6 ms·

I'm surprised at how little advocacy there is for 1password. Yes, it's a single point of failure (probably more, depending on how you choose to define them) bu

I'm surprised at how little advocacy there is for 1password. Yes, it's a single point of failure (probably more, depending on how you choose to define them) but it is invariably more secure than me remembering my super-nifty password algorithm. It's not perfect, but I trivially generate very long passwords for every service, and have to remember the master password only of my email and my 1password account. If anything is truly important, it will have 2 factor authentication. If someone has access to my unlocked physical machine and an unlocked 1password UI, I'm screwed. Additionally, they could use the wrench approach [0] to gain my credentials. This is not a use-case I'm actively trying to prevent. Nor is protection against state-level actors targeting me in particular. Further benefit of 1password: my wife and I both use certain shared logins to access things like credit card accounts. Instead of me having to get her on board with my password book, or special algorithm, I can just move a login into our shared password vault. I suspect most people reading this are in a similar boat - we're more than happy to pay a few dollars to hire millions of dollars of specialized security knowledge to outsource this problem for us. This is just too mundane a solution for most people to comment on. Long live 1Password! [0] https://xkcd.com/538/ https://xkcd.com/538/

whalesalad 9y ago
My wife and I do the same which is hugely convenient. You can store more than website logins as well, such as credit card numbers, drivers license details or our passport information. We do a lot of travel and financial witchcraft so having full access to each other’s into at the unlock of a thumbprint is extremely convenient. We also have a team vault at FarmLogs which is hugely helpful for sharing access to singular accounts. It’s such a valuable tool that I don’t even think about paying for it.
- wonder_er 9y ago
  precisely! I make heavy use of 1pass document storage to keep high-quality PDFs of: * passports * drivers licenses * birth certificates * visas * proof of residency * vaccination records * bank paperwork * etc We're in the same boat. We travel a lot, often for extended periods of time, and both work fully remotely. Any document anyone could want from me, for any reason, lives in 1password. They could double the price, and I'd gripe a little, but would never imagine walking away from the tool. (er, 1password, don't double your prices, if you're reading this.) edit: formatting
exhilaration 9y ago
I've been happily using 1Password 4 for many years, my credentials are encrypted and synced via Dropbox. But I hear the latest versions require you to use their cloud service, the self-hosted version is no longer available. Is that true? I use 1Password for not only credentials but as a document vault for everything from passports, birth certificates, anything else that falls under "needed after the house burns down". It's one of the most elegant pieces of software I've ever used.
- nicky0 9y ago
  Whilst they do have a cloud-hosted subscription service, the self hosted version is still available.
  - falcolas 9y ago
    And self-hosted can put the files in Apple's iCloud service, making it accessible on your phone. At least, that's how my own is still working.
    - smt88 9y ago
      Your weakest link is probably now iCloud, considering how easily and often it gets hacked...
      - nkristoffersen 9y ago
        Which is never, right? Has iCloud actually been “hacked” in the “Yahoo” sense of the word? I ask because I use iCloud heavily. Nearly 1TB of photos/videos and now use 1Password with iCloud sync.
        smt88 9y ago
        Has there been a large dump of iCloud credentials, allowing unauthorized access to accounts? Maybe, but it isn't publicly known. Has Apple made mistakes when designing iCloud, allowing unauthorized access to accounts? Yes.
SnowingXIV 9y ago
I switched to this after being a long time lastpass user, I'm regretting it. It's visually a lot better but it is terrible at generating passwords and saving them. On both windows and mac with chrome I click the 1pass icon and click generate (nothing happens). If something happens it shows up as a new entry if I go into the vault with no site or anything just a random string that I then maybe copy paste? (ugh). There also is nothing that pops up that lets me alter the specifications for the randomly generated password. Lastpass did an amazing job of this, 1password just seems broken all over the place. When I did the export/import it ruined tons of passwords because if it had an ampersand symbol (&) it turned it into & resulting in me editing tons of passwords manually. It sucks at saving passwords too, lastpass just worked. Plus no check on password integrity or strength or leaks. It was nice to do a scan and check on what passwords should be updated, what my duplicates are (if any), mass update, etc. So, basically I went from free but kinda ugly to pretty but broken and more $. This has been the worst trade deal in the history of trade deals, maybe ever. YMMV but I wish I didn't switch and to move back would be another annoyance that I might do if I didn't just pay for the year.
- mikestew 9y ago
  it is terrible at generating passwords and saving them 1Password used to be better at this. Generating a password was pretty obvious, it was consistent across mobile/desktop, and the save workflow was better. It’s been several versions since that was the case (v. 3, maybe?). Now I have to hunt for the functionality and then it gets put someplace with no reference to what it is. Plus no check on password integrity or strength or leaks. It was nice to do a scan and check on what passwords should be updated, what my duplicates are (if any), mass update, etc I know the Mac version will give you all of this. Compromised sites, dupes, weak passwords, old passwords, there’s a filter for each, and I think you can make your own. It does not appear that you get this on mobile, though.
  - deleted 9y ago
    [deleted]
- wonder_er 9y ago
  Hm. I just checked on both of these comments, and it seems 1password manages both quite well. re: password generation in-browser - this is working just fine for me. [0] And re: pw integrity or strength - this might not be everything you're looking for, but it's close. under a 'Security Audit' tab, it has categories for: - Watchtower (logins associated w/sites that are known vulnurable/exploited) - Weak Passwords - Duplicates - 3+ year old PWs - 1-3 year old pws - 6-12 month old pws. I'm not trying to be a 1password apologist, but I find it to cover my day-to-day use _very_ well. To be sure, I still tweak things in the UI at times. It doesn't capture login URLs perfectly all the time. Etc. But it's pretty good. [0] https://cl.ly/07072T0e1P2C/Add_Comment___Hacker_News.jpg https://cl.ly/07072T0e1P2C/Add_Comment___Hacker_News.jpg

