16 ms·

I guess I’m the outlier in being very happy with 1Password and fine with paying for the subscription service. Not only is 1Password the best password manager I’

I guess I’m the outlier in being very happy with 1Password and fine with paying for the subscription service. Not only is 1Password the best password manager I’ve used, but it makes it seamless to share stuff with my wife. I don’t care if 8 is an Electron app either, considering I usually interact with it via the browser anyway with their extension. (Also I know that the majority of what they wrote for it is Rust and fast, and I generally trust the engineers to do a good job since they’ve done a good job with it in the past) Also they make a CLI tool for accessing passwords allowing you to integrate password management there: https://1password.com/downloads/command-line/ https://1password.com/downloads/command-line/

ValentineC 5y ago
I'm perfectly happy with paying a subscription, and think $4.99/month for 5 people is affordable. What I'm not happy with is the possibility of password access being limited or sync breaking if 1Password servers go down. At least with Dropbox (iCloud, wifi) sync, I have full control over the local vault file. Ultimately, it might be mostly about ownership and choice for me.
- auslegung 5y ago
  If the servers go down you'll never lose access to anything. You would lose sync while the servers were down but you would be able to access everything you already had on every device.
- DavideNL 5y ago
  Also I think the "head" of the family can reset passwords of the other accounts...
  - DavideNL 5y ago
    Not sure why I'm being downvoted...: https://support.1password.com/recovery/ https://support.1password.com/recovery/ Ps. They can delete accounts too: https://support.1password.com/add-remove-family-members/ https://support.1password.com/add-remove-family-members/
    - ValentineC 5y ago
      > Ps. They can delete accounts too: https://support.1password.com/add-remove-family-members/ https://support.1password.com/add-remove-family-members/ This makes losing local vault support an even bigger cause for alarm: > After you remove a family member’s account, they can’t sign in to 1Password, which means: > They lose all the items in their Private vault. Because the items weren’t shared with any other family members, no one will be able to access them. Imagine: the access credentials of the administrator gets compromised, and the entire's family's digital life, stored on 1Password, gets wiped by the malicious actor. The attack surface would be limited if instead, the removed user's license turns into a read-only one, like how 1Password currently deals with people using local vaults, and are not on a subscription.
      - romwell 5y ago
        More pragmatically, that's a prime opportunity for some to make a nasty divorce quite a bit more nasty. Big, big nope right there, thanks.
      - staticassertion 5y ago
        So don't use the family plan?
        ValentineC 5y ago
        It's not a problem right now with 1Password 7, because family members are (as far as I know) able to use local vaults too.
        DavideNL 5y ago
        ...which makes the subscription even more expensive.
- prepend 5y ago
  > $4.99/month for 5 people is affordable. I’m glad you find it affordable but these nickle and dime things add up. Especially when the product fits into $0 software so $4.99 is infinitely higher than $0. I feel like these small, “affordable,” services are just whittling away the Unix philosophy of do one small thing well. Layering on unnecessary crap just to charge a fee eventually comes home to roost. Also, passwords is a lifetime need. So 80 years x 12 months = $4,790.4 and that seems like a cost that should be reduced out of one’s lifetime. Do I want to go to Tahiti once in my life, or pay for password convenience? Again, glad you’re happy but I don’t want to live in a world where I pay $5/month for commercials versions that crowd out what should be community, OSS tools. I love curl and it’s awesome, but don’t want to pay $5/month/forever. We forget that taxes are inefficient and should be minimized where possible. A login tax for all eternity sucks.
  - nacho_weekend 5y ago
    Personally, the added foolproof security and ease of sharing with non-tech savvy family makes that cost more than worth it for me personally.
    - prepend 5y ago
      Again, I’m glad it works for you and others. I think about sustainability quite a bit and if everyone who needs password management spends what you’re comfortable spending, that’s a waste I think. And when tech stops making things cheaper and faster it’s a bit sad.
    - greyhair 5y ago
      Bingo!
  - ValentineC 5y ago
    > We forget that taxes are inefficient and should be minimized where possible. A login tax for all eternity sucks. Yes, but like in many other cases, an efficient market would mean that they will always need to be better in most aspects than whatever free, open source, or simply lower cost competitor pops up. Unless they decide to prevent people from exporting their passwords, of course — and that's a big enough dealbreaker for me that I'd move away anyway, not caring how fancy or advanced the rest of their UX is.
- mst 5y ago
  I'd vastly prefer to be able to do 'bring your own storage' but for that price I don't really see a problem with that being a "you can do that, but you pay the same subscription price anyway" feature.
  - nucleardog 5y ago
