4 ms·

1Password is another proprietary SaaS password manager. You "dodged this bullet" but shouldn't you also be concerned that 1P will do the same thing in the futu

1Password is another proprietary SaaS password manager. You "dodged this bullet" but shouldn't you also be concerned that 1P will do the same thing in the future?

mplewis 5y ago
> When LastPass was acquired Maybe, if someone acquires 1Password?
- InGoodFaith 5y ago
  The company vision can change even without acquisition. Having an open source and self-hsotable alternative (that also has a SaaS equivalent if you so choose) seems to be the more prudent choice.
Xylakant 5y ago
1password explicitly say what happens if your subscription lapses; your account will be frozen and placed in a read only state: https://support.1password.com/frozen-account/ https://support.1password.com/frozen-account/ Now, the question is “why would I trust this?” to which I answer: I trust them to safeguard my passwords.
- Qub3d 5y ago
  > Now, the question is “why would I trust this?” to which I answer: I trust them to safeguard my passwords. Isn't that tautological? I trust 1Password more than LastPass simply because you _must_ pay for it. Freemium upsells are a dark pattern, and the temptation to monetize data on free users is much greater than paid.
  - TAForObvReasons 5y ago
    > I trust 1Password more than LastPass simply because you _must_ pay for it The ultimate problem with this whole logic is that you trust that other individuals and companies are not tempted to "double-dip" by monetizing data on paying users. A comment in the reddit thread referenced in the article summarizes the problem neatly: > These SaaS cloud services are completely unregulated and answer to no one except their own profits. They can and will hold your data hostage the moment they think they can do so profitably on a large scale. It doesn't matter whether you're paying for the service or not. https://old.reddit.com/r/software/comments/s053t3/lastpass_is_holding_peoples_data_hostage_and_it/hrzmkrt/ https://old.reddit.com/r/software/comments/s053t3/lastpass_i...
    - Closi 5y ago
      > The ultimate problem with this whole logic is that you trust that other individuals and companies are not tempted to "double-dip" by monetizing data on paying users. A comment in the reddit thread referenced in the article summarizes the problem neatly: I don't think the logic is wholly broken - there will be a lower incentive for paid companies who can generate a profit with subscription fees to "double-dip" than there is for free companies to "single-dip" (who need to dip to survive). It's all about relative risk between those two models - if company A has a business model that can work without doing shady shit, and company B has a business model that can only work if they do shady shit, then company B will be more likely to do shady shit in reality.
    - Qub3d 5y ago
      True, which is why I switched from 1Password to Bitwarden about 6 months ago. If you told me my options were between LastPass and 1Password, I would rather use a physical pen & paper than LastPass, but I would at least be able to live with 1Password.
specialp 5y ago
There is nothing wrong with a proprietary SaaS password manager if: 1. You can export all of your data easily 2. They cannot see your data (E2E encryption with you holding the key) You get the benefits of people making money off this service and thus keeping up to date clients and plugins. If it becomes bad you dump your data and go somewhere else.
- the_snooze 5y ago
  I quite like the fact that 1PW has a very simple business proposition: I give them money, and they safeguard my passwords. And if I don't like their service, I can easily export my stuff and not renew my subscription. There are no growth hacks involved.
- approxim8ion 5y ago
  I tend to agree, but the E2EE part can only be verified if their clients are not proprietary. The SaaS part isn't a huge issue as long as there is no lock-in, as you mentioned.
bcrosby95 5y ago
My #1 priority is a manager that my family can easily figure out how to use it. The alternative is easily hackable passwords.
- smoldesu 5y ago
  Which is easier to use: LastPass or CorrectHorseBatteryStaple?
  - kingnothing 5y ago
    LastPass, unless you're able to memorize 200 different unique, complex passwords. Using a password "scheme" per site (like CorrectHorseBatteryStapleHN, CorrectHorseBatteryStapleReddit) is not safe.
  - mttjj 5y ago
    A password manager. A much as I like CorrectHorseBatteryStaple, it would be impossible to use on every account I have (hundreds). I use CHBS for the few (5 at most) accounts that I log into all day, every day. Everything else gets a long, random string of garbage and stored in my password manager.
  - admax88qqq 5y ago
    LastPass Cause most services still require arcane rules like "must have a number, an upper and lowercase letter, and 2 symbol but not on Thursdays"
    - mrtranscendence 5y ago
      I use the CorrectHorseBatteryStaple format, but with a short string of digits/symbols at the end to satisfy picky rules. This generally seems to work. But since I use a different password for every website I don't see how I could not use a password manager of some sort ... making passwords easier to type and remember doesn't mean I'm going to remember them all.
  - function_seven 5y ago
joconde 5y ago
1Password on desktop stores items in a standard SQLite database, in an open format: https://support.1password.com/1password-security/#transparency https://support.1password.com/1password-security/#transparen... They also store regular copies of your vault in a backup folder. If Satan buys them and they try to lock you out, just decrypt your backups and move somewhere else.

