5 ms·
1password has been audited a bazillion times. They're E2EE. They're cheap. Your master passwords aren't stored on their servers. Neither is your key information
by junon 5y ago
1password has been audited a bazillion times. They're E2EE. They're cheap. Your master passwords aren't stored on their servers. Neither is your key information.
The only thing I pay for is the managed hosting, but in theory it's not much different than anything else properly designed (e.g. bitwarden) aside from the obvious things, such as OSS-ness.
The only relevant CVEs are relatively mild compared to LastPass.
Give them some credit.
- throw10920 5y ago> Your master passwords aren't stored on their servers. Neither is your key information. ...and, those are the only things that really matter for an attacker. Encrypted data (assuming reasonably strong encryption) is useless without the key.
- postalrat 5y agoSome encrypted data is worthless. Some isn't. Depends on what value it has when down the road the encryption is broken.
- tatersolid 5y agoIf AES being broken is in your personal threat model, you have far more to worry about than passwords.
- postalrat 5y agoWhat if its broken in 10 years? Or in 50 years? Eventually it will be.
- tatersolid 5y agoI’d wager you could survey 100 cryptographers and at least 90 would say the AES-256 primitive itself will never be practically broken, even by large-scale quantum computers. Related-key attacks aren’t realistic or practical.
- junon 5y agoProperly encrypted data is worthless unless you intend to get the keys somehow. Breaking industry standard encryption schemes shouldn't be in your threat model.
- _jal 5y agoHappy to give them credit. I just refuse to give them my passwords. > The only thing I pay for is the managed hosting Funny, I was happy to pay them until they removed my ability to store it myself. edit: > CVEs are relatively mild compared to LastPass LP is not the relevant comparison. The relevant comparison is an encrypted store on my laptop.
- dylan604 5y agoI still use an older version of 1Pass specifically so I can run things locally. Sometimes, I wish I was ignorant to all of this stuff and could just be a plebe out in the wild using all of the convenient software out there. Just take the blue pill and put me back in the matrix. The knowing of all of this stuff just makes life so much more difficult.
- lathiat 5y agoMaybe look at BitWarden
- dylan604 5y agoEasy thing to suggest. However, in my experience, as soon as I decide to use a program after researching it, take the time to switch over to it, that company will then switch to a cloud based whatever. Here we are again at the same spot different name. Sometimes the devil you know, you know?
- bshipp 5y agoI'm in the same boat. I've used lastpass for years and tried a few alternatives over the time but they fell down when it came to providing access to my "vault" on different systems or architectures. The biggest benefit is lastpass generating and storing random passwords for every site and application without me having to cut and paste a thing, and having it easily accessible. That said, if their closed-source browser extension is leaking my master password to random websites I'll cut them out of my life tomorrow.