    If they let me do that (and have more than one local vault) I'd still be using 1Password. I have no particular qualms with paying for software whether as a one-time purchase or a subscription. I just don't want all my stuff syncing to and reliant on 1Password's infra. I'll pay them $5/mo to self-host my own passwords. But they won't let me. So I switched to KeepassXC.
- stereoradonc 5y ago
  Affordability is a mirage- $5 per month and $60 per year wont break a bank but its a huge amount to justify other geographies where money transactions are NOT in $$
- leokennis 5y ago
  When you have a 1Password.com subscription, you are not "working in the cloud" like with Google Docs or something. Your vault is local, and synced to/from the cloud. Basically just like Dropbox. If your internet is down and you cannot reach Dropbox, all files synced to your computer are still there, on your computer. It's just that any changes you make locally or changes made on dropbox.com cannot be synced until your connection is back.
gjs278 5y ago
enjoy when they get hacked and all your passwords leak at once
joshstrange 5y ago
I agree, I switched about a year or two ago to subscription and I'm quite happy with it. There are some apps/platforms that I believe /should/ be subscriptions and my password manager is absolutely one of those. 1Password has continually added new/better features year after year and the price is tiny compared to the value I get (and then subsequently provide to people in my 'family'). The UI is the best I've seen in a password manager and while design doesn't necessarily affect the ability for a PW manager to do it's core job, I prefer looking at pretty apps. Almost every time I use 1Password I leave with a smile/good-feeling.
notyourwork 5y ago
$20/month seems a bit steep if you ask me. Otherwise I agree with everything you said. edit: I misread and was looking at the business page. $4.99/month for family and $2.99/month for user is entirely reasonable!
- bennyp101 5y ago
  For a family (5 ppl) it was $71.82 last invoice (Dec) which is ~£50 a year. We have me, my wife, my eldest, and my mum on it - and it is indeed super simple to be able to share things around. I used to have keepas/lastpass/dashlane - but 1password is the only one I've managed to convince family members to use as well
- adoxyz 5y ago
  yeah. and I think its $50/year. It's the one sub that I'm happy to pay.
  - mst 5y ago
    Plus they have a 'pay $99 once, get $150 in credit' option which makes it work out even cheaper if you're happy to do that.
    - stereoradonc 5y ago
      Can you share the link? I haven't seen it.
      - mst 5y ago
        That was announced as part of the post that we're discussing. Not sure where the signup link is, sorry.
runlevel1 5y ago
I'd be ok with paying an annual fee for the app. What I have zero interest in is increasing my attack surface solely for their bottom line. I'm also increasingly uncomfortable with the company handling my passwords engaging in the sort of spin and dark patters we've seen from AgileBits in the past few years.
- FreezerburnV 5y ago
  I'm curious about how you see the attack surface increasing when using 1Password. My knowledge of how it works is that it always stores your passwords in an encrypted blob that can only be decrypted with a combination of username, "master password", and vault password. So no matter if it's in Dropbox, 1Password's servers, or your own hard drive, if anyone obtains a copy of the password file they still have to crack it before they gain access to anything. Also I see your reply has been downvoted enough to become grey. (EDIT: Looks like between starting writing this and submitting it, you're no longer in the gray from downvotes!) I imagine it's because you made a blanket claim about spin and dark patterns without any supporting evidence. I'd be curious to know what you're referring to since I don't really keep an eagle eye on this stuff, I just use their product. The one thing I do remember in the vein of "dark patterns" is how they effectively hid the method of doing a one-time payment for 1Password where you have to manage syncing and backing up the password file yourself. Seeing as I have no reason currently to do anything but make a charitable read of that situation which has been decried more than once on HN, I'd be willing to bet they did so for the following reason: They have had many problems in the past where a customer has lost a password file because they were not a power user and did something such as keep it on one hard drive in their only computer. (reinstalled windows, hard drive died, etc.) So they wanted to make something that would prevent that from happening for the vast majority of their customers that don't really understand stuff like backups, or don't have Dropbox, or who aren't part of Apple's ecosystem and have iCloud, etc. so that their passwords will remain safe and secure. So they made their own sync service and hid the version that would do local-only files so that only the dedicated users who really want to do that would find it and use it. OR alternatively they're a bunch of greedy people that just want to hoover up dollars from our wallets, as people love to accuse them of here. Maybe a little of column A and column B, honestly. Something something needing to ensure they have a company that stays in the black without wanting to absolutely bloat up their own software so it becomes another useless Enterprise(TM) application with each passing paid version. Also the only affiliation I have with 1Password is I have a friend I recently learned works for them, otherwise I'm just a customer. I just got into one of my little ADHD focuses where I really wanted to reply with something long and detailed, so please don't assume I work for them or something and am defending them because of that :)
