4 ms·

The fact that it takes me half an hour to find the standalone app for the desktop annoys me every time I recommend this wonderful application. And, frankly, I

• deleted 9y ago
  [deleted]
• pfg 9y ago
  I don't think cloud storage is all that uncommon. Even before 1Password introduced subscriptions, they had sync options for things like Dropbox, and those were pretty popular in my experience. I imagine most users would want some sort of offsite storage either way, and cloud storage is the obvious solution. That said, there are definitely environments where any kind of third-party storage is unacceptable, so they should keep that option around. Still: Most users are probably better served with cloud storage. Usable security beats perfect security. What I'm more concerned about is that, IIRC, there's no way to go through the on-boarding process for their subscription service without using their website, which relies on WebCrypto. I'd rather have that (and other management features) be part of the native applications, which can use proper code signing. From what I gather from Twitter, their security lead isn't happy with that either, so hopefully this will change.
  • cygned 9y ago
    You're right, you could sync with Dropbox before cloud subscriptions - but you could literally see the file in your Dropbox. In case of the subscription, you don't see it. It's a different feeling, more like a black-box.
• bitexploder 9y ago
  I am security aware and keep a significant enough subset of my passwords on Dropbox. In fact, it may be because I am security aware and very good at understanding the risk / reward trade off that I feel comfortable operating this way. With something like a KeePass or pass, password store as long as you have a strong password and avoid storing multiple or historical versions it is fine. You can't trust any old password manager, if you don't know for sure how it operators on the files, but otherwise this is much lower risk than most people think. Something like 1Password cloud is entirely different from storing a password safe in Dropbox.
• Xylakant 9y ago
  I'm security aware and I push my passwords to a (private) github repo. I'm using pass and the passwords are gpg-encrypted using a key that lives on my smartcard. I understand that there's a tradeoff there - mostly that pass does not hide the sites that the account is for, but that works for me, the benefit of having a backup outweighs the potential damage in my case.
  • cygned 9y ago
    That's indeed an interesting approach.
  • ryukafalz 9y ago
    I do much the same thing, but I push them to a git repo on a server that I control. GPG smartcards are super nice for that though, the machines I use on a daily basis don't have access to any of my passwords unless I explicitly decrypt them.
• rimliu 9y ago
  Remark about security-aware people not keeping their password in the claud has go a vibe of "tech-savvy people do not use Macs".
• kavok 9y ago
  I consider myself security-aware and use LastPass for the majority of my passwords.