8 ms·

When LastPass was acquired a few years back, I saw the writing on the wall and changed to 1Password. Thank goodness I dodged this bullet.

by efitz 5y ago

TAForObvReasons 5y ago
1Password is another proprietary SaaS password manager. You "dodged this bullet" but shouldn't you also be concerned that 1P will do the same thing in the future?
- mplewis 5y ago
  > When LastPass was acquired Maybe, if someone acquires 1Password?
  - InGoodFaith 5y ago
    The company vision can change even without acquisition. Having an open source and self-hsotable alternative (that also has a SaaS equivalent if you so choose) seems to be the more prudent choice.
- Xylakant 5y ago
  1password explicitly say what happens if your subscription lapses; your account will be frozen and placed in a read only state: https://support.1password.com/frozen-account/ https://support.1password.com/frozen-account/ Now, the question is “why would I trust this?” to which I answer: I trust them to safeguard my passwords.
  - Qub3d 5y ago
    > Now, the question is “why would I trust this?” to which I answer: I trust them to safeguard my passwords. Isn't that tautological? I trust 1Password more than LastPass simply because you _must_ pay for it. Freemium upsells are a dark pattern, and the temptation to monetize data on free users is much greater than paid.
    - TAForObvReasons 5y ago
      > I trust 1Password more than LastPass simply because you _must_ pay for it The ultimate problem with this whole logic is that you trust that other individuals and companies are not tempted to "double-dip" by monetizing data on paying users. A comment in the reddit thread referenced in the article summarizes the problem neatly: > These SaaS cloud services are completely unregulated and answer to no one except their own profits. They can and will hold your data hostage the moment they think they can do so profitably on a large scale. It doesn't matter whether you're paying for the service or not. https://old.reddit.com/r/software/comments/s053t3/lastpass_is_holding_peoples_data_hostage_and_it/hrzmkrt/ https://old.reddit.com/r/software/comments/s053t3/lastpass_i...
      - Closi 5y ago
        > The ultimate problem with this whole logic is that you trust that other individuals and companies are not tempted to "double-dip" by monetizing data on paying users. A comment in the reddit thread referenced in the article summarizes the problem neatly: I don't think the logic is wholly broken - there will be a lower incentive for paid companies who can generate a profit with subscription fees to "double-dip" than there is for free companies to "single-dip" (who need to dip to survive). It's all about relative risk between those two models - if company A has a business model that can work without doing shady shit, and company B has a business model that can only work if they do shady shit, then company B will be more likely to do shady shit in reality.
      - Qub3d 5y ago
        True, which is why I switched from 1Password to Bitwarden about 6 months ago. If you told me my options were between LastPass and 1Password, I would rather use a physical pen & paper than LastPass, but I would at least be able to live with 1Password.
- specialp 5y ago
  There is nothing wrong with a proprietary SaaS password manager if: 1. You can export all of your data easily 2. They cannot see your data (E2E encryption with you holding the key) You get the benefits of people making money off this service and thus keeping up to date clients and plugins. If it becomes bad you dump your data and go somewhere else.
  - the_snooze 5y ago
    I quite like the fact that 1PW has a very simple business proposition: I give them money, and they safeguard my passwords. And if I don't like their service, I can easily export my stuff and not renew my subscription. There are no growth hacks involved.
  - approxim8ion 5y ago
    I tend to agree, but the E2EE part can only be verified if their clients are not proprietary. The SaaS part isn't a huge issue as long as there is no lock-in, as you mentioned.
- bcrosby95 5y ago
  My #1 priority is a manager that my family can easily figure out how to use it. The alternative is easily hackable passwords.
  - smoldesu 5y ago
    Which is easier to use: LastPass or CorrectHorseBatteryStaple?
    - kingnothing 5y ago
      LastPass, unless you're able to memorize 200 different unique, complex passwords. Using a password "scheme" per site (like CorrectHorseBatteryStapleHN, CorrectHorseBatteryStapleReddit) is not safe.
    - mttjj 5y ago
      A password manager. A much as I like CorrectHorseBatteryStaple, it would be impossible to use on every account I have (hundreds). I use CHBS for the few (5 at most) accounts that I log into all day, every day. Everything else gets a long, random string of garbage and stored in my password manager.
    - admax88qqq 5y ago
      LastPass Cause most services still require arcane rules like "must have a number, an upper and lowercase letter, and 2 symbol but not on Thursdays"
      - mrtranscendence 5y ago
        I use the CorrectHorseBatteryStaple format, but with a short string of digits/symbols at the end to satisfy picky rules. This generally seems to work. But since I use a different password for every website I don't see how I could not use a password manager of some sort ... making passwords easier to type and remember doesn't mean I'm going to remember them all.
    - function_seven 5y ago
- joconde 5y ago
  1Password on desktop stores items in a standard SQLite database, in an open format: https://support.1password.com/1password-security/#transparency https://support.1password.com/1password-security/#transparen... They also store regular copies of your vault in a backup folder. If Satan buys them and they try to lock you out, just decrypt your backups and move somewhere else.
halfmatthalfcat 5y ago
I moved to 1PW after the first LastPass leak, was the best decision I ever made.
- jwineinger 5y ago
  I switched after the ~thanksgiving multi-day outage a few years ago. I've been happy with that decision as well
mijoharas 5y ago
Doing the same was on my TODO list for a long time, and I just migrated a couple of weeks ago. Very glad I finally got around to it!
l30n4da5 5y ago
I moved to Bitwarden. Solid choice, as well.
mrtranscendence 5y ago
My girlfriend has been using 1Password for years without any issue, so I think it must be a decent service, at least in her book. The built-in password management on iOS and macOS has been good enough for me, though.
cassac 5y ago
1Password is moving in a direction just as bad. A few months ago they took away features for legacy single paid users and started hiding them behind the monthly paywall.
- petarb 5y ago
  Just curious, what were some of those features?
  - prdonahue 5y ago
    The newest version removed the ability to use a local repo (on iCloud, etc.) and they force you to use their monthly cloud service vs. buying outright. See here for more details: https://news.ycombinator.com/item?id=28145247 https://news.ycombinator.com/item?id=28145247.

