fact there are plenty of feature requests that 1P team has just ignored over the years.

Not only there is no upside but actually the missing local vault is an horrendous downside.

nreilly• 5 years ago

With the Apple iCloud Keychain supporting one-time (the google Authenticator style) passwords from the next major Apple OS release, I have no reason to continue to use 1Password.

_zzaw• 5 years ago

Well—that’s it for me, I guess. Used them for years, but I’ll switch to the standard Apple password manager.

I believe in buying my software once. Not monthly.

deadpanPotato6• 5 years ago

They said that 97% of their users are already on subscriptions. I get that local vault users are disappointed, but there's an app for you and it's called Bitwarden.

I think 1Password made a smart business decision. By cutting loose the need to support local vaults, they can focus more development energy on other things that 97% of their users will appreciate. It's a numbers game.

That said...Electron? Ugh. I already spend half my day grumbling about the Slack app.

tuxone3• 5 years ago

This is a slap in the face to all of their long time customers. To me it looks like a risky decision more than a smart one. Note that new customers just go the subscription path because that is the only option advertised.

_dot__dot_7• 5 years ago

They said that 97% of their users are already on subscriptions.

It is quite obvious from the response here that 97% of their users who are actually paying attention to these issues are not on the bandwagon. They should rephrase it as "we could fool 97% of our customers into switching after years of misdirection and misinformation".

almostdigital• 5 years ago

I've been buying licenses since version 3 (2013) even after they started to hide the option.

Sad to see 1Password use dark patterns to push people towards subscriptions then twisting that into that people don't want licenses, at least be honest about it.

+1 customer lost.

benguild• 5 years ago

Ugh

kgarten• 5 years ago

Apple user for over 20 years. I loved my powerbook 4g and loved the first iPhones. Even though they were not the first mobile nix systems (love for the n770 Nokia tablet with Debian and root!).], I felt empowered being able to hack them easily, getting shells running and recording/analyzing sensor data on them.

I feel more and more uncomfortable in the Apple / iOS ecosystem. It’s getting closed down and commodified. Even when there is something cool in terms of tech, they know how to spoil it.

Instead of dealing with Pegasus head on and starting to fix the security culture of iOS/Mac, they make our systems less secure (less open and less hackable).

I find it sad that there are no viable alternatives for non-tech users. I switched last week to a Librem 14 with Arch Linux, KeepassXC and a pixel 5 running grapheneOS, Miiband 6 with GadgetBridge, a System 76 for work. I honestly love it, there are some hiccups, yet it feels exciting, similar like switching from Microsoft to Apple did 20 years ago.

Also moved from programming objective c / swift to rust, elixir and flutter/react. That seems where the innovation happens today for me. As I work in research I have the Privilege to easy switch … we need better alternatives and I feel even stronger about supporting open source and projects and companies that care about it (pine, purism, system76, mozilla, …).

Khaine• 5 years ago

This is disappointing. I have been using 1Password for a long time. I'm not opposed to the subscription model per-se, particularly for critical software to ensure it is supported.

But I don't want or need my passwords in the cloud. I don't want or need it to be an electron app. I want a simple, lightweight, highly secure, with good UX password manager. 1Password used to fit that bill. With each successive change it moves away from that.

sleepybrett12• 5 years ago

fuck these guys. seriously.

I've been using this product since 3.x. I chose it because I could use a wide variety of syncing solutions. It did what it said on the tin. Gave me a place to store my passwords that was secure.

I was a happy user buying upgrades whenever they came out until 7.x where it took me over an hour to figure out how to buy the non-subscription/cloud version and instead find the link for the standalone version.

I paid for versions that I honestly didn't have any features I cared about simply because it kept doing what I wanted it to do.

Gone are the days when you can buy a hammer, and use it to hammer just as many nails as you like until it breaks. Now we have to rent a goddamned hammer apparently. Even that wouldn't be so bad if I could still keep my passwords out of their cloud provider.

They've fucked up, they don't think they have.

