7 ms·

While this looks interesting, I'll admit I feel like there's been a bit of drift from their bread and butter over the years since they launched their cloud thin

by xoa 6y ago

While this looks interesting, I'll admit I feel like there's been a bit of drift from their bread and butter over the years since they launched their cloud thing and started pushing hard towards a subscription model. I chose them long ago specifically over options like LastPass because I liked having a rich application without internet dependency and their attention to detail and features there, but it's been a while since it feels like it got major new improvements vs the site. For example, while macOS and Windows have supported smart cards and security tokens like YubiKeys forever now, and I use them to login, unlock, authorize sudo/SSH, etc every day, 1Password still has no support. There are things that can now only be done through the web interface, like finer grained control over permissions for shared vaults, and some of those are also nastily locked away behind more expensive subscriptions. I think everything should be manageable through the application, without ever visiting the site. Duplicate items across vaults remain completely manually managed, when automating stuff like that is kind of the purpose of a password manager. Etc. Heck, even within their own subscription service I think they're missing a trick by not having more powerful/flexible organization(including families) and inter-organizational capabilities. I still think 1Password is the best option for most people. I specifically want my non-technical family and friends to use password managers too as long as its necessary, and having some multiperson capability is also key to that. I can't say though that I feel like the move to subs has been a huge win in terms of development. Granted, I'm a little down on the whole field which colors things a bit. Ultimately underlying my feelings is a touch of bitterness that their entire industry even exists. Passwords and password managers are mostly recreating public key auth really, really badly and it stinks. Passwords and other symmetric tokens by definition should never be shared. A website being hacked should never affect me in the slightest, in the same way that me getting hacked doesn't somehow suddenly mean attackers now own Debian/Apple/FreeBSD/Microsoft. Everywhere should just have public keys. We've had the tech for decades and sufficient crypto speed on client systems since at least AES-NI. What's been missing has been glue and effort. It's frustrating every time a hack happens. We shouldn't have to care! Sigh.

fastball 6y ago
Very much agree. My pet peeve at the moment is this[1], where they removed a feature I very much like (TouchID in the standalone browser extension) and still have yet to replace that functionality despite many promises that it is just around the corner. It was removed in August 2020. Definitely feel like they've lost sight of why people chose them in the first place, and stuff like this is certainly not helping assuage my concerns. [1] https://1password.community/discussion/115228/temporarily-removing-desktop-app-integration/p1 https://1password.community/discussion/115228/temporarily-re...
- 1cvmask 6y ago
  Did you ever look at a password manager like saas pass that does not need a desktop app and the browser extension is a full blown app that is protected by 2fa?
- xoa 6y ago
  It's a fundamental concern I've always had with subscriptions for non-entertainment services or trivially fungible goods. I've become a big believer in business incentives and feedback loops for sustainable commercial relationships. Individual leadership and culture can stand against them to some extent for a time, but individuals move on and it seems that near inevitably over enough years organizations tend to track and/or drift according to their incentives and impactful feedback. In a traditional software upgrade model, the default is that they get no money unless they can convince people to upgrade each time. They make their money from overcoming that default, and if people choose not to upgrade that's the most core unignorable feedback for a business that something isn't right. It doesn't guarantee responsiveness or good choices, but it forces them to think about it. From a customer perspective, not paying means the status quo, they don't gain anything new but they lose nothing either. But with subscriptions it gets inverted. Now for the customer failure to keep paying means losing existing functionality and/or having to expend additional resources (money and time) actively moving to something else. So rather then needing to be convinced to give the company more money, it's more that they need to be convinced not to. There's a real difference between "a customer base that is very happy" and "a customer base that is merely not irritated enough yet to overcome the inherent energy hump and go looking for a new local minima" and I worry the subscription business model makes that easier to ignore. Not that companies can't in principle find out in other ways! They can do detailed customer polling and so on. But that requires active effort and expense by the company so the temptation will always be to ignore it and follow inertia. This doesn't require the slightest bit of active malice, just a break in feedback loops resulting in drift as a company starts pursuing things from its own tunnel vision. They then look and see the money keep pouring in, so what's the problem? The threat eventually becomes that if the energy barrier is overcome and the stampede begins it's too late. It's a shame to see happen to companies I really really like and have great visions that could be even better.
rectang 6y ago
> I specifically want my non-technical family and friends to use password managers I consider it a victory if I can get non-techies to use their browser's facilities to store passwords, and then to choose reasonably long passwords and avoid reuse. (I use `pass`, myself.)
- fiddlerwoaroof 6y ago
  I use a password manager but, as a mostly-Apple user, I see very little reason not to just use iCloud Keychain: the UX of Apple’s solution is significantly better than all the alternatives because I don’t have to remember yet another password/mfa token to type in every once in a while.
  - Vvector 6y ago
    BitWarden ties into iCloud somehow. I unlock it with my fingerprint.
    - deleted 6y ago
      [deleted]
    - stjohnswarts 6y ago
      I choose bitwarden because I like my passwords with a 3rd party rather than the big guys google/apple/etc . It works fine as both a desktop client and browser extension.
  - gen220 6y ago
    Most password managers support auth with touchid/face id these days, I believe. The value prop if you're 100% on-Apple, and OK with this fact, is hard to challenge. If you have some non-apple devices that need passwords, that's where having a third-party password service makes sense. FWIW, I use `pass`, as a mostly-Apple person who also owns a few linux devices and occasionally requires passwords while `ssh`'d into servers.
    - deleted 6y ago
a-dub 6y ago
honestly i think solutions to many of these problems have been put into practice in the cryptocurrency space. there are commercial entities today that i don't have to trust, but will help me set up multiparty signatures for sending bitcoin transactions. i could see a similar mechanism being used for creating/revoking/recovering a compromised identity. hierarchical deterministic wallets seem a decent blueprint for identity. if i can generate arbitrary pubkeys from a single seed, then i maintain my privacy across providers i use my identity with. i used to think that the blockchain itself could make for a decent revocation list, but i don't think that's even neccessary. maybe it's simply time for governments to grow up and accept that the internet is critical now and as such provide basic digital identity services as they do with travel documents today. it doesn't have to be perfect, just publish revocations on behalf of citizens.