whalesalad 9y ago

My wife and I do the same which is hugely convenient. You can store more than website logins as well, such as credit card numbers, drivers license details or our passport information. We do a lot of travel and financial witchcraft so having full access to each other’s into at the unlock of a thumbprint is extremely convenient. We also have a team vault at FarmLogs which is hugely helpful for sharing access to singular accounts. It’s such a valuable tool that I don’t even think about paying for it.

wonder_er 9y ago
precisely! I make heavy use of 1pass document storage to keep high-quality PDFs of: * passports * drivers licenses * birth certificates * visas * proof of residency * vaccination records * bank paperwork * etc We're in the same boat. We travel a lot, often for extended periods of time, and both work fully remotely. Any document anyone could want from me, for any reason, lives in 1password. They could double the price, and I'd gripe a little, but would never imagine walking away from the tool. (er, 1password, don't double your prices, if you're reading this.) edit: formatting

exhilaration 9y ago

I've been happily using 1Password 4 for many years, my credentials are encrypted and synced via Dropbox. But I hear the latest versions require you to use their cloud service, the self-hosted version is no longer available. Is that true? I use 1Password for not only credentials but as a document vault for everything from passports, birth certificates, anything else that falls under "needed after the house burns down". It's one of the most elegant pieces of software I've ever used.

nicky0 9y ago
Whilst they do have a cloud-hosted subscription service, the self hosted version is still available.
- falcolas 9y ago
  And self-hosted can put the files in Apple's iCloud service, making it accessible on your phone. At least, that's how my own is still working.
  - smt88 9y ago
    Your weakest link is probably now iCloud, considering how easily and often it gets hacked...
    - nkristoffersen 9y ago
      Which is never, right? Has iCloud actually been “hacked” in the “Yahoo” sense of the word? I ask because I use iCloud heavily. Nearly 1TB of photos/videos and now use 1Password with iCloud sync.
      - smt88 9y ago
        Has there been a large dump of iCloud credentials, allowing unauthorized access to accounts? Maybe, but it isn't publicly known. Has Apple made mistakes when designing iCloud, allowing unauthorized access to accounts? Yes.

SnowingXIV 9y ago

I switched to this after being a long time lastpass user, I'm regretting it. It's visually a lot better but it is terrible at generating passwords and saving them. On both windows and mac with chrome I click the 1pass icon and click generate (nothing happens). If something happens it shows up as a new entry if I go into the vault with no site or anything just a random string that I then maybe copy paste? (ugh). There also is nothing that pops up that lets me alter the specifications for the randomly generated password. Lastpass did an amazing job of this, 1password just seems broken all over the place. When I did the export/import it ruined tons of passwords because if it had an ampersand symbol (&) it turned it into & resulting in me editing tons of passwords manually. It sucks at saving passwords too, lastpass just worked. Plus no check on password integrity or strength or leaks. It was nice to do a scan and check on what passwords should be updated, what my duplicates are (if any), mass update, etc. So, basically I went from free but kinda ugly to pretty but broken and more $. This has been the worst trade deal in the history of trade deals, maybe ever. YMMV but I wish I didn't switch and to move back would be another annoyance that I might do if I didn't just pay for the year.

mikestew 9y ago
it is terrible at generating passwords and saving them 1Password used to be better at this. Generating a password was pretty obvious, it was consistent across mobile/desktop, and the save workflow was better. It’s been several versions since that was the case (v. 3, maybe?). Now I have to hunt for the functionality and then it gets put someplace with no reference to what it is. Plus no check on password integrity or strength or leaks. It was nice to do a scan and check on what passwords should be updated, what my duplicates are (if any), mass update, etc I know the Mac version will give you all of this. Compromised sites, dupes, weak passwords, old passwords, there’s a filter for each, and I think you can make your own. It does not appear that you get this on mobile, though.
- deleted 9y ago
  [deleted]
wonder_er 9y ago
Hm. I just checked on both of these comments, and it seems 1password manages both quite well. re: password generation in-browser - this is working just fine for me. [0] And re: pw integrity or strength - this might not be everything you're looking for, but it's close. under a 'Security Audit' tab, it has categories for: - Watchtower (logins associated w/sites that are known vulnurable/exploited) - Weak Passwords - Duplicates - 3+ year old PWs - 1-3 year old pws - 6-12 month old pws. I'm not trying to be a 1password apologist, but I find it to cover my day-to-day use _very_ well. To be sure, I still tweak things in the UI at times. It doesn't capture login URLs perfectly all the time. Etc. But it's pretty good. [0] https://cl.ly/07072T0e1P2C/Add_Comment___Hacker_News.jpg https://cl.ly/07072T0e1P2C/Add_Comment___Hacker_News.jpg