4 ms·

So the issue boils down to, this person wants control over where they put their password vaults? To play devil's advocate: what makes your solution better than

by yladiz 9y ago

So the issue boils down to, this person wants control over where they put their password vaults? To play devil's advocate: what makes your solution better than one from a company specifically based around security? If you use Dropbox, iCloud, etc., why is it somehow better than their cloud based solution? And if you don't choose the cloud option, what makes your local computer significantly better than their cloud based solution, besides that you have control over it? An argument I buy is that you need it to be local for regulatory reasons, but if that's the case you wouldn't be using 1Password since it's not certified in any of the major ways, like HIPAA (from my understanding). I do agree that you should get a choice, but I don't think the argument the author is presenting is good enough. I do think that the argument that they're pushing their subscription model very heavily is bad, is true, but I can also buy 1Password's argument that it's technically more difficult to set up, because it does tend to be (I remember having to set up something when I set up 1Password initially, but it's been a while now). I also am not worried because, trusting 1Password's word, they're not removing the option. I do use 1Password, and I don't particularly care about this change. If I'm trusting a company enough to create an app that is essentially the gatekeeper to my entire digital life, I sure as hell should trust their cloud based solution. I think that 1Password is still the best; beyond their vault design, which I have worked with and trust (and trust the researchers who read and verified the white paper), their UI is still the best for me thanks to its great integration into iPhone and Safari. I am of course not a security researcher, but I don't see the inherit negative here.

bjpbakker 9y ago
IMO the article includes an important reason as to why their push to their company controlled cloud is horrible. > While the product is not open source, the storage format is, which is important to avoid vendor lock-in of your data. I'm a user of 1password. Honestly I've been less and less happy with the product for a while now, I think since they moved to version 6. AgileBits seems to been moving away from the open structure they had and pushes more for vendor locking. Which is bad is any case, but especially with your passwords. The question is not just whether or not you trust them right now, but do you trust them in a year from now? What about 5 years from now? If so, you're on board with the vendor locking and do not have to worry about it so much. Personally I will move away from 1password because the trust they gained from their start, has slowly degraded for a while now.
CJefferson 9y ago
Reasons the cloud is bad: 1) I stop paying, I lose all my passwords. 2) 1Password gets aquirhired/goes bankrupt, I lose all my passwords. 3) It easier to be much more confident if my passwords never leave my computer -- sure there could be code in 1Password which secretly makes internet connections for no reason, but people would notice it, however if it is communicating frequently then it is harder to track. it's IMPOSSIBLE to verify the web access, because they can just send different javascript every time you connect. If some finds a 1Password security problem, but my passwords are only on my computer, then that's not too serious. If some finds a 1Password security problem but my passwords are on Dropbox, then dropbox has to also have a massive security problem. If my passwords are in 1Password cloud and 1Password has a big security hole, game over.
wlll 9y ago
> what makes your solution better than one from a company specifically based around security? If you use Dropbox, iCloud, etc., why is it somehow better than their cloud based solution? I deliberately don't use cloud based storage for my passwords, secrets or other stuff I tend to store in 1Password. > And if you don't choose the cloud option, what makes your local computer significantly better than their cloud based solution, besides that you have control over it? It's the difference between a remote and a local vulnerability. If Agile Bits buggers something up and introduces a bug that means password vaults can be decrypted without the master password (or just leak metadata, whatever) then when stored locally you also need to get access to my local machine. If you are uploading your data to someone else's computer you now have vulnerable data out of your direct control. You've also created a gigantic target for hackers. There is no compartmentalisation, there's a password piñata up there with a huge target painted on it.

by yladiz 9y ago

bjpbakker 9y ago

IMO the article includes an important reason as to why their push to their company controlled cloud is horrible. > While the product is not open source, the storage format is, which is important to avoid vendor lock-in of your data. I'm a user of 1password. Honestly I've been less and less happy with the product for a while now, I think since they moved to version 6. AgileBits seems to been moving away from the open structure they had and pushes more for vendor locking. Which is bad is any case, but especially with your passwords. The question is not just whether or not you trust them right now, but do you trust them in a year from now? What about 5 years from now? If so, you're on board with the vendor locking and do not have to worry about it so much. Personally I will move away from 1password because the trust they gained from their start, has slowly degraded for a while now.

CJefferson 9y ago

Reasons the cloud is bad: 1) I stop paying, I lose all my passwords. 2) 1Password gets aquirhired/goes bankrupt, I lose all my passwords. 3) It easier to be much more confident if my passwords never leave my computer -- sure there could be code in 1Password which secretly makes internet connections for no reason, but people would notice it, however if it is communicating frequently then it is harder to track. it's IMPOSSIBLE to verify the web access, because they can just send different javascript every time you connect. If some finds a 1Password security problem, but my passwords are only on my computer, then that's not too serious. If some finds a 1Password security problem but my passwords are on Dropbox, then dropbox has to also have a massive security problem. If my passwords are in 1Password cloud and 1Password has a big security hole, game over.

wlll 9y ago

> what makes your solution better than one from a company specifically based around security? If you use Dropbox, iCloud, etc., why is it somehow better than their cloud based solution? I deliberately don't use cloud based storage for my passwords, secrets or other stuff I tend to store in 1Password. > And if you don't choose the cloud option, what makes your local computer significantly better than their cloud based solution, besides that you have control over it? It's the difference between a remote and a local vulnerability. If Agile Bits buggers something up and introduces a bug that means password vaults can be decrypted without the master password (or just leak metadata, whatever) then when stored locally you also need to get access to my local machine. If you are uploading your data to someone else's computer you now have vulnerable data out of your direct control. You've also created a gigantic target for hackers. There is no compartmentalisation, there's a password piñata up there with a huge target painted on it.