mynameisvlad 5y ago
100% same. I've been a happy subscriber for years now, and recently switched to the Family plan to try and get my parents to start taking security a bit more seriously.
thallavajhula 5y ago
I've been using 1Password for 3 years now. Been paying $35/year and I'm with you on this one. I really like their service. The integrations are great. I rarely use their Mac app. I use my Apple Watch to unlock 1Password in my browser. That for me, is a game changer. It's such a seamless experience. I'm a happy customer and I love the service.
- robbiep 5y ago
  I didn’t know this is a thing… I’ll have to look into it - thanks
- slipperlobster 5y ago
  > I use my Apple Watch to unlock 1Password in my browser. Can you point me to where this gets set up? I'd love to do this.
  - thallavajhula 5y ago
    1. Open 1Password Mac app 2. Go to Preferences > Security > Apple Watch (there's also option to enable Touch ID) and enable it Make sure you have your browser 1Password plugin updated to the latest version. When you click on the locked 1Password icon in the browser, you get the "Double click to approve" alert on your Apple Watch. You double click the side button on your watch and 1Password in your browser is now unlocked. This also works the same way with Touch ID. Hope that helps. Cheers. edit: Provided clarity regarding the Mac App
    - slipperlobster 5y ago
      Perfect - thank you! I don't know how I missed this.
  - atonse 5y ago
    This feature was a game changer for me and my Mac mini without Touch ID or Face ID
falcolas 5y ago
I come at it from a slightly different angle. I got in when it was syncing via Dropbox and iCloud, and it worked perfectly fine. The switch to a subscription service is a forced downgrade for me; it's putting functionality I already have behind a subscription. This is particularly an issue since the old versions (versions I paid for, mind you) are slowly going away (typically as a recompilation and submission is required to keep them available on iOS devices).
- city41 5y ago
  I'm somewhere in between. I also paid for a non subscription version and I also feel like I was forced to upgrade to the subscription. Sadly switching password managers, especially if you share with a family, is really painful. We now pay the subscription, a tad begrudgingly, but I have to admit 1Password overall does a great job.
  - chrischen 5y ago
    Bitwarden can 1-click import 1Password vaults.
    - geerlingguy 5y ago
      That pushes me even further towards going that route. It looks like it requires an export-than-import though? https://bitwarden.com/help/article/import-from-1password/ https://bitwarden.com/help/article/import-from-1password/
      - wlesieutre 5y ago
        It’s not a complete import, you’ll get usernames and passwords but if you’ve done anything else with it (like say attaching software license files, scans of important documents, etc) they’ll be silently dropped. Most record types (software license, wireless router, documents, drivers licenses, email accounts, membership, passports, maybe more) don’t exist in Bitwarden. I’m not sure what happens with all of those, maybe transformed into secure note, but again with all of the attachments removed. The lack of categories is also a nuisance for organization, you can create folders but have to manage it manually. I’m still glad I switched, having bought 1Password on a bunch of platforms and a bunch of paid upgrades before it turned into a subscription. It probably would have been less money if it had been a subscription from the start with all the times I bought it. Maybe it’s irrational, I just don’t like being so dependent on a subscription service, and having a local network sync between my devices was just fine. Same reason Lightroom can pound sand with their $120/year licensing, I’m not going to keep my photo library in something that I just have to keep paying for the rest of my life. Bitwarden is good enough for me, with 1Password as a subscription you can look at it and realize “this is going to be $36/year forever.” If I spent any time in it, might be worth the expense. I’ve bought a lot of software and I don’t mind paying for good software. But I’ve moved the things that were attachments to an encrypted disk image, and 99% of my password manager interaction is via auto fill so I don’t actually care how polished the UI is. Family sharing would be a more compelling reason to stick with it if you’re using that.
MrStonedOne 5y ago
I think the issue people have is YetAnotherCompany:tm: forcing you into their subscription walled garden. And also from a user security standpoint, i don't think we can keep going on making enhancements to user security good practice habits if we gate keep good password habits behind paywalls.
burnte 5y ago
I'll be an outlier with you. I install the app where every I am, authenticate, and BAM, I have my passwords. So easy even a caveman could do it. I've been a happy subscriber for years.
hosh 5y ago