So what are the options for someone who just wants a simple place to store a bunch of passwords encrypted in a secure way. With decent clients for ios/mac/windows/linux that lets me be the only person who has their hads on those encrypted bits?

ashton314• 5 years ago

I hear good things about Bitwarden.

https://bitwarden.com/

fortuna8614• 5 years ago

I spent an hour setting it up, the export worked well from 1P but you get to the very end to find out that "features" like a functioning F2A code generator or image storage are premium features that require, guess what, a subscription.

Damn it. It's only $10 a year but i'd rather buy it outright the way 1P allowed me to in the past.

canadaduane2• 5 years ago

I feel like Buttercup [1] doesn't get enough attention. Open source, available on all platforms, and has imports from multiple other password managers. If several people offered a small monthly donation for some time, we'd all be in a more competitive situation with password manager companies whose interests drift from our own through time.

[1] https://github.com/buttercup/buttercup-core

joelkesler• 5 years ago

This is terrible news. I am thinking the push to subscription related to their recent fundraising round.

I am happy paying upgrade price for each new version of 1Password but I hate the idea of a subscription.

Dropbox syncing works well for me.

1Password has done almost everything they can to stop people from using the standalone version. I am disappointed and angry.

brailsafe• 5 years ago

I'm chillin with 1Password 4 or something. Presumably some MacOS update will break it due to their use of some hacky undocumented API (like Omnifocus2) but until that day comes I'm quite happy syncing to dropbox. I don't like the insecurity of having to pay for something that stores critical data on an ongoing basis. If it's optional, I can make that choice. I do also like a native mac experience.

That said, I'm sure a lot of people value their current offering for a variety of reasons, and it obviously makes good business sense. I've been burned by subscriptions in the past though, and I don't want to deal with that again if it can be avoided.

Valkhyr2• 5 years ago

Well, f** 1Password then.

I am currently still using them, but once my current apps are no longer supported, whenever that might happen, I will move to another solution rather than paying a subscription for the privilege of storing my data with them.

MindTooth• 5 years ago

When we talk about local vaults, does that also include iCloud?

MarcysVonEylau• 5 years ago

Just use Bitwarden...

paulcarroty• 5 years ago

I'm using PasswordSafe probably last 2 years and happy with it. Open source, multiple vaults support, good UI, easy click-to-copy after search query. https://gitlab.gnome.org/World/PasswordSafe

system2• 5 years ago

God bless KeePass with sFTP plugin.

gspr• 5 years ago

I'm still baffled why anyone on HN would be using anything other than https://www.passwordstore.org/

A dead simple (in the good sense!) CLI program that lets GPG deal with encryption and git deal with synchronization and distribution. It's perfect. And FOSS, of course.

You don't even have to run your own internet-facing git repo for synchronization across devices. You can just put it all on GitHub or whatever.

sqldba• 5 years ago

I like 1Password so much I don't mind paying for a subscription. But I have to draw the line at no local vaults because there's no other way to keep work data separate without violating company policies.

peterkelly• 5 years ago

Every so often one needs to go back to the drawing board and rebuild things completely in order to soar to ever greater heights.

No you don't. When you have an awesome product that people love, you just fucking leave it alone. These "rebuilds" always make things worse. See also: Spotify.

antioxidant• 5 years ago

I’ll switch to Bitwarden! Wait… Bitwarden is cloud only? Wait… Bitwarden doesn’t allow offline editing? Wait… Bitwarden has a self hosting docker which will end up using more RAM than an electron app?