1Password is another proprietary SaaS password manager. You "dodged this bullet" but shouldn't you also be concerned that 1P will do the same thing in the future?

mplewis 5y ago

> When LastPass was acquired Maybe, if someone acquires 1Password?

InGoodFaith 5y ago
The company vision can change even without acquisition. Having an open source and self-hsotable alternative (that also has a SaaS equivalent if you so choose) seems to be the more prudent choice.

Xylakant 5y ago

1password explicitly say what happens if your subscription lapses; your account will be frozen and placed in a read only state: https://support.1password.com/frozen-account/ https://support.1password.com/frozen-account/ Now, the question is “why would I trust this?” to which I answer: I trust them to safeguard my passwords.

Qub3d 5y ago
> Now, the question is “why would I trust this?” to which I answer: I trust them to safeguard my passwords. Isn't that tautological? I trust 1Password more than LastPass simply because you _must_ pay for it. Freemium upsells are a dark pattern, and the temptation to monetize data on free users is much greater than paid.
- TAForObvReasons 5y ago
  > I trust 1Password more than LastPass simply because you _must_ pay for it The ultimate problem with this whole logic is that you trust that other individuals and companies are not tempted to "double-dip" by monetizing data on paying users. A comment in the reddit thread referenced in the article summarizes the problem neatly: > These SaaS cloud services are completely unregulated and answer to no one except their own profits. They can and will hold your data hostage the moment they think they can do so profitably on a large scale. It doesn't matter whether you're paying for the service or not. https://old.reddit.com/r/software/comments/s053t3/lastpass_is_holding_peoples_data_hostage_and_it/hrzmkrt/ https://old.reddit.com/r/software/comments/s053t3/lastpass_i...
  - Closi 5y ago
    > The ultimate problem with this whole logic is that you trust that other individuals and companies are not tempted to "double-dip" by monetizing data on paying users. A comment in the reddit thread referenced in the article summarizes the problem neatly: I don't think the logic is wholly broken - there will be a lower incentive for paid companies who can generate a profit with subscription fees to "double-dip" than there is for free companies to "single-dip" (who need to dip to survive). It's all about relative risk between those two models - if company A has a business model that can work without doing shady shit, and company B has a business model that can only work if they do shady shit, then company B will be more likely to do shady shit in reality.
  - Qub3d 5y ago
    True, which is why I switched from 1Password to Bitwarden about 6 months ago. If you told me my options were between LastPass and 1Password, I would rather use a physical pen & paper than LastPass, but I would at least be able to live with 1Password.

specialp 5y ago

There is nothing wrong with a proprietary SaaS password manager if: 1. You can export all of your data easily 2. They cannot see your data (E2E encryption with you holding the key) You get the benefits of people making money off this service and thus keeping up to date clients and plugins. If it becomes bad you dump your data and go somewhere else.

the_snooze 5y ago
I quite like the fact that 1PW has a very simple business proposition: I give them money, and they safeguard my passwords. And if I don't like their service, I can easily export my stuff and not renew my subscription. There are no growth hacks involved.
approxim8ion 5y ago
I tend to agree, but the E2EE part can only be verified if their clients are not proprietary. The SaaS part isn't a huge issue as long as there is no lock-in, as you mentioned.

bcrosby95 5y ago

My #1 priority is a manager that my family can easily figure out how to use it. The alternative is easily hackable passwords.

smoldesu 5y ago
Which is easier to use: LastPass or CorrectHorseBatteryStaple?
- kingnothing 5y ago
  LastPass, unless you're able to memorize 200 different unique, complex passwords. Using a password "scheme" per site (like CorrectHorseBatteryStapleHN, CorrectHorseBatteryStapleReddit) is not safe.
- mttjj 5y ago
  A password manager. A much as I like CorrectHorseBatteryStaple, it would be impossible to use on every account I have (hundreds). I use CHBS for the few (5 at most) accounts that I log into all day, every day. Everything else gets a long, random string of garbage and stored in my password manager.
- admax88qqq 5y ago
  LastPass Cause most services still require arcane rules like "must have a number, an upper and lowercase letter, and 2 symbol but not on Thursdays"
  - mrtranscendence 5y ago
    I use the CorrectHorseBatteryStaple format, but with a short string of digits/symbols at the end to satisfy picky rules. This generally seems to work. But since I use a different password for every website I don't see how I could not use a password manager of some sort ... making passwords easier to type and remember doesn't mean I'm going to remember them all.
- function_seven 5y ago

joconde 5y ago

1Password on desktop stores items in a standard SQLite database, in an open format: https://support.1password.com/1password-security/#transparency https://support.1password.com/1password-security/#transparen... They also store regular copies of your vault in a backup folder. If Satan buys them and they try to lock you out, just decrypt your backups and move somewhere else.