Same. I share my passwords with my wife and sync them across devices. I also have a license for an older standalone app. I don’t feel cheated. I wanted to be able to share some passwords with other people. I saw something mentioned about self-hosted vaults. That is something I might consider for my family. I advocated for the use of 1pass at work precisely because we can share strong passwords with the team. Otherwise, people would just use the same, well-known weak passwords for everything, including business critical ones like domain registrar or Gsuite admin or the root AWS account. I am not as happy about having another Electron app running on my local box. I hope they spent time locking things down. On the other hand, if it means my wife (on Windows) gets feature parity with my macOS client, that would be good. Even better if the Linux desktop gets feature parity and no longer have to rely on the web or browser plugin.
jw1224 5y ago
1Password’s 2FA OTP auto-fill is such a blessing. It saves me so much time compared to how I used to have to do it — pull out phone, unlock, open Authy, wait forever for it to load, type in code, put phone away… It’s the little things that all add up. I’m very happy with 1Password — been using it for 10 years, and happy to subscribe, considering it’s probably my most-used utility app.
- andrecarini 5y ago
  > 1Password’s 2FA OTP auto-fill is such a blessing. Until your vault is somehow compromised and your second factor is no longer distinct from the first one...
  - mdaniel 5y ago
    I am cognizant of this risk, and assume it, because security is always a spectrum between Secure and Convenient. If I had to pull out my phone every time I wanted to use 2FA, I for sure would not be so liberal to turn it on for all the "low value" properties the way I do now I have never even _heard_ of someone having their 1P master password compromised and the vault(s) exfiltrated (although I grant you it could be just because the NSA doesn't write blog posts about their pwn2own victories) It's my recollection AgileBits is also running (that is: currently) a CTF with a publicly exposed vault, so folks can test the resilience against attack for themselves
    - andrecarini 5y ago
      > I am cognizant of this risk, and assume it, because security is always a spectrum between Secure and Convenient. Absolutely. But also, in such setup, the security benefit of 2FA/OTP codes are negligible at best since there are no conditions under which only one factor could be compromised without also having the other factor leaked (assuming you're using unique passwords for each identity, which is the entire point of a password manager). However, I suppose it could be used for bypassing the inconvenience of mandated 2FA scenarios (to the dismay of your company's security team).
sylens 5y ago
I agree with all of your points - I'm okay with their sub model, I'm okay with Electron and it's the first time I was able to convince family members to use a password manager (because it works so well)
staticassertion 5y ago
Yeah, same. This is fine by me and changes nothing for me as a customer.
munchbunny 5y ago
I think removing the self-managed data store feature makes sense even if not everyone likes it. It removes a source of architectural complexity, and most users aren't looking for local storage anyway. Personally, the problem of managing reliable persistence of my password database just isn't something I want to spend time on, and the incremental difference in security posture is uninteresting to me given that it's encrypted at rest anyway. In terms of waking hours spent worrying about the security of my household IT, the security and persistence of sensitive documents (mainly vs. ransomware) is a bigger problem and I like that my passwords aren't tied up in that mess.
- swiley 5y ago
  >I think removing feature X makes sense, even if people are using it. It just makes the developers job way easier. And that's why I only use community maintained software with no telemetry or "data driven decisions."
- sleepybrett 5y ago
  psst i'm not paying for the software to make their lives easier. I'm paying for the software for the features.
ShakataGaNai 5y ago
I'm with you. It's seemless, it works (on everyplatform) and it's easy to use. At the end of the day if you want a password vault that is sync'd across devices, you're trusting someone...somewhere. Be that 1password, dropbox, or even that Linode you manually rsync your data to. You've got to decide what is the biggest risk for your own personal use cases. For me, I'd rather store my sensitive data with a company that has demonstrated a repeated push to keep my data as secure as possible, even from itself. It's their core business, all they focus on.
fossuser 5y ago
Agreed - software like this doesn't exist in a vacuum of frozen dependencies (at least not until Urbit takes over). Subscription models make sense for stuff that requires updates over time to keep it working. Their stuff is reasonably priced and the product has been really good for years (imo). I suppose they could do something like JetBrains where you get updates while subscribed, but realistically login breaks for users would be a mess to support and a standalone text editor is a different service. This move makes sense to me given their market. Those that want to run a vault can use an alternative that's more of a hassle to deal with.
cirrus3 5y ago
Agree. 1Password is one of the software subscriptions I have no regret paying for.
sanderjd 5y ago
Yep, long time 1password user and recommender. None of this bothers me.
deleted 5y ago
[deleted]

