6 ms·

As time goes on, I've gotten less and less comfortable using proprietary software for critical tasks. If 1Password were open source, I'd actually be pretty happ

As time goes on, I've gotten less and less comfortable using proprietary software for critical tasks. If 1Password were open source, I'd actually be pretty happy to subscribe. But as it stands, I have no faith that the product won't change out from under me in the future, whether due to a pivot, an acquisition, or some other reason. The incentives align in favor of the business, not the customer. IMHO, subscriptions are already pointing in that direction. I'd rather use something like pass and deal with the downsides. (Though I admittedly haven't switched yet.)

samatman 8y ago
For me, something related: can I remove the data in a usable form? 1Password makes that easy, so like others here, I'm happy to pay them to perform the 'eternal vigilance' that secret-keeping entails.
- Nullabillity 8y ago
  For now...
  - facetube 8y ago
    Removing the ability to get your own passwords out of your password management utility that you paid for would be corporate suicide.
    - iuguy 8y ago
      Crippling it, not so much. I moved away from 1password at the time of the subscription palaver. I managed to move everything to Keepass but each entry has it's own folder. I don't blame 1Password for the state of my Keepass db (although they pretty much forced my hand) but the closed nature of 1Password does bite you in the arse when you decide to leave.
      - facetube 8y ago
        I keep meaning to write some Applescript and/or browser glue for pass(1). Uses GPG, checks into Git, and even has an iOS app.
      - brightball 8y ago
        I switched from 1Password to LastPass last year and it was a smooth transition. If they’d had a Linux version I’d still be a customer right now.
        facetube 8y ago
        We evaluated Lastpass about a year ago and the UI was borderline unusable. Doesn't matter so much for technical teams, but it does in broader use cases.
        brightball 8y ago
        What did you settle on? It’s basically just a browser extension.
        tempay 8y ago
        They now have a chrome extension that supports Linux[1] and a command line app.[2] [1] https://support.1password.com/getting-started-1password-x/ https://support.1password.com/getting-started-1password-x/ [2] https://support.1password.com/command-line-getting-started/ https://support.1password.com/command-line-getting-started/
    - coldtea 8y ago
      "Corporate suicide"? 99% of the users wont even notice the feature existed...
      - saagarjha 8y ago
        They will if you go out of business or decide to spin off the product.
        coldtea 8y ago
        "Corporate suicide" implies that it would be a problem for the company. Users noticing it after the company is already "going out of business" does not qualify as such.
        facetube 8y ago
        Yes, you're right, an already-dead company can't die a second time in this highly-hypothethical scenario. They're still dead.
  - orf 8y ago
    For ever.
- sbuk 8y ago
  Yes, you can export it as a CSV file. They even warn you that it’s not secure.
  - reificator 8y ago
    > They even warn you that it’s not secure. I don't think anyone who uses a password manager is exporting to CSV for security purposes.
    - sbuk 8y ago
      I was trying to illustrate that not only can you extract data in an open format, they also are responsible enough to warn end users that the data is no longer encrypted. This isn’t for the benefit of your typical HN reader.
- frankzinger 8y ago
  Password Store (AKA 'pass') stores each password as a GPG-encrypted text file, so with gpg, $EDITOR, and cp/mv you have full control over your password data at all times without pass even having to get involved.
- AGKyle 8y ago