by xoa 6y ago

fastball 6y ago

Very much agree. My pet peeve at the moment is this[1], where they removed a feature I very much like (TouchID in the standalone browser extension) and still have yet to replace that functionality despite many promises that it is just around the corner. It was removed in August 2020. Definitely feel like they've lost sight of why people chose them in the first place, and stuff like this is certainly not helping assuage my concerns. [1] https://1password.community/discussion/115228/temporarily-removing-desktop-app-integration/p1 https://1password.community/discussion/115228/temporarily-re...

1cvmask 6y ago
Did you ever look at a password manager like saas pass that does not need a desktop app and the browser extension is a full blown app that is protected by 2fa?
xoa 6y ago
It's a fundamental concern I've always had with subscriptions for non-entertainment services or trivially fungible goods. I've become a big believer in business incentives and feedback loops for sustainable commercial relationships. Individual leadership and culture can stand against them to some extent for a time, but individuals move on and it seems that near inevitably over enough years organizations tend to track and/or drift according to their incentives and impactful feedback. In a traditional software upgrade model, the default is that they get no money unless they can convince people to upgrade each time. They make their money from overcoming that default, and if people choose not to upgrade that's the most core unignorable feedback for a business that something isn't right. It doesn't guarantee responsiveness or good choices, but it forces them to think about it. From a customer perspective, not paying means the status quo, they don't gain anything new but they lose nothing either. But with subscriptions it gets inverted. Now for the customer failure to keep paying means losing existing functionality and/or having to expend additional resources (money and time) actively moving to something else. So rather then needing to be convinced to give the company more money, it's more that they need to be convinced not to. There's a real difference between "a customer base that is very happy" and "a customer base that is merely not irritated enough yet to overcome the inherent energy hump and go looking for a new local minima" and I worry the subscription business model makes that easier to ignore. Not that companies can't in principle find out in other ways! They can do detailed customer polling and so on. But that requires active effort and expense by the company so the temptation will always be to ignore it and follow inertia. This doesn't require the slightest bit of active malice, just a break in feedback loops resulting in drift as a company starts pursuing things from its own tunnel vision. They then look and see the money keep pouring in, so what's the problem? The threat eventually becomes that if the energy barrier is overcome and the stampede begins it's too late. It's a shame to see happen to companies I really really like and have great visions that could be even better.

rectang 6y ago

> I specifically want my non-technical family and friends to use password managers I consider it a victory if I can get non-techies to use their browser's facilities to store passwords, and then to choose reasonably long passwords and avoid reuse. (I use `pass`, myself.)

fiddlerwoaroof 6y ago
I use a password manager but, as a mostly-Apple user, I see very little reason not to just use iCloud Keychain: the UX of Apple’s solution is significantly better than all the alternatives because I don’t have to remember yet another password/mfa token to type in every once in a while.
- Vvector 6y ago
  BitWarden ties into iCloud somehow. I unlock it with my fingerprint.
  - deleted 6y ago
    [deleted]
  - stjohnswarts 6y ago
    I choose bitwarden because I like my passwords with a 3rd party rather than the big guys google/apple/etc . It works fine as both a desktop client and browser extension.
- gen220 6y ago
  Most password managers support auth with touchid/face id these days, I believe. The value prop if you're 100% on-Apple, and OK with this fact, is hard to challenge. If you have some non-apple devices that need passwords, that's where having a third-party password service makes sense. FWIW, I use `pass`, as a mostly-Apple person who also owns a few linux devices and occasionally requires passwords while `ssh`'d into servers.
  - deleted 6y ago

a-dub 6y ago

honestly i think solutions to many of these problems have been put into practice in the cryptocurrency space. there are commercial entities today that i don't have to trust, but will help me set up multiparty signatures for sending bitcoin transactions. i could see a similar mechanism being used for creating/revoking/recovering a compromised identity. hierarchical deterministic wallets seem a decent blueprint for identity. if i can generate arbitrary pubkeys from a single seed, then i maintain my privacy across providers i use my identity with. i used to think that the blockchain itself could make for a decent revocation list, but i don't think that's even neccessary. maybe it's simply time for governments to grow up and accept that the internet is critical now and as such provide basic digital identity services as they do with travel documents today. it doesn't have to be perfect, just publish revocations on behalf of citizens.