ValentineC 5y ago

I'm perfectly happy with paying a subscription, and think $4.99/month for 5 people is affordable. What I'm not happy with is the possibility of password access being limited or sync breaking if 1Password servers go down. At least with Dropbox (iCloud, wifi) sync, I have full control over the local vault file. Ultimately, it might be mostly about ownership and choice for me.

auslegung 5y ago
If the servers go down you'll never lose access to anything. You would lose sync while the servers were down but you would be able to access everything you already had on every device.
DavideNL 5y ago
Also I think the "head" of the family can reset passwords of the other accounts...
- DavideNL 5y ago
  Not sure why I'm being downvoted...: https://support.1password.com/recovery/ https://support.1password.com/recovery/ Ps. They can delete accounts too: https://support.1password.com/add-remove-family-members/ https://support.1password.com/add-remove-family-members/
  - ValentineC 5y ago
    > Ps. They can delete accounts too: https://support.1password.com/add-remove-family-members/ https://support.1password.com/add-remove-family-members/ This makes losing local vault support an even bigger cause for alarm: > After you remove a family member’s account, they can’t sign in to 1Password, which means: > They lose all the items in their Private vault. Because the items weren’t shared with any other family members, no one will be able to access them. Imagine: the access credentials of the administrator gets compromised, and the entire's family's digital life, stored on 1Password, gets wiped by the malicious actor. The attack surface would be limited if instead, the removed user's license turns into a read-only one, like how 1Password currently deals with people using local vaults, and are not on a subscription.
    - romwell 5y ago
      More pragmatically, that's a prime opportunity for some to make a nasty divorce quite a bit more nasty. Big, big nope right there, thanks.
    - staticassertion 5y ago
      So don't use the family plan?
      - ValentineC 5y ago
        It's not a problem right now with 1Password 7, because family members are (as far as I know) able to use local vaults too.
      - DavideNL 5y ago
        ...which makes the subscription even more expensive.
prepend 5y ago
> $4.99/month for 5 people is affordable. I’m glad you find it affordable but these nickle and dime things add up. Especially when the product fits into $0 software so $4.99 is infinitely higher than $0. I feel like these small, “affordable,” services are just whittling away the Unix philosophy of do one small thing well. Layering on unnecessary crap just to charge a fee eventually comes home to roost. Also, passwords is a lifetime need. So 80 years x 12 months = $4,790.4 and that seems like a cost that should be reduced out of one’s lifetime. Do I want to go to Tahiti once in my life, or pay for password convenience? Again, glad you’re happy but I don’t want to live in a world where I pay $5/month for commercials versions that crowd out what should be community, OSS tools. I love curl and it’s awesome, but don’t want to pay $5/month/forever. We forget that taxes are inefficient and should be minimized where possible. A login tax for all eternity sucks.
- nacho_weekend 5y ago
  Personally, the added foolproof security and ease of sharing with non-tech savvy family makes that cost more than worth it for me personally.
  - prepend 5y ago
    Again, I’m glad it works for you and others. I think about sustainability quite a bit and if everyone who needs password management spends what you’re comfortable spending, that’s a waste I think. And when tech stops making things cheaper and faster it’s a bit sad.
  - greyhair 5y ago
    Bingo!
- ValentineC 5y ago
  > We forget that taxes are inefficient and should be minimized where possible. A login tax for all eternity sucks. Yes, but like in many other cases, an efficient market would mean that they will always need to be better in most aspects than whatever free, open source, or simply lower cost competitor pops up. Unless they decide to prevent people from exporting their passwords, of course — and that's a big enough dealbreaker for me that I'd move away anyway, not caring how fancy or advanced the rest of their UX is.
mst 5y ago
I'd vastly prefer to be able to do 'bring your own storage' but for that price I don't really see a problem with that being a "you can do that, but you pay the same subscription price anyway" feature.
- nucleardog 5y ago
  If they let me do that (and have more than one local vault) I'd still be using 1Password. I have no particular qualms with paying for software whether as a one-time purchase or a subscription. I just don't want all my stuff syncing to and reliant on 1Password's infra. I'll pay them $5/mo to self-host my own passwords. But they won't let me. So I switched to KeepassXC.
stereoradonc 5y ago
Affordability is a mirage- $5 per month and $60 per year wont break a bank but its a huge amount to justify other geographies where money transactions are NOT in $$
leokennis 5y ago
When you have a 1Password.com subscription, you are not "working in the cloud" like with Google Docs or something. Your vault is local, and synced to/from the cloud. Basically just like Dropbox. If your internet is down and you cannot reach Dropbox, all files synced to your computer are still there, on your computer. It's just that any changes you make locally or changes made on dropbox.com cannot be synced until your connection is back.