  We also allow export in something called 1PIF. It's a JSON format export of your data. It doesn't currently handle everything super smoothly, notably Documents which are new. We'll have another solution in the not too distant future that should cover things and be a documented format that anyone with the know how could use. Also important to note, that if your account ever lapses due to lack of payment. The account is still read-only. You can export your data if you wish even when the account is read-only. We do not lock you out of your data, we just prevent normal use of the application (browser extension, editing items, adding new items, etc). But the data you've already entered is entirely accessible if you want to copy/paste or export. Kyle AgileBits
- will_dev_4_food 8y ago
  It’s nice to see a team of marketers working so hard to convince the masses. Kudos.
selectodude 8y ago
https://github.com/OblivionCloudControl/opvault https://github.com/OblivionCloudControl/opvault opvault file access has open source tools. It would suck if they changed out from under me in the future (1password is the best password manager and it’s really not even close) but my passwords are at least accessible.
scarface74 8y ago
So if the app were open source and the maintainers decided to abandon it, are you going to download the code and keep it updated? If it is forked are you going to trust the new maintainers? Are you going to audit the source code?
- archagon 8y ago
  If it was a matter of OS compatibility, I'd certainly be able to do it for iOS or macOS. Security, less so, but with luck there would be others to do that work, if the app had enough users. Surely it would be better than just implicitly trusting some company with a profit motive? I'm not expecting anyone to do the work for free, by the way. You could still charge money for cloud sync or even app extensions and still keep the main repo open. Maybe the code could be a few revisions behind to incentivize people to pay. In any case, from looking around, it seems that KeePass and possibly Bitwarden fit this bill.
  - stevewillows 8y ago
    Bitwarden has been great for me. After going from LastPass to 1Pass to KeePassXC to Bitwarden, I really appreciate the simplicity of a simple browser extension without the requirement for a local client. Bitwarden just works and checks the boxes for me. I haven't tried it yet, but there is also a fork [1] that allows us to use our own hosting. [1] https://github.com/jakeswenson/BitBetter https://github.com/jakeswenson/BitBetter
- dabockster 8y ago
  This is the big fallacy I see whenever someone uses open source just because the source code is public. Unless you're able to perform a full audit yourself, is it really any better than a closed offering like 1Password?
  - rwbcxrz 8y ago
    I suppose the theory is that open source is better (a) because you can audit it if you want to, and (b) it's more likely that someone out there has audited it. In practice, (a) falls apart if the user doesn't have the knowledge, experience, or time necessary to perform an audit, which is quite likely for security software. And I feel like (b) isn't great either, as there are plenty of examples of major flaws in open source projects that went undetected for long periods - heartbleed is just one example.
mlindner 8y ago
There are open source 3d party applications on Linux that I've used to access 1Password password archives. The code is closed source but everything they're using to encrypt the passwords are open standards. You can build your own 3rd party open source platform to access them.
- josegonzalez 8y ago
  Do you have any suggestions for such software? I've been looking into this as I migrate to Linux and have yet to find something that does read and write for stuff stored in my Vault. I'd honestly be willing to pay for software that provided this.
  - JonathonW 8y ago
    The official solution is to subscribe to their subscription service (any tier works) and use 1Password X in-browser: https://support.1password.com/getting-started-1password-x/ https://support.1password.com/getting-started-1password-x/ Not sure about other solutions, open or closed; I moved over to their subscription service a few months ago and haven't looked back.
