6 ms·

Not the OP, but I dropped 1Password when it became clear you're forcing folks to cloud storage. I was sort of hoping the carefully chosen weasel-words about tha

by _jal 7y ago

Not the OP, but I dropped 1Password when it became clear you're forcing folks to cloud storage. I was sort of hoping the carefully chosen weasel-words about that used at the time meant you'd reconsider if enough of us made noise, but later releases made it clear where you're headed. It bummed me out - I really like 1pw. And I still don't have my password situation back to the same level of ease-of-use yet, but I switched to control the timing. Storing my password DB on other people's computers is simply not going to happen.

AGKyle 7y ago
Thanks for the feedback. I won't pretend that we're the password manager for everyone. If we're not the right one for you then hopefully one of the dozens of others out there fit the bill. I appreciate you taking the time to respond and let me know your opinion on this though. Thanks! Kyle 1Password Security Team
- _jal 7y ago
  I assume you have numbers showing the total number of whiners like me are an acceptable loss, but I find dropping that feature inexplicable, honestly.
  - StavrosK 7y ago
    From running a service, I assume the calculation they did was simply "number of people that whine to us because they lost their self-hosted files > number of people that whine to us because we don't allow them to self-host their files".
    - AGKyle 7y ago
      I think this is probably the better way to look at it. We seen a lot more "I can't access my data anymore" emails before we had our own service. Those seem to have dropped a lot, at least based on my own experience when doing support, since introducing 1Password.com. At the end of the day, our 1Password.com solution is also more secure thanks to the Secret Key being used as well. Our local vaults are certainly secure, but 1Password.com is even more secure. No matter what we do we will have people who don't agree with us. The best answer we can have is be able to logically explain why we have chosen to do something the way we have. Whether the user agrees or not is up to them, but we try to be able to at least explain why we chose to go a direction and hope that the explanation makes the most sense for the most people. We don't always get it right, but we certainly try our best. Kyle 1Password Security Team
      - StavrosK 7y ago
        Yeah, that makes sense, though I might have kept the self-hosting feature hidden behind a wall of "you're REALLY not going to get ANY support for this" text. Then again, the maintenance might not even be worth it.
        AGKyle 7y ago
        We still sell licenses, it's not super easy to find but it's there. Open the app on a new machine, on the welcome screen of options there's a "Create A New Local Vault" option, which takes you down the path of purchasing a license if one doesn't already exist. Those on subscriptions can also still create local vaults as well. You'd have a subscription plus the option of local vaults. So options haven't disappeared, they're all there. That said, providing an option without support is kind of bad form. We pride ourselves on providing the best technical support we can for our users. Selling a license and then not supporting it would just not be within what we consider good business or, well, being a good developer. So whatever we sell, we have to support. Kyle 1Password Security Team
        StavrosK 7y ago
        Hmm yeah, that's fair.
  - AGKyle 7y ago
    To be clear, we haven't dropped anything. We still sell licenses. We still provide local vaults, in fact you can use them via a license (that we still sell) AND you can use them with a subscription. Want to buy a license? On the Mac app for instance, open it on a fresh installation. Goto the welcome screen that pops up on first launch, from the list of options choose the "Create a new Local Vault" option in the list. This will take you down the path of buying a license. Or if you sign up for a subscription, goto advanced options and enable the option to create local vaults. You can sync these to Dropbox or iCloud if you wish, same as you always have been. There's similar options for Windows. Though it only includes Dropbox syncing and not iCloud. Hope that helps. Kyle 1Password Security Team
    - _jal 7y ago
      I know you haven't dropped anything yet. The Windows release and the choices your firm made about how to talk about the change have made it pretty clear where this is headed.
      - AGKyle 7y ago
        Sorry to say I don't think any words I'm going to say will help here. You'll just have to keep an eye on what we do I guess. I've said elsewhere but we won't pretend to be the single password manager that works for everyone and I'm sorry if we end up being one that doesn't work for you. Hopefully one of the dozens of others out there work for you if we don't though. Thanks for the feedback though! I certainly appreciate it and will pass along the information I've gleaned from this thread to the various people that need to see them. Kyle 1Password Security Team
- booi 7y ago
  There's a good argument that a subscription-based cloud-stored passwords isn't a good password manager for anybody.
enraged_camel 7y ago
>> Storing my password DB on other people's computers is simply not going to happen. What is the risk scenario you're worried about?
- oarsinsync 7y ago