When LastPass was acquired a few years back, I saw the writing on the wall and changed to 1Password. Thank goodness I dodged this bullet.

by efitz 5y ago

When LastPass was acquired a few years back, I saw the writing on the wall and changed to 1Password. Thank goodness I dodged this bullet.

TAForObvReasons 5y ago

1Password is another proprietary SaaS password manager. You "dodged this bullet" but shouldn't you also be concerned that 1P will do the same thing in the future?

mplewis 5y ago
> When LastPass was acquired Maybe, if someone acquires 1Password?
- InGoodFaith 5y ago
  The company vision can change even without acquisition. Having an open source and self-hsotable alternative (that also has a SaaS equivalent if you so choose) seems to be the more prudent choice.
Xylakant 5y ago
1password explicitly say what happens if your subscription lapses; your account will be frozen and placed in a read only state: https://support.1password.com/frozen-account/ https://support.1password.com/frozen-account/ Now, the question is “why would I trust this?” to which I answer: I trust them to safeguard my passwords.
- Qub3d 5y ago
  > Now, the question is “why would I trust this?” to which I answer: I trust them to safeguard my passwords. Isn't that tautological? I trust 1Password more than LastPass simply because you _must_ pay for it. Freemium upsells are a dark pattern, and the temptation to monetize data on free users is much greater than paid.
  - TAForObvReasons 5y ago
    > I trust 1Password more than LastPass simply because you _must_ pay for it The ultimate problem with this whole logic is that you trust that other individuals and companies are not tempted to "double-dip" by monetizing data on paying users. A comment in the reddit thread referenced in the article summarizes the problem neatly: > These SaaS cloud services are completely unregulated and answer to no one except their own profits. They can and will hold your data hostage the moment they think they can do so profitably on a large scale. It doesn't matter whether you're paying for the service or not. https://old.reddit.com/r/software/comments/s053t3/lastpass_is_holding_peoples_data_hostage_and_it/hrzmkrt/ https://old.reddit.com/r/software/comments/s053t3/lastpass_i...
    - Closi 5y ago
      > The ultimate problem with this whole logic is that you trust that other individuals and companies are not tempted to "double-dip" by monetizing data on paying users. A comment in the reddit thread referenced in the article summarizes the problem neatly: I don't think the logic is wholly broken - there will be a lower incentive for paid companies who can generate a profit with subscription fees to "double-dip" than there is for free companies to "single-dip" (who need to dip to survive). It's all about relative risk between those two models - if company A has a business model that can work without doing shady shit, and company B has a business model that can only work if they do shady shit, then company B will be more likely to do shady shit in reality.
    - Qub3d 5y ago
      True, which is why I switched from 1Password to Bitwarden about 6 months ago. If you told me my options were between LastPass and 1Password, I would rather use a physical pen & paper than LastPass, but I would at least be able to live with 1Password.
specialp 5y ago
There is nothing wrong with a proprietary SaaS password manager if: 1. You can export all of your data easily 2. They cannot see your data (E2E encryption with you holding the key) You get the benefits of people making money off this service and thus keeping up to date clients and plugins. If it becomes bad you dump your data and go somewhere else.
