5 ms·

I don't even mind the subscription fee and cloud hosting personally, just make a kickass native app like they always had and I'll stay. If they force me to "upg

by rekoil 5y ago

I don't even mind the subscription fee and cloud hosting personally, just make a kickass native app like they always had and I'll stay. If they force me to "upgrade" to 8 and it's not a native app then I'll just use something else like bitwarden.

kitsunesoba 5y ago
Similar here, I don’t mind the subscription fee and even like that I can effortlessly pull my passwords from whichever device I need to at the moment. The new electron app is a mess though, even if its data layer is done in Rust. It feels like a cheap imitation of the old one with so many little details being wrong, along with the general sluggishness that comes with a “modern” web stack. I’m not really happy with any of the other options either though. Bitwarden is stuck in the browser, and the various KeePass clients vary a lot in polish. It seems a little ridiculous because the UI involved in this sort of app is trivial to build and make nice in practically any native UI toolkit released in the past 20 years. It’s just list views and text fields… I would’ve expected the hard part of building a password manager to be the functional bits, not the UI.
- rekoil 5y ago
  Right!? The hard part is integrating nicely with the OS, which is just not something that's in Electrons bag. The thing Electron "improves" for them is portability for the one thing that users really want to avoid interacting with. It's just such a confusing business decision in my eyes, and to be completely honest, part of the reason I'm looking at switching is literally that they are making a decision like this unprovoked when they have a great native app already, I just don't understand it and don't want to support a business making shit decisions like that. Someone in this thread suggested Strongbox which looks very promising. I will stick with 1Password until they've decommissioned 7, and then make my decision whether to stay or not I think.
  - pantulis 5y ago
    In Apple land you have Strongbox or Keepassium. Both are fine projects based on Keepass technology so you are basically safe and the developers are even in cool terms with themselves.
    - kitsunesoba 5y ago
      Looking around, on macOS there’s also MacPass[0] which looks decent (good enough that I could see myself contributing for the last few % of polish), and gnome-passwordsafe[1] looks reasonable on Linux (if a bit too mobile-y for a desktop app). The only notable hole in the platforms I use is Windows… perhaps it’s time to spin up a WinUI Keepass project. [0]: https://github.com/MacPass/MacPass https://github.com/MacPass/MacPass [1]: https://apps.gnome.org/app/org.gnome.PasswordSafe/ https://apps.gnome.org/app/org.gnome.PasswordSafe/
      - pantulis 5y ago
        The issue I see with KeePass as an standard password format is that, afaik, it does not have the native concept of OTP which is critical these days. I understand some developers have come up with ways to store the needed information to generate the OTP in some of the metadata fields. But that does not guarantee OTP interoperability between different Keepass implementations accessing the same Keepass database. For example, using MacPass I can access my KeePass DB managed by Strongbox from iCloud Drive but the OTP field seems to be opaque to MacPass, it does not know what to do with it.
  - drewmol 5y ago
    Here's a +1 for Strongbox. It plays nicely with my Keepass/Dropbox sync setup. Been using it for a few years definitely worth the price.
  - Spooky23 5y ago
    Agreed. Porting an app as security sensitive as a secrets manager to a client with an attack surface of Electron seems just fundamentally dumb.
  - 1123581321 5y ago
    The new Mac app has a lot of OS-specific code for those nice integrations. Their new client is a mix of Rust, Electron UI and Swift with all secure processing and OS handoffs done in Rust and Swift. No one owes 1Password anything but the engineering reviews often seem to miss what they're actually developing.
jonpurdy 5y ago
I would be happy to pay the subscription fee for a native app, especially since my partner and parents can use it under the family plan. It works great for that! I've been paying for upgrades since 2007 (version 2.0 I think). Except that version 7 also introduced some massive UI/UX regressions! There were so many that I started collecting them in a Ulysses note so that I wouldn't forget why 1Password has gone so far downhill. ---- Attachments: - Attachments used to be attached to entries by drag files there, and they'd show up at the bottom (if I wanted my passport, there'd be a single Passport entry with copyable fields + jpeg photos of front and back at the bottom). - Now, every attachment is a separate document cluttering up everything. If I want my passport, I search for "passport" and three separate entries come up: entry with passport details I can copy, and passport-front.jpg and passport-back.jpg. And if I delete Passport entry, the jpegs are still hanging around. - See [1][2] ---- When it doesn't sync, there's no "force sync" button on iOS. So I just sit there waiting... ---- Can't suppress "duplicate password" warning: - If I reuse a password on two or more entries, each of those entries shows this warning - No way to disable it, clutters up the UI - Some entries have an insecure password for local use, dev use, whatever, so let me disable the warning - Tons of threads on their forums about this complaining about it [3][4][5][6] ---- Another warning that can't be disabled in preferences: 2FA available but not enabled - If you have an entry where 2FA is available on that site, you cannot disable the warning if you don't have it set up - To actually disable this, you need to tag the entry with 2FA (which is dumb because it implies that it has 2FA, but the tag is showing that it DOESN'T have 2FA enabled) ---- Subdomain matching doesn't work: - This used to actually work fine but it was removed! - If you have a.test.com and b.test.com with different credentials, 1password treats them as the same website and will ALWAYS show entries for both, breaking autofill - See [7][8] ---- And after all this, I still planned to continue to use 1Password until they made their version 8 Electron announcement. That's absolutely the final straw and I won't be moving forward with them after that. 1 - https://discussions.agilebits.com/discussion/92007/1password-7-attachements-and-documents-issue https://discussions.agilebits.com/discussion/92007/1password... 2 - https://discussions.agilebits.com/discussion/111892/messy-documents-list https://discussions.agilebits.com/discussion/111892/messy-do... 3 - https://discussions.agilebits.com/discussion/95438/reused-password-warning https://discussions.agilebits.com/discussion/95438/reused-pa... 4 - https://1password.community/discussion/106132/suppress-the-reused-password-prompt https://1password.community/discussion/106132/suppress-the-r... 5 - https://discussions.agilebits.com/discussion/115492/feature-request-silence-reused-password-for-legitimate-cases https://discussions.agilebits.com/discussion/115492/feature-... 6 - https://1password.community/discussion/104141/watchtower-reused-passwords-esp-w-r-t-sso https://1password.community/discussion/104141/watchtower-reu... 7 - https://1password.community/discussion/89271/matching-sub-domains-no-plans-for-this https://1password.community/discussion/89271/matching-sub-do... 8 - https://1password.community/discussion/87028/stricting-url-matching-for-subdomains/ https://1password.community/discussion/87028/stricting-url-m...