gjs278 5y ago

enjoy when they get hacked and all your passwords leak at once

joshstrange 5y ago

I agree, I switched about a year or two ago to subscription and I'm quite happy with it. There are some apps/platforms that I believe /should/ be subscriptions and my password manager is absolutely one of those. 1Password has continually added new/better features year after year and the price is tiny compared to the value I get (and then subsequently provide to people in my 'family'). The UI is the best I've seen in a password manager and while design doesn't necessarily affect the ability for a PW manager to do it's core job, I prefer looking at pretty apps. Almost every time I use 1Password I leave with a smile/good-feeling.

notyourwork 5y ago

$20/month seems a bit steep if you ask me. Otherwise I agree with everything you said. edit: I misread and was looking at the business page. $4.99/month for family and $2.99/month for user is entirely reasonable!

bennyp101 5y ago
For a family (5 ppl) it was $71.82 last invoice (Dec) which is ~£50 a year. We have me, my wife, my eldest, and my mum on it - and it is indeed super simple to be able to share things around. I used to have keepas/lastpass/dashlane - but 1password is the only one I've managed to convince family members to use as well
adoxyz 5y ago
yeah. and I think its $50/year. It's the one sub that I'm happy to pay.
- mst 5y ago
  Plus they have a 'pay $99 once, get $150 in credit' option which makes it work out even cheaper if you're happy to do that.
  - stereoradonc 5y ago
    Can you share the link? I haven't seen it.
    - mst 5y ago
      That was announced as part of the post that we're discussing. Not sure where the signup link is, sorry.

runlevel1 5y ago

I'd be ok with paying an annual fee for the app. What I have zero interest in is increasing my attack surface solely for their bottom line. I'm also increasingly uncomfortable with the company handling my passwords engaging in the sort of spin and dark patters we've seen from AgileBits in the past few years.

FreezerburnV 5y ago
I'm curious about how you see the attack surface increasing when using 1Password. My knowledge of how it works is that it always stores your passwords in an encrypted blob that can only be decrypted with a combination of username, "master password", and vault password. So no matter if it's in Dropbox, 1Password's servers, or your own hard drive, if anyone obtains a copy of the password file they still have to crack it before they gain access to anything. Also I see your reply has been downvoted enough to become grey. (EDIT: Looks like between starting writing this and submitting it, you're no longer in the gray from downvotes!) I imagine it's because you made a blanket claim about spin and dark patterns without any supporting evidence. I'd be curious to know what you're referring to since I don't really keep an eagle eye on this stuff, I just use their product. The one thing I do remember in the vein of "dark patterns" is how they effectively hid the method of doing a one-time payment for 1Password where you have to manage syncing and backing up the password file yourself. Seeing as I have no reason currently to do anything but make a charitable read of that situation which has been decried more than once on HN, I'd be willing to bet they did so for the following reason: They have had many problems in the past where a customer has lost a password file because they were not a power user and did something such as keep it on one hard drive in their only computer. (reinstalled windows, hard drive died, etc.) So they wanted to make something that would prevent that from happening for the vast majority of their customers that don't really understand stuff like backups, or don't have Dropbox, or who aren't part of Apple's ecosystem and have iCloud, etc. so that their passwords will remain safe and secure. So they made their own sync service and hid the version that would do local-only files so that only the dedicated users who really want to do that would find it and use it. OR alternatively they're a bunch of greedy people that just want to hoover up dollars from our wallets, as people love to accuse them of here. Maybe a little of column A and column B, honestly. Something something needing to ensure they have a company that stays in the black without wanting to absolutely bloat up their own software so it becomes another useless Enterprise(TM) application with each passing paid version. Also the only affiliation I have with 1Password is I have a friend I recently learned works for them, otherwise I'm just a customer. I just got into one of my little ADHD focuses where I really wanted to reply with something long and detailed, so please don't assume I work for them or something and am defending them because of that :)

mynameisvlad 5y ago

100% same. I've been a happy subscriber for years now, and recently switched to the Family plan to try and get my parents to start taking security a bit more seriously.