  A situation where the remote datastore is compromised and now with it, all of my passwords. Or if I was to buy into 1Password's worldview, all of my credit cards, bank accounts, ID cards, everything I want to keep a secure digital copy of, is at risk. Having a sense of control is a huge part of the way we think. Despite the greater risk of death in a car compared to an aeroplane, there's less concerns about car travel because there's a sense of control. Similarly, having the data under my control may be less secure, but that's still within my control rather than dependent on someone else doing the right thing.
  - AGKyle 7y ago
    I think you may want to take a closer look at how 1Password works. I'll give a quick rundown here, but our security white paper goes into much greater detail: https://1pw.ca/whitepaper https://1pw.ca/whitepaper Your data is encrypted locally on your devices, it is never available in a decrypted form on any of our servers. A compromise of our servers would result in the attacker getting gibberish (encrypted data). To decrypt that data the attacker will need both your Master Password and your Secret Key. A Secret Key is a 128-bit key generated locally on your device, your Master Password is a passphrase set by you. These two keys are combined and, to simplify greatly, used to decrypt your data. The only way an attacker is going to acquire your Master Password and Secret Key are from your devices. Those are the only places those keys really exist. Guessing both the Secret Key and a strong Master Password are effectively going to cost such a significant amount of money, or due to time and processing constraints, be infeasible. An attack would have to be highly targeted. In other words, you would have to be a specific target to make any attack be worthwhile. If you believe you are likely to be the target of such a very specific attack you probably have a team of security personnel working for you who could better advise you than I could. I'd really suggest looking into how we do things. The only feasible attack on your data would be through your devices, and any other password manager that stores data locally on your devices will be impacted the same exact way in this case. Hope that helps but if you have questions please let me know and I'll do my best to help get you answers. Kyle 1Password Security Team Edit: apparently markdown isn't a thing here.
oarsinsync 7y ago
+1 for this. The only reason I ever got onto 1Password in the first place was because I didn't have to use any cloud storage, and could use wifi sync between my devices. I was extremely disappointed as that started to change. It was an absolute nightmare having to retrain all family members in the nuanced differences in how Bitwarden works compared to 1Password. I hope I don't end up having to eat that cost a second time.
- dangus 7y ago
  It seems really self-centered to retrain non-technical family on new software to satisfy your own philosophical needs that they may not share. There is nothing about “being a cloud service” that makes 1Password unusable for your family other than your own objections. On the contrary, it probably protects your family against their own incompetence compared to messing with local files, or depending on you to run a server for them (what happens if you’re hit by a bus?) Obviously that doesn’t mean that Bitwarden isn’t a superior solution, but that’s not why you switched them over.
  - jodrellblank 7y ago
    What a weird, accusatory, windmill-tilting comment. to satisfy your own philosophical needs that they may not share They are, presumably, adults who could reject the suggestion to change if they had strong feelings about it. but that’s not why you switched them over If you think cloud services are bad, then Bitwarden not using cloud services is what makes it a superior solution, and then would be why you switched them over. There is nothing about “being a cloud service” that makes 1Password unusable for your family other than your own objections. But you could say that about every tech decision every tech person makes on behalf of other people. 2015 LastPass was hacked and user details stolen, 2017 OneLogin was hacked and they accessed "user data, apps and various types of keys" and they "cannot rule out the possibility that the threat actor also obtained the ability to decrypt data"; "I don't trust (or don't want to have to trust) cloud services" is a reasonable choice to make.
    - deleted 7y ago
      [deleted]
erichurkman 7y ago
I'm souring on 1password, for both personal and work (we have it company-wide), based on unexpected pricing and licensing model changes. I really liked being able to buy a version _and have it keep working_. I could get it set up for my parents and nothing significant changed because it wasn't a "SaaS" product. I don't need a subscription for a password manager. So we're ditching 1password for our family, and are likely to do so for work, too.
sersi 7y ago
I still use 1password because local storage and wifi sync still works but the minute that stops I'll look for another alternative.
ketralnis 7y ago
Same. I'm holding out with a regular licence until they force me off but it's clear that they will, and that they'll probably use the mobile apps as the vehicle. I've paid for every upgrade for myself and my family so I'm aggregately paying _more_ than I would have paid for the cloud service. But I don't want a cloud service

by _jal 7y ago

AGKyle 7y ago

Thanks for the feedback. I won't pretend that we're the password manager for everyone. If we're not the right one for you then hopefully one of the dozens of others out there fit the bill. I appreciate you taking the time to respond and let me know your opinion on this though. Thanks! Kyle 1Password Security Team

