3 ms·

I don’t really think $8/user/mo for Business is overcharging compared to Slack which quickly gets into $30+ per user per month in larger shops where Enterprise

I don’t really think $8/user/mo for Business is overcharging compared to Slack which quickly gets into $30+ per user per month in larger shops where Enterprise Grid is required for its features. By your argument why can’t I buy that and self-host it too, decide if I want to upgrade for more features myself? I also think $5/mo for 1Password for Families is incredible value. Zero regrets on paying for this because it meaningfully enhances my families personal security posture through elimination of reused credentials and enabling TOTP (sharing of code generation) on many sites we use, that it is cross-platform so no excuses for everyone to not use it, and the UX is so simple you don’t need to be “tech people” to succeed. How much you charge and how you charge is definitely divisive, but 1Password feels very much on the cheaper end of the spectrum, not “overcharging”, heck Discord Nitro is $5 (Classic) or $10 and gets you very little by comparison IMO.

jimmydorry 5y ago
Can you elaborate on: >enabling TOTP (sharing of code generation) on many sites we use Are you generating TOTP codes via 1Password or something? That seems like a degradation of security. I did a cursorary search and didn't find mention of 1Password providing such a "service".
- nixgeek 5y ago
  Yes. https://blog.1password.com/totp-for-1password-users/ https://blog.1password.com/totp-for-1password-users/ It isn’t a degradation of security, in my opinion, it’s an upgrade, when certain accounts are involved. For these shared accounts, such as those used by my family, and on services which don’t support account-per-person in an “organization” or “household” sense, this still provides for TOTP in a way my spouse and I can both login. Ensuring just the loss of the password isn’t enough to compromise the account is an upgrade vs. not having TOTP enabled. Where we can both have our own accounts and use U2F tokens that’s a better story, clearly, but 1Password having this functionality is great!
  - jimmydorry 5y ago
    I don't understand how it's not a security degredation. The point of TOTP is to make access of the service dependant on something you must have phsyically (and isolated from the internet) on you. An attacker that manages to exfiltrate 1Password data has everything they need to access the service if TOTP is part of their offering. Where as all users with TOTP on their phone would have an additional layer of protection. Even by that blog post, they have to go out of their way and clarify that using this feature means you are not longer using two-factor authentication.

jimmydorry 5y ago

Can you elaborate on: >enabling TOTP (sharing of code generation) on many sites we use Are you generating TOTP codes via 1Password or something? That seems like a degradation of security. I did a cursorary search and didn't find mention of 1Password providing such a "service".

nixgeek 5y ago
Yes. https://blog.1password.com/totp-for-1password-users/ https://blog.1password.com/totp-for-1password-users/ It isn’t a degradation of security, in my opinion, it’s an upgrade, when certain accounts are involved. For these shared accounts, such as those used by my family, and on services which don’t support account-per-person in an “organization” or “household” sense, this still provides for TOTP in a way my spouse and I can both login. Ensuring just the loss of the password isn’t enough to compromise the account is an upgrade vs. not having TOTP enabled. Where we can both have our own accounts and use U2F tokens that’s a better story, clearly, but 1Password having this functionality is great!
- jimmydorry 5y ago
  I don't understand how it's not a security degredation. The point of TOTP is to make access of the service dependant on something you must have phsyically (and isolated from the internet) on you. An attacker that manages to exfiltrate 1Password data has everything they need to access the service if TOTP is part of their offering. Where as all users with TOTP on their phone would have an additional layer of protection. Even by that blog post, they have to go out of their way and clarify that using this feature means you are not longer using two-factor authentication.