thallavajhula 5y ago

I've been using 1Password for 3 years now. Been paying $35/year and I'm with you on this one. I really like their service. The integrations are great. I rarely use their Mac app. I use my Apple Watch to unlock 1Password in my browser. That for me, is a game changer. It's such a seamless experience. I'm a happy customer and I love the service.

robbiep 5y ago
I didn’t know this is a thing… I’ll have to look into it - thanks
slipperlobster 5y ago
> I use my Apple Watch to unlock 1Password in my browser. Can you point me to where this gets set up? I'd love to do this.
- thallavajhula 5y ago
  1. Open 1Password Mac app 2. Go to Preferences > Security > Apple Watch (there's also option to enable Touch ID) and enable it Make sure you have your browser 1Password plugin updated to the latest version. When you click on the locked 1Password icon in the browser, you get the "Double click to approve" alert on your Apple Watch. You double click the side button on your watch and 1Password in your browser is now unlocked. This also works the same way with Touch ID. Hope that helps. Cheers. edit: Provided clarity regarding the Mac App
  - slipperlobster 5y ago
    Perfect - thank you! I don't know how I missed this.
- atonse 5y ago
  This feature was a game changer for me and my Mac mini without Touch ID or Face ID

falcolas 5y ago

I come at it from a slightly different angle. I got in when it was syncing via Dropbox and iCloud, and it worked perfectly fine. The switch to a subscription service is a forced downgrade for me; it's putting functionality I already have behind a subscription. This is particularly an issue since the old versions (versions I paid for, mind you) are slowly going away (typically as a recompilation and submission is required to keep them available on iOS devices).

city41 5y ago
I'm somewhere in between. I also paid for a non subscription version and I also feel like I was forced to upgrade to the subscription. Sadly switching password managers, especially if you share with a family, is really painful. We now pay the subscription, a tad begrudgingly, but I have to admit 1Password overall does a great job.
- chrischen 5y ago
  Bitwarden can 1-click import 1Password vaults.
  - geerlingguy 5y ago
    That pushes me even further towards going that route. It looks like it requires an export-than-import though? https://bitwarden.com/help/article/import-from-1password/ https://bitwarden.com/help/article/import-from-1password/
    - wlesieutre 5y ago
      It’s not a complete import, you’ll get usernames and passwords but if you’ve done anything else with it (like say attaching software license files, scans of important documents, etc) they’ll be silently dropped. Most record types (software license, wireless router, documents, drivers licenses, email accounts, membership, passports, maybe more) don’t exist in Bitwarden. I’m not sure what happens with all of those, maybe transformed into secure note, but again with all of the attachments removed. The lack of categories is also a nuisance for organization, you can create folders but have to manage it manually. I’m still glad I switched, having bought 1Password on a bunch of platforms and a bunch of paid upgrades before it turned into a subscription. It probably would have been less money if it had been a subscription from the start with all the times I bought it. Maybe it’s irrational, I just don’t like being so dependent on a subscription service, and having a local network sync between my devices was just fine. Same reason Lightroom can pound sand with their $120/year licensing, I’m not going to keep my photo library in something that I just have to keep paying for the rest of my life. Bitwarden is good enough for me, with 1Password as a subscription you can look at it and realize “this is going to be $36/year forever.” If I spent any time in it, might be worth the expense. I’ve bought a lot of software and I don’t mind paying for good software. But I’ve moved the things that were attachments to an encrypted disk image, and 99% of my password manager interaction is via auto fill so I don’t actually care how polished the UI is. Family sharing would be a more compelling reason to stick with it if you’re using that.