_jal 7y ago
I assume you have numbers showing the total number of whiners like me are an acceptable loss, but I find dropping that feature inexplicable, honestly.
- StavrosK 7y ago
  From running a service, I assume the calculation they did was simply "number of people that whine to us because they lost their self-hosted files > number of people that whine to us because we don't allow them to self-host their files".
  - AGKyle 7y ago
    I think this is probably the better way to look at it. We seen a lot more "I can't access my data anymore" emails before we had our own service. Those seem to have dropped a lot, at least based on my own experience when doing support, since introducing 1Password.com. At the end of the day, our 1Password.com solution is also more secure thanks to the Secret Key being used as well. Our local vaults are certainly secure, but 1Password.com is even more secure. No matter what we do we will have people who don't agree with us. The best answer we can have is be able to logically explain why we have chosen to do something the way we have. Whether the user agrees or not is up to them, but we try to be able to at least explain why we chose to go a direction and hope that the explanation makes the most sense for the most people. We don't always get it right, but we certainly try our best. Kyle 1Password Security Team
    - StavrosK 7y ago
      Yeah, that makes sense, though I might have kept the self-hosting feature hidden behind a wall of "you're REALLY not going to get ANY support for this" text. Then again, the maintenance might not even be worth it.
      - AGKyle 7y ago
        We still sell licenses, it's not super easy to find but it's there. Open the app on a new machine, on the welcome screen of options there's a "Create A New Local Vault" option, which takes you down the path of purchasing a license if one doesn't already exist. Those on subscriptions can also still create local vaults as well. You'd have a subscription plus the option of local vaults. So options haven't disappeared, they're all there. That said, providing an option without support is kind of bad form. We pride ourselves on providing the best technical support we can for our users. Selling a license and then not supporting it would just not be within what we consider good business or, well, being a good developer. So whatever we sell, we have to support. Kyle 1Password Security Team
        StavrosK 7y ago
        Hmm yeah, that's fair.
- AGKyle 7y ago
  To be clear, we haven't dropped anything. We still sell licenses. We still provide local vaults, in fact you can use them via a license (that we still sell) AND you can use them with a subscription. Want to buy a license? On the Mac app for instance, open it on a fresh installation. Goto the welcome screen that pops up on first launch, from the list of options choose the "Create a new Local Vault" option in the list. This will take you down the path of buying a license. Or if you sign up for a subscription, goto advanced options and enable the option to create local vaults. You can sync these to Dropbox or iCloud if you wish, same as you always have been. There's similar options for Windows. Though it only includes Dropbox syncing and not iCloud. Hope that helps. Kyle 1Password Security Team
  - _jal 7y ago
    I know you haven't dropped anything yet. The Windows release and the choices your firm made about how to talk about the change have made it pretty clear where this is headed.
    - AGKyle 7y ago
      Sorry to say I don't think any words I'm going to say will help here. You'll just have to keep an eye on what we do I guess. I've said elsewhere but we won't pretend to be the single password manager that works for everyone and I'm sorry if we end up being one that doesn't work for you. Hopefully one of the dozens of others out there work for you if we don't though. Thanks for the feedback though! I certainly appreciate it and will pass along the information I've gleaned from this thread to the various people that need to see them. Kyle 1Password Security Team
booi 7y ago
There's a good argument that a subscription-based cloud-stored passwords isn't a good password manager for anybody.

enraged_camel 7y ago

>> Storing my password DB on other people's computers is simply not going to happen. What is the risk scenario you're worried about?