  - AGKyle 8y ago
    I work for AgileBits, makers of 1Password We don't prevent people from writing 3rd party tools, but I would also be very wary of using them. Our stance is outlined here: https://blog.agilebits.com/2013/03/06/you-have-secrets-we-dont-why-our-data-format-is-public/ https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do... > We have to advise you to never enter your 1Password Master Password into anything that isn’t 1Password. We aren’t casting aspersions on the integrity or competence of any developers, but we simply can’t advise otherwise. So as long as you're mindful of this advice from us, go forth and conquer. Kyle AgileBits
guelo 8y ago
Especially security related software companies, they have a tendency of degenerating into user-hostile malware businesses.
- himom 8y ago
  Comodo, Tripwire, Symantec, McAfee... on and on.
burnte 8y ago
At some point you have to value people. The 1Password folks have never let me down, and have been very honest, so I trust them. The product has done nothing but improve over the years for me, increasing in value and ease of use. And then with how often LastPass has had security breaches, it was a no brainer for me to leave LastPass years ago, and I don't regret it.
- archagon 8y ago
  Shifty Jelly has never let me down either, but they got acquired by NPR. Neither has Q Branch, but they ran out of money and had to shut down. Business for indies isn't predictable. Is AgileBits going to be around in 10 years? I hope so, but I think it's far more likely that they'll be swallowed up by some other company, at best. After getting burned by this over and over again, I just think it's more sensible to stick to OSS options that will probably exist in some compilable state even in the distant future.
  - burnte 8y ago
    > Shifty Jelly has never let me down either, but they got acquired by NPR. Of all the entities they could be acquired by, I think NPR is the least offensive of all. And they've stated the intent is not to change how PocketCasts works. The other partners are WNYC, WBEZ, and PRX (helmed by Ira Glass). These are all major publishers of podcasts who have a vested interest in keeping PocketCasts a good app, and growing it. I think this is a bad example. > Neither has Q Branch, but they ran out of money and had to shut down. They would still be around if they had subscription revenue. Guess who has subscription revenue? > Is AgileBits going to be around in 10 years? They started 12 years ago. If you asked 12 years ago if they would still be around in 10 years, the answer would be yes. > After getting burned by this over and over again, I just think it's more sensible to stick to OSS options that will probably exist in some compilable state even in the distant future. Well, don't go LastPass if you want OSS.
casefields 8y ago
Bitwarden is the answer for your concerns. I've moved to it and never looked back. https://bitwarden.com https://bitwarden.com
- cerberusss 8y ago
  Interesting suggestion, thanks! Can you comment on how good the mobile apps work?
m-p-3 8y ago
KeePass works for me, and it's available on all the platforms I use.
Khaine 8y ago
I agree. I try and use solutions that have open source formats, and are preferably open source. I have made an exception for 1Password, as it is so good. I hate subscription for software, unless there is a clear benefit. In this case, I don't see the benefit.
- bwoodruff 8y ago
  While our code is not, our vault formats are open. :) Ben Woodruff AgileBits
  - Khaine 8y ago
    I didn't know that. That adds to the esteem in which I hold 1Password and AgileBits. I think an open source format is almost as important as open source software.
spronkey 8y ago
I agree, especially around subscriptions. Too many light burnings already. I use and love 1Password, but there's no way I'm switching to the subscription model. When my version stops working (either through incompatibility or serious security flaw), I'll begrudgingly find something else to use.