MrStonedOne 5y ago

I think the issue people have is YetAnotherCompany:tm: forcing you into their subscription walled garden. And also from a user security standpoint, i don't think we can keep going on making enhancements to user security good practice habits if we gate keep good password habits behind paywalls.

burnte 5y ago

I'll be an outlier with you. I install the app where every I am, authenticate, and BAM, I have my passwords. So easy even a caveman could do it. I've been a happy subscriber for years.

hosh 5y ago

Same. I share my passwords with my wife and sync them across devices. I also have a license for an older standalone app. I don’t feel cheated. I wanted to be able to share some passwords with other people. I saw something mentioned about self-hosted vaults. That is something I might consider for my family. I advocated for the use of 1pass at work precisely because we can share strong passwords with the team. Otherwise, people would just use the same, well-known weak passwords for everything, including business critical ones like domain registrar or Gsuite admin or the root AWS account. I am not as happy about having another Electron app running on my local box. I hope they spent time locking things down. On the other hand, if it means my wife (on Windows) gets feature parity with my macOS client, that would be good. Even better if the Linux desktop gets feature parity and no longer have to rely on the web or browser plugin.

jw1224 5y ago

1Password’s 2FA OTP auto-fill is such a blessing. It saves me so much time compared to how I used to have to do it — pull out phone, unlock, open Authy, wait forever for it to load, type in code, put phone away… It’s the little things that all add up. I’m very happy with 1Password — been using it for 10 years, and happy to subscribe, considering it’s probably my most-used utility app.

andrecarini 5y ago
> 1Password’s 2FA OTP auto-fill is such a blessing. Until your vault is somehow compromised and your second factor is no longer distinct from the first one...
- mdaniel 5y ago
  I am cognizant of this risk, and assume it, because security is always a spectrum between Secure and Convenient. If I had to pull out my phone every time I wanted to use 2FA, I for sure would not be so liberal to turn it on for all the "low value" properties the way I do now I have never even _heard_ of someone having their 1P master password compromised and the vault(s) exfiltrated (although I grant you it could be just because the NSA doesn't write blog posts about their pwn2own victories) It's my recollection AgileBits is also running (that is: currently) a CTF with a publicly exposed vault, so folks can test the resilience against attack for themselves
  - andrecarini 5y ago
    > I am cognizant of this risk, and assume it, because security is always a spectrum between Secure and Convenient. Absolutely. But also, in such setup, the security benefit of 2FA/OTP codes are negligible at best since there are no conditions under which only one factor could be compromised without also having the other factor leaked (assuming you're using unique passwords for each identity, which is the entire point of a password manager). However, I suppose it could be used for bypassing the inconvenience of mandated 2FA scenarios (to the dismay of your company's security team).

sylens 5y ago

I agree with all of your points - I'm okay with their sub model, I'm okay with Electron and it's the first time I was able to convince family members to use a password manager (because it works so well)

staticassertion 5y ago

Yeah, same. This is fine by me and changes nothing for me as a customer.

munchbunny 5y ago

I think removing the self-managed data store feature makes sense even if not everyone likes it. It removes a source of architectural complexity, and most users aren't looking for local storage anyway. Personally, the problem of managing reliable persistence of my password database just isn't something I want to spend time on, and the incremental difference in security posture is uninteresting to me given that it's encrypted at rest anyway. In terms of waking hours spent worrying about the security of my household IT, the security and persistence of sensitive documents (mainly vs. ransomware) is a bigger problem and I like that my passwords aren't tied up in that mess.

swiley 5y ago
>I think removing feature X makes sense, even if people are using it. It just makes the developers job way easier. And that's why I only use community maintained software with no telemetry or "data driven decisions."
sleepybrett 5y ago
psst i'm not paying for the software to make their lives easier. I'm paying for the software for the features.

ShakataGaNai 5y ago

I'm with you. It's seemless, it works (on everyplatform) and it's easy to use. At the end of the day if you want a password vault that is sync'd across devices, you're trusting someone...somewhere. Be that 1password, dropbox, or even that Linode you manually rsync your data to. You've got to decide what is the biggest risk for your own personal use cases. For me, I'd rather store my sensitive data with a company that has demonstrated a repeated push to keep my data as secure as possible, even from itself. It's their core business, all they focus on.

fossuser 5y ago

Agreed - software like this doesn't exist in a vacuum of frozen dependencies (at least not until Urbit takes over). Subscription models make sense for stuff that requires updates over time to keep it working. Their stuff is reasonably priced and the product has been really good for years (imo). I suppose they could do something like JetBrains where you get updates while subscribed, but realistically login breaks for users would be a mess to support and a standalone text editor is a different service. This move makes sense to me given their market. Those that want to run a vault can use an alternative that's more of a hassle to deal with.

cirrus3 5y ago

Agree. 1Password is one of the software subscriptions I have no regret paying for.

sanderjd 5y ago

Yep, long time 1password user and recommender. None of this bothers me.

deleted 5y ago

[deleted]