oarsinsync 7y ago
A situation where the remote datastore is compromised and now with it, all of my passwords. Or if I was to buy into 1Password's worldview, all of my credit cards, bank accounts, ID cards, everything I want to keep a secure digital copy of, is at risk. Having a sense of control is a huge part of the way we think. Despite the greater risk of death in a car compared to an aeroplane, there's less concerns about car travel because there's a sense of control. Similarly, having the data under my control may be less secure, but that's still within my control rather than dependent on someone else doing the right thing.
- AGKyle 7y ago
  I think you may want to take a closer look at how 1Password works. I'll give a quick rundown here, but our security white paper goes into much greater detail: https://1pw.ca/whitepaper https://1pw.ca/whitepaper Your data is encrypted locally on your devices, it is never available in a decrypted form on any of our servers. A compromise of our servers would result in the attacker getting gibberish (encrypted data). To decrypt that data the attacker will need both your Master Password and your Secret Key. A Secret Key is a 128-bit key generated locally on your device, your Master Password is a passphrase set by you. These two keys are combined and, to simplify greatly, used to decrypt your data. The only way an attacker is going to acquire your Master Password and Secret Key are from your devices. Those are the only places those keys really exist. Guessing both the Secret Key and a strong Master Password are effectively going to cost such a significant amount of money, or due to time and processing constraints, be infeasible. An attack would have to be highly targeted. In other words, you would have to be a specific target to make any attack be worthwhile. If you believe you are likely to be the target of such a very specific attack you probably have a team of security personnel working for you who could better advise you than I could. I'd really suggest looking into how we do things. The only feasible attack on your data would be through your devices, and any other password manager that stores data locally on your devices will be impacted the same exact way in this case. Hope that helps but if you have questions please let me know and I'll do my best to help get you answers. Kyle 1Password Security Team Edit: apparently markdown isn't a thing here.

oarsinsync 7y ago

+1 for this. The only reason I ever got onto 1Password in the first place was because I didn't have to use any cloud storage, and could use wifi sync between my devices. I was extremely disappointed as that started to change. It was an absolute nightmare having to retrain all family members in the nuanced differences in how Bitwarden works compared to 1Password. I hope I don't end up having to eat that cost a second time.

dangus 7y ago
It seems really self-centered to retrain non-technical family on new software to satisfy your own philosophical needs that they may not share. There is nothing about “being a cloud service” that makes 1Password unusable for your family other than your own objections. On the contrary, it probably protects your family against their own incompetence compared to messing with local files, or depending on you to run a server for them (what happens if you’re hit by a bus?) Obviously that doesn’t mean that Bitwarden isn’t a superior solution, but that’s not why you switched them over.
- jodrellblank 7y ago
  What a weird, accusatory, windmill-tilting comment. to satisfy your own philosophical needs that they may not share They are, presumably, adults who could reject the suggestion to change if they had strong feelings about it. but that’s not why you switched them over If you think cloud services are bad, then Bitwarden not using cloud services is what makes it a superior solution, and then would be why you switched them over. There is nothing about “being a cloud service” that makes 1Password unusable for your family other than your own objections. But you could say that about every tech decision every tech person makes on behalf of other people. 2015 LastPass was hacked and user details stolen, 2017 OneLogin was hacked and they accessed "user data, apps and various types of keys" and they "cannot rule out the possibility that the threat actor also obtained the ability to decrypt data"; "I don't trust (or don't want to have to trust) cloud services" is a reasonable choice to make.
  - deleted 7y ago
    [deleted]

erichurkman 7y ago

I'm souring on 1password, for both personal and work (we have it company-wide), based on unexpected pricing and licensing model changes. I really liked being able to buy a version _and have it keep working_. I could get it set up for my parents and nothing significant changed because it wasn't a "SaaS" product. I don't need a subscription for a password manager. So we're ditching 1password for our family, and are likely to do so for work, too.

sersi 7y ago

I still use 1password because local storage and wifi sync still works but the minute that stops I'll look for another alternative.

ketralnis 7y ago

Same. I'm holding out with a regular licence until they force me off but it's clear that they will, and that they'll probably use the mobile apps as the vehicle. I've paid for every upgrade for myself and my family so I'm aggregately paying _more_ than I would have paid for the cloud service. But I don't want a cloud service