samatman 8y ago

For me, something related: can I remove the data in a usable form? 1Password makes that easy, so like others here, I'm happy to pay them to perform the 'eternal vigilance' that secret-keeping entails.

Nullabillity 8y ago
For now...
- facetube 8y ago
  Removing the ability to get your own passwords out of your password management utility that you paid for would be corporate suicide.
  - iuguy 8y ago
    Crippling it, not so much. I moved away from 1password at the time of the subscription palaver. I managed to move everything to Keepass but each entry has it's own folder. I don't blame 1Password for the state of my Keepass db (although they pretty much forced my hand) but the closed nature of 1Password does bite you in the arse when you decide to leave.
    - facetube 8y ago
      I keep meaning to write some Applescript and/or browser glue for pass(1). Uses GPG, checks into Git, and even has an iOS app.
    - brightball 8y ago
      I switched from 1Password to LastPass last year and it was a smooth transition. If they’d had a Linux version I’d still be a customer right now.
      - facetube 8y ago
        We evaluated Lastpass about a year ago and the UI was borderline unusable. Doesn't matter so much for technical teams, but it does in broader use cases.
        brightball 8y ago
        What did you settle on? It’s basically just a browser extension.
      - tempay 8y ago
        They now have a chrome extension that supports Linux[1] and a command line app.[2] [1] https://support.1password.com/getting-started-1password-x/ https://support.1password.com/getting-started-1password-x/ [2] https://support.1password.com/command-line-getting-started/ https://support.1password.com/command-line-getting-started/
  - coldtea 8y ago
    "Corporate suicide"? 99% of the users wont even notice the feature existed...
    - saagarjha 8y ago
      They will if you go out of business or decide to spin off the product.
      - coldtea 8y ago
        "Corporate suicide" implies that it would be a problem for the company. Users noticing it after the company is already "going out of business" does not qualify as such.
        facetube 8y ago
        Yes, you're right, an already-dead company can't die a second time in this highly-hypothethical scenario. They're still dead.
- orf 8y ago
  For ever.
sbuk 8y ago
Yes, you can export it as a CSV file. They even warn you that it’s not secure.
- reificator 8y ago
  > They even warn you that it’s not secure. I don't think anyone who uses a password manager is exporting to CSV for security purposes.
  - sbuk 8y ago
    I was trying to illustrate that not only can you extract data in an open format, they also are responsible enough to warn end users that the data is no longer encrypted. This isn’t for the benefit of your typical HN reader.
frankzinger 8y ago
Password Store (AKA 'pass') stores each password as a GPG-encrypted text file, so with gpg, $EDITOR, and cp/mv you have full control over your password data at all times without pass even having to get involved.
AGKyle 8y ago
We also allow export in something called 1PIF. It's a JSON format export of your data. It doesn't currently handle everything super smoothly, notably Documents which are new. We'll have another solution in the not too distant future that should cover things and be a documented format that anyone with the know how could use. Also important to note, that if your account ever lapses due to lack of payment. The account is still read-only. You can export your data if you wish even when the account is read-only. We do not lock you out of your data, we just prevent normal use of the application (browser extension, editing items, adding new items, etc). But the data you've already entered is entirely accessible if you want to copy/paste or export. Kyle AgileBits
will_dev_4_food 8y ago
It’s nice to see a team of marketers working so hard to convince the masses. Kudos.

selectodude 8y ago

https://github.com/OblivionCloudControl/opvault https://github.com/OblivionCloudControl/opvault opvault file access has open source tools. It would suck if they changed out from under me in the future (1password is the best password manager and it’s really not even close) but my passwords are at least accessible.

scarface74 8y ago

So if the app were open source and the maintainers decided to abandon it, are you going to download the code and keep it updated? If it is forked are you going to trust the new maintainers? Are you going to audit the source code?

archagon 8y ago
If it was a matter of OS compatibility, I'd certainly be able to do it for iOS or macOS. Security, less so, but with luck there would be others to do that work, if the app had enough users. Surely it would be better than just implicitly trusting some company with a profit motive? I'm not expecting anyone to do the work for free, by the way. You could still charge money for cloud sync or even app extensions and still keep the main repo open. Maybe the code could be a few revisions behind to incentivize people to pay. In any case, from looking around, it seems that KeePass and possibly Bitwarden fit this bill.
- stevewillows 8y ago
  Bitwarden has been great for me. After going from LastPass to 1Pass to KeePassXC to Bitwarden, I really appreciate the simplicity of a simple browser extension without the requirement for a local client. Bitwarden just works and checks the boxes for me. I haven't tried it yet, but there is also a fork [1] that allows us to use our own hosting. [1] https://github.com/jakeswenson/BitBetter https://github.com/jakeswenson/BitBetter
dabockster 8y ago
This is the big fallacy I see whenever someone uses open source just because the source code is public. Unless you're able to perform a full audit yourself, is it really any better than a closed offering like 1Password?
- rwbcxrz 8y ago
  I suppose the theory is that open source is better (a) because you can audit it if you want to, and (b) it's more likely that someone out there has audited it. In practice, (a) falls apart if the user doesn't have the knowledge, experience, or time necessary to perform an audit, which is quite likely for security software. And I feel like (b) isn't great either, as there are plenty of examples of major flaws in open source projects that went undetected for long periods - heartbleed is just one example.

mlindner 8y ago

There are open source 3d party applications on Linux that I've used to access 1Password password archives. The code is closed source but everything they're using to encrypt the passwords are open standards. You can build your own 3rd party open source platform to access them.