by rekoil 5y ago

kitsunesoba 5y ago

Similar here, I don’t mind the subscription fee and even like that I can effortlessly pull my passwords from whichever device I need to at the moment. The new electron app is a mess though, even if its data layer is done in Rust. It feels like a cheap imitation of the old one with so many little details being wrong, along with the general sluggishness that comes with a “modern” web stack. I’m not really happy with any of the other options either though. Bitwarden is stuck in the browser, and the various KeePass clients vary a lot in polish. It seems a little ridiculous because the UI involved in this sort of app is trivial to build and make nice in practically any native UI toolkit released in the past 20 years. It’s just list views and text fields… I would’ve expected the hard part of building a password manager to be the functional bits, not the UI.

rekoil 5y ago
Right!? The hard part is integrating nicely with the OS, which is just not something that's in Electrons bag. The thing Electron "improves" for them is portability for the one thing that users really want to avoid interacting with. It's just such a confusing business decision in my eyes, and to be completely honest, part of the reason I'm looking at switching is literally that they are making a decision like this unprovoked when they have a great native app already, I just don't understand it and don't want to support a business making shit decisions like that. Someone in this thread suggested Strongbox which looks very promising. I will stick with 1Password until they've decommissioned 7, and then make my decision whether to stay or not I think.
- pantulis 5y ago
  In Apple land you have Strongbox or Keepassium. Both are fine projects based on Keepass technology so you are basically safe and the developers are even in cool terms with themselves.
  - kitsunesoba 5y ago
    Looking around, on macOS there’s also MacPass[0] which looks decent (good enough that I could see myself contributing for the last few % of polish), and gnome-passwordsafe[1] looks reasonable on Linux (if a bit too mobile-y for a desktop app). The only notable hole in the platforms I use is Windows… perhaps it’s time to spin up a WinUI Keepass project. [0]: https://github.com/MacPass/MacPass https://github.com/MacPass/MacPass [1]: https://apps.gnome.org/app/org.gnome.PasswordSafe/ https://apps.gnome.org/app/org.gnome.PasswordSafe/
    - pantulis 5y ago
      The issue I see with KeePass as an standard password format is that, afaik, it does not have the native concept of OTP which is critical these days. I understand some developers have come up with ways to store the needed information to generate the OTP in some of the metadata fields. But that does not guarantee OTP interoperability between different Keepass implementations accessing the same Keepass database. For example, using MacPass I can access my KeePass DB managed by Strongbox from iCloud Drive but the OTP field seems to be opaque to MacPass, it does not know what to do with it.
- drewmol 5y ago
  Here's a +1 for Strongbox. It plays nicely with my Keepass/Dropbox sync setup. Been using it for a few years definitely worth the price.
- Spooky23 5y ago
  Agreed. Porting an app as security sensitive as a secrets manager to a client with an attack surface of Electron seems just fundamentally dumb.
- 1123581321 5y ago
  The new Mac app has a lot of OS-specific code for those nice integrations. Their new client is a mix of Rust, Electron UI and Swift with all secure processing and OS handoffs done in Rust and Swift. No one owes 1Password anything but the engineering reviews often seem to miss what they're actually developing.

