5 ms·

Like OP, I’ve used 1P since the early 2010s. Its approachability (and the fact that I pay for it) finally convinced my family (SO/siblings/parents) to use a pas

Like OP, I’ve used 1P since the early 2010s. Its approachability (and the fact that I pay for it) finally convinced my family (SO/siblings/parents) to use a password manager. I love the native experience on iOS, and the full desktop version + browser extensions I remember being frustrated by the Dropbox loss, and I’m still frustrated that they seem to push 1PasswordX over the native apps. Other than that I’ve only had 3 major gripes: 1) Lack of Linux support 2) Lack of good ssh key management 3) Lack of ability to self host I’ve been eying BitWarden for awhile- How was your transition/migration to Bitwarden from 1P? How does the iOS integration compare to 1P? Do you self-host?

rdschouw 5y ago
I self-host using docker. It is very reliable including updates. Transition is as easy as exporting your 1P database and importing it into BW. Integration in IOS is very similar as 1P. Overall, 1P's apps are more polished than BW. You notice it when you migrate over and after a while you forget about it. There's one caveat and that is you've to pay BW $10 per year to get TOTP/2F AUTH support and offline support in the apps.
- dteare 5y ago
  I'm happy to hear our export worked well for you. We spent extra effort there to make sure our export format contained enough structured information that it could be imported properly elsewhere. I hate data lock-in and we wanted to make sure you wouldn't be locked into 1Password. I hope we can win you back someday. ++dave; 1Password Founder.
- sildur 5y ago
  You don't have to pay if you use biwarden_rs. It's also way lighter and easier to set up.
philsnow 5y ago
> I’m still frustrated that they seem to push 1PasswordX over the native apps This is one of the things that pushed me to choose bitwarden over a 1password families subscription (even though I get the latter for free from my work). I don't like the idea of credentials living in a browser extension (or even in a browser). I'm not confident in the long-term security of the entire setup, especially with the "evergreen" nature of modern browsers. I don't like telling my less-technical family that this extension is okay, but absolutely don't trust any other extensions.
- bwoodruff 5y ago
  Interesting! I honestly hadn't seen the perspective that we were pushing 1Password in the browser _over_ the apps. We may need to look at our messaging on that. Personally I think the best experience comes from using both in conjunction, especially with the new mutual unlock feature. > I don't like telling my less-technical family that this extension is okay, but absolutely don't trust any other extensions. I do understand this dilemma, but I'm curious how you reconcile that against things like the benefits of filling from the extension avoiding the system clipboard & key loggers, the inherent phishing protection that comes from 1Password only suggesting credentials on sites where the URL matches your items, etc. Telling folks the 1Password extension is okay and others are not is the approach we take internally. - Ben, 1Password
  - philsnow 5y ago
    > I'm curious how you reconcile that against things like the benefits of filling from the extension avoiding the system clipboard & key loggers I'm mostly punting this to macos. I don't give my kids admin rights on the devices I let them use and in general I think you need a11y access to log keys on mac, granting which requires admin. AFAIK, modern browsers prevent interaction with the clipboard without user interaction, so using the system clipboard for passwords is not a huge deal. As a mitigation, 1password and other password managers clear the clipboard after a timeout. On my linux machine, I use a bitwarden CLI in a script that either uses xclip to put the password into the clipboard or xdotool to type it directly. To my understanding, the security model in X is quite a bit worse than that in mac, but I prefer this over using a browser extension. > the inherent phishing protection that comes from 1Password only suggesting credentials on sites where the URL matches your items I can't wait for a passwordless world to come. For now, my kids only have credentials on sites that are relatively worthless, and I use U2F on all the sites/services I possibly can that have any value. On the sites that have value but don't support U2F, I either accept the risk or try to find alternatives. Banks and financial services (I live in the US) are a perennial disappointment here. I do use the bitwarden app on my iphone, and when you actually go through the password filling feature (instead of just switching to the bitwarden app and searching), it does suggest only those passwords that match the URI you're looking at. I haven't closely examined why I'm okay with this integration but not a browser extension on other platforms, but I am.

rdschouw 5y ago

I self-host using docker. It is very reliable including updates. Transition is as easy as exporting your 1P database and importing it into BW. Integration in IOS is very similar as 1P. Overall, 1P's apps are more polished than BW. You notice it when you migrate over and after a while you forget about it. There's one caveat and that is you've to pay BW $10 per year to get TOTP/2F AUTH support and offline support in the apps.

dteare 5y ago
I'm happy to hear our export worked well for you. We spent extra effort there to make sure our export format contained enough structured information that it could be imported properly elsewhere. I hate data lock-in and we wanted to make sure you wouldn't be locked into 1Password. I hope we can win you back someday. ++dave; 1Password Founder.
sildur 5y ago
You don't have to pay if you use biwarden_rs. It's also way lighter and easier to set up.

philsnow 5y ago

> I’m still frustrated that they seem to push 1PasswordX over the native apps This is one of the things that pushed me to choose bitwarden over a 1password families subscription (even though I get the latter for free from my work). I don't like the idea of credentials living in a browser extension (or even in a browser). I'm not confident in the long-term security of the entire setup, especially with the "evergreen" nature of modern browsers. I don't like telling my less-technical family that this extension is okay, but absolutely don't trust any other extensions.

bwoodruff 5y ago
Interesting! I honestly hadn't seen the perspective that we were pushing 1Password in the browser _over_ the apps. We may need to look at our messaging on that. Personally I think the best experience comes from using both in conjunction, especially with the new mutual unlock feature. > I don't like telling my less-technical family that this extension is okay, but absolutely don't trust any other extensions. I do understand this dilemma, but I'm curious how you reconcile that against things like the benefits of filling from the extension avoiding the system clipboard & key loggers, the inherent phishing protection that comes from 1Password only suggesting credentials on sites where the URL matches your items, etc. Telling folks the 1Password extension is okay and others are not is the approach we take internally. - Ben, 1Password
- philsnow 5y ago
  > I'm curious how you reconcile that against things like the benefits of filling from the extension avoiding the system clipboard & key loggers I'm mostly punting this to macos. I don't give my kids admin rights on the devices I let them use and in general I think you need a11y access to log keys on mac, granting which requires admin. AFAIK, modern browsers prevent interaction with the clipboard without user interaction, so using the system clipboard for passwords is not a huge deal. As a mitigation, 1password and other password managers clear the clipboard after a timeout. On my linux machine, I use a bitwarden CLI in a script that either uses xclip to put the password into the clipboard or xdotool to type it directly. To my understanding, the security model in X is quite a bit worse than that in mac, but I prefer this over using a browser extension. > the inherent phishing protection that comes from 1Password only suggesting credentials on sites where the URL matches your items I can't wait for a passwordless world to come. For now, my kids only have credentials on sites that are relatively worthless, and I use U2F on all the sites/services I possibly can that have any value. On the sites that have value but don't support U2F, I either accept the risk or try to find alternatives. Banks and financial services (I live in the US) are a perennial disappointment here. I do use the bitwarden app on my iphone, and when you actually go through the password filling feature (instead of just switching to the bitwarden app and searching), it does suggest only those passwords that match the URI you're looking at. I haven't closely examined why I'm okay with this integration but not a browser extension on other platforms, but I am.