Uh, I guess I’ll use KeePassXC then.

phs318u• 5 years ago

I recommend this every time a similar news item gets posted. Password Safe (designed by Bruce Schneier). I use the iOS and Linux apps and keep them synced via DropBox. Been around for years (I've been using it almost as long). Still getting updates. Still works.

https://pwsafe.org

rStar• 5 years ago

i don't see any real security model here. online only is insecure by design. Hopefully for customers who stick around the user experience continues to be first class, at least, but I have my doubts about that as well. I don't know anything about this company or who makes the decisions, but as a user, in my opinion, 1password used to make every decision in a way that I would have considered correct. 1password made good decision after good decision after good decision as they grew as a company over the years. Every decision was user and security focused, and the product was consistently excellent. those days are over, apparently. from my perspective, there has been a massive shift in company/product values since the shift to the subscription service. I wish them well.

aecrimus• 5 years ago

For somebody who's in the Apple ecosystem it seems to me that a password-protected Numbers file should suffice. Are there security implications that I'm missing?

8fingerlouie• 5 years ago

As others have said, i much prefer to keep my password vault and hosting of it separate.

Being forced into a 1P subscription feels like a downgrade to me. I've been a faithful customer for years, and have used iCloud synchronization for years as well. My entire household uses the app (through family sharing).

Self hosting it is not an option for me (i know how to, and that's why it's off the table), and purchasing a $5/month subscription feels like it's overpriced for what it delivers. I can get 10 months worth of Family365 subscription for what 1P is asking for a year, and that gives me 6 accounts with 1TB storage each and the entire Office suite.

The thing that seems to annoy people the most doesn't bother me one bit though. If it works i don't care if it's electron or not.

I'm instead evaulating Secrets[1] as a replacement. It requires a $20 in-app purchase to unlock full functionality, but even with 4 people buying it, it's still only 1,5 years of 1P service. For now i will try to get the kids to use iCloud Keychain instead.

As for "what's the rush". 1P7 will receive updates for now, until it doesn't, and at some point an update to MacOS or iOS will make it stop working, at which point i will have lost access to my passwords. I much prefer to be in control of when that happens :)

[1] https://outercorner.com/secrets-ios/

AwaAwa• 5 years ago

So ease of access is really the number one driver. Perhaps I'm just old, but I remember when security was never supposed to be easy. When easy, it is taken for granted, and therein lies the failure of security. So essentially this cloud model gives everyone the illusion of security. Probably nothing new, since its all theater at a certain point.

This is not to takeaway from all the technical details of 1Ps approach to this, but (once again) in light of what we have seen from the "Trillion $ darling of privacy", enabling scanning of personal content one has to wonder how long before the same is applied by 1P. Remember your vault can store just about anything. I am sure it is only a matter of time before the case is made that we must think of the children.

Irony of all this, I'm someone who is paid to migrate customer security to the cloud. Runs counter to my thoughts on the matter, but not those making the financial decisions on all sides. I certainly don't fault 1P for making the prudent financial decision that 95% of their customers have made. As part of the 5% I shall wring as much out of 1P7 as possible and eventually move elsewhere.

_dot__dot_7• 5 years ago

As far as I am concerned, this is a `bait and switch` tactic. It is unethical. And it is a surefire way to shoot oneself in the corporate foot and destroy customer trust.

Nobody who values security enough to use a password manager would leave their passwords at the mercy of the next corporate turnabout, when said corporation is evidently untrustworthy.

This is the same lizard-brain self-interest unleavened by any shred of higher brain functions that people like Shkreli exhibit: `the suckers have switching costs so let's jack up the price obscenely while reducing the actual customer benefits.` Some people should be kept away from MBA programs.

josephd79• 5 years ago

I switched to Bitwarden a long time ago. I pay for a premium sub now, should probably upgrade to a family plan @ $3 a month just haven't got around to it yet. Worth it.

fortuna8614• 5 years ago

The thing I genuinely don't understand, and I really hope a 1P employee can answer for me, if it's true that 97% of your customers are subscription and have online vaults, why not just leave the other 3% alone? We pay for your service, we love it, why not reward that?

It's not like maintaining standalone licenses and local vault storage is hard, it's already there. Just maintain it.

justinmking• 5 years ago

Can anyone confirm for me. Is it still possible to buy a stand alone license for 1Password 7? I had heard if you download the Mac app from their website it was possible however I can’t see a way

1Password 8 will be subscription only and won’t support local vaults

Related Stories