jonpurdy 5y ago

I would be happy to pay the subscription fee for a native app, especially since my partner and parents can use it under the family plan. It works great for that! I've been paying for upgrades since 2007 (version 2.0 I think). Except that version 7 also introduced some massive UI/UX regressions! There were so many that I started collecting them in a Ulysses note so that I wouldn't forget why 1Password has gone so far downhill. ---- Attachments: - Attachments used to be attached to entries by drag files there, and they'd show up at the bottom (if I wanted my passport, there'd be a single Passport entry with copyable fields + jpeg photos of front and back at the bottom). - Now, every attachment is a separate document cluttering up everything. If I want my passport, I search for "passport" and three separate entries come up: entry with passport details I can copy, and passport-front.jpg and passport-back.jpg. And if I delete Passport entry, the jpegs are still hanging around. - See [1][2] ---- When it doesn't sync, there's no "force sync" button on iOS. So I just sit there waiting... ---- Can't suppress "duplicate password" warning: - If I reuse a password on two or more entries, each of those entries shows this warning - No way to disable it, clutters up the UI - Some entries have an insecure password for local use, dev use, whatever, so let me disable the warning - Tons of threads on their forums about this complaining about it [3][4][5][6] ---- Another warning that can't be disabled in preferences: 2FA available but not enabled - If you have an entry where 2FA is available on that site, you cannot disable the warning if you don't have it set up - To actually disable this, you need to tag the entry with 2FA (which is dumb because it implies that it has 2FA, but the tag is showing that it DOESN'T have 2FA enabled) ---- Subdomain matching doesn't work: - This used to actually work fine but it was removed! - If you have a.test.com and b.test.com with different credentials, 1password treats them as the same website and will ALWAYS show entries for both, breaking autofill - See [7][8] ---- And after all this, I still planned to continue to use 1Password until they made their version 8 Electron announcement. That's absolutely the final straw and I won't be moving forward with them after that. 1 - https://discussions.agilebits.com/discussion/92007/1password-7-attachements-and-documents-issue https://discussions.agilebits.com/discussion/92007/1password... 2 - https://discussions.agilebits.com/discussion/111892/messy-documents-list https://discussions.agilebits.com/discussion/111892/messy-do... 3 - https://discussions.agilebits.com/discussion/95438/reused-password-warning https://discussions.agilebits.com/discussion/95438/reused-pa... 4 - https://1password.community/discussion/106132/suppress-the-reused-password-prompt https://1password.community/discussion/106132/suppress-the-r... 5 - https://discussions.agilebits.com/discussion/115492/feature-request-silence-reused-password-for-legitimate-cases https://discussions.agilebits.com/discussion/115492/feature-... 6 - https://1password.community/discussion/104141/watchtower-reused-passwords-esp-w-r-t-sso https://1password.community/discussion/104141/watchtower-reu... 7 - https://1password.community/discussion/89271/matching-sub-domains-no-plans-for-this https://1password.community/discussion/89271/matching-sub-do... 8 - https://1password.community/discussion/87028/stricting-url-matching-for-subdomains/ https://1password.community/discussion/87028/stricting-url-m...