josegonzalez 8y ago
Do you have any suggestions for such software? I've been looking into this as I migrate to Linux and have yet to find something that does read and write for stuff stored in my Vault. I'd honestly be willing to pay for software that provided this.
- JonathonW 8y ago
  The official solution is to subscribe to their subscription service (any tier works) and use 1Password X in-browser: https://support.1password.com/getting-started-1password-x/ https://support.1password.com/getting-started-1password-x/ Not sure about other solutions, open or closed; I moved over to their subscription service a few months ago and haven't looked back.
- AGKyle 8y ago
  I work for AgileBits, makers of 1Password We don't prevent people from writing 3rd party tools, but I would also be very wary of using them. Our stance is outlined here: https://blog.agilebits.com/2013/03/06/you-have-secrets-we-dont-why-our-data-format-is-public/ https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do... > We have to advise you to never enter your 1Password Master Password into anything that isn’t 1Password. We aren’t casting aspersions on the integrity or competence of any developers, but we simply can’t advise otherwise. So as long as you're mindful of this advice from us, go forth and conquer. Kyle AgileBits

guelo 8y ago

Especially security related software companies, they have a tendency of degenerating into user-hostile malware businesses.

himom 8y ago
Comodo, Tripwire, Symantec, McAfee... on and on.

burnte 8y ago

At some point you have to value people. The 1Password folks have never let me down, and have been very honest, so I trust them. The product has done nothing but improve over the years for me, increasing in value and ease of use. And then with how often LastPass has had security breaches, it was a no brainer for me to leave LastPass years ago, and I don't regret it.

archagon 8y ago
Shifty Jelly has never let me down either, but they got acquired by NPR. Neither has Q Branch, but they ran out of money and had to shut down. Business for indies isn't predictable. Is AgileBits going to be around in 10 years? I hope so, but I think it's far more likely that they'll be swallowed up by some other company, at best. After getting burned by this over and over again, I just think it's more sensible to stick to OSS options that will probably exist in some compilable state even in the distant future.
- burnte 8y ago
  > Shifty Jelly has never let me down either, but they got acquired by NPR. Of all the entities they could be acquired by, I think NPR is the least offensive of all. And they've stated the intent is not to change how PocketCasts works. The other partners are WNYC, WBEZ, and PRX (helmed by Ira Glass). These are all major publishers of podcasts who have a vested interest in keeping PocketCasts a good app, and growing it. I think this is a bad example. > Neither has Q Branch, but they ran out of money and had to shut down. They would still be around if they had subscription revenue. Guess who has subscription revenue? > Is AgileBits going to be around in 10 years? They started 12 years ago. If you asked 12 years ago if they would still be around in 10 years, the answer would be yes. > After getting burned by this over and over again, I just think it's more sensible to stick to OSS options that will probably exist in some compilable state even in the distant future. Well, don't go LastPass if you want OSS.

casefields 8y ago

Bitwarden is the answer for your concerns. I've moved to it and never looked back. https://bitwarden.com https://bitwarden.com

cerberusss 8y ago
Interesting suggestion, thanks! Can you comment on how good the mobile apps work?

m-p-3 8y ago

KeePass works for me, and it's available on all the platforms I use.

Khaine 8y ago

I agree. I try and use solutions that have open source formats, and are preferably open source. I have made an exception for 1Password, as it is so good. I hate subscription for software, unless there is a clear benefit. In this case, I don't see the benefit.

bwoodruff 8y ago
While our code is not, our vault formats are open. :) Ben Woodruff AgileBits
- Khaine 8y ago
  I didn't know that. That adds to the esteem in which I hold 1Password and AgileBits. I think an open source format is almost as important as open source software.

spronkey 8y ago

I agree, especially around subscriptions. Too many light burnings already. I use and love 1Password, but there's no way I'm switching to the subscription model. When my version stops working (either through incompatibility or serious security flaw), I'll begrudgingly find something else to use.