- the_snooze 5y ago
  I quite like the fact that 1PW has a very simple business proposition: I give them money, and they safeguard my passwords. And if I don't like their service, I can easily export my stuff and not renew my subscription. There are no growth hacks involved.
- approxim8ion 5y ago
  I tend to agree, but the E2EE part can only be verified if their clients are not proprietary. The SaaS part isn't a huge issue as long as there is no lock-in, as you mentioned.
bcrosby95 5y ago
My #1 priority is a manager that my family can easily figure out how to use it. The alternative is easily hackable passwords.
- smoldesu 5y ago
  Which is easier to use: LastPass or CorrectHorseBatteryStaple?
  - kingnothing 5y ago
    LastPass, unless you're able to memorize 200 different unique, complex passwords. Using a password "scheme" per site (like CorrectHorseBatteryStapleHN, CorrectHorseBatteryStapleReddit) is not safe.
  - mttjj 5y ago
    A password manager. A much as I like CorrectHorseBatteryStaple, it would be impossible to use on every account I have (hundreds). I use CHBS for the few (5 at most) accounts that I log into all day, every day. Everything else gets a long, random string of garbage and stored in my password manager.
  - admax88qqq 5y ago
    LastPass Cause most services still require arcane rules like "must have a number, an upper and lowercase letter, and 2 symbol but not on Thursdays"
    - mrtranscendence 5y ago
      I use the CorrectHorseBatteryStaple format, but with a short string of digits/symbols at the end to satisfy picky rules. This generally seems to work. But since I use a different password for every website I don't see how I could not use a password manager of some sort ... making passwords easier to type and remember doesn't mean I'm going to remember them all.
  - function_seven 5y ago
joconde 5y ago
1Password on desktop stores items in a standard SQLite database, in an open format: https://support.1password.com/1password-security/#transparency https://support.1password.com/1password-security/#transparen... They also store regular copies of your vault in a backup folder. If Satan buys them and they try to lock you out, just decrypt your backups and move somewhere else.

halfmatthalfcat 5y ago

I moved to 1PW after the first LastPass leak, was the best decision I ever made.

jwineinger 5y ago
I switched after the ~thanksgiving multi-day outage a few years ago. I've been happy with that decision as well

mijoharas 5y ago

Doing the same was on my TODO list for a long time, and I just migrated a couple of weeks ago. Very glad I finally got around to it!

l30n4da5 5y ago

I moved to Bitwarden. Solid choice, as well.

mrtranscendence 5y ago

My girlfriend has been using 1Password for years without any issue, so I think it must be a decent service, at least in her book. The built-in password management on iOS and macOS has been good enough for me, though.

cassac 5y ago

1Password is moving in a direction just as bad. A few months ago they took away features for legacy single paid users and started hiding them behind the monthly paywall.

petarb 5y ago
Just curious, what were some of those features?
- prdonahue 5y ago
  The newest version removed the ability to use a local repo (on iCloud, etc.) and they force you to use their monthly cloud service vs. buying outright. See here for more details: https://news.ycombinator.com/item?id=28145247 https://news.ycombinator.com/item?id=28145247.