14 ms·

1Password delisting forum posts critical of their new Electron based 1Password 8

269 points by smcleod 4y ago

encryptluks2 4y ago
vaultwarden is a free Rust-based implementation of Bitwarden that works with the Bitwarden client. Password Store (pass) is also a great password manager with multiple clients and frontends.
- smoldesu 4y ago
  KeePass is an even simpler solution, the only thing you need to provide yourself is a folder to sync it in.
  - munk-a 4y ago
    Yea but for non-techie users the cloud based storage the majority of the value proposition. I'm going to be setting up a password manager for my mother shortly (since she's trying to get to grips with a ring binder full of passwords my dad left behind) and cloud based storage is a hard requirement for whatever software I end up choosing. Some other big features are no timeout auto-lock and the ability to assist with recovery codes remotely (in case she locks herself out of the system). Edited to add: I would mention that I personally use KeePass and love it to death though - my SO and I have vaults we occasionally sync and it's a wonderfully simple and easy to use application for anyone with confidence in keeping the password vault secured and a backup ready.
    - Nikbul 4y ago
      I would think cloud storage of some kind is default in the current devices. I use dropbox as storage for DB file and it autosync with other PC and phones. Also you can get access to file in browser if needed. Google drive might be even better for it.
denimnerd42 4y ago
ok great but I don't want a LOCAL vault. I used keepass for a years and it was such a hassle. I used to make all these arguments to myself too, but I finally gave in. 1password has all the features I could ever want and I never have to mess with it.
reissbaker 4y ago
Glad I stopped using them many years ago and switched to the open-source KeePass ecosystem... Which also lets you bring your own file sync (e.g. Dropbox, OneDrive, etc) instead of paying a subscription. 1Password used to work that way too!
saos 4y ago
Those comments are hilarious
smcleod 4y ago
I've seen this happen a couple of times but didn't think to screenshot them at the time like this person has.
torstenvl 4y ago
Truly a sketchy company. I'm extremely glad I moved away from them. I think the beginning of the end was pushing an update to the iOS app that deliberately took away previous functionality if you didn't have a subscription account.
- utdoctor 4y ago
  Could you elaborate? I've used them for years and have been very happy with their service
- kelt 4y ago
  I was a legacy user too, they finally got rid of me I guess The update to version 8 forces a login to the app and I could not use my own storage to sync vaults, out of the blue it just happened, I wasn't a paying customer The workaround? Create an account, export your vault(not in the older version, the export formats are limited), and off I went to Bitwarden
moomoo11 4y ago
Can someone explain what this means or why it is bad? Thanks!
- mroche 4y ago
  Doing a quick scan through the linked thread and the final screenshot that this post's title is about (re: delisting forums posts)... the thread issue isn't criticism of the new app version per se (there is some) but the fact it's not available in Apple's Mac App Store (it is in the iOS App Store). The screenshot just shows the thread as visible from the "latest post" view, but doesn't actually show up in the Mac forum area.
- mdaniel 4y ago
  If one looks at all the brew-haha over DDG delisting some search results, it's the same thing: no one likes having pseudo-censorship applied to what seemed like a good-faith ~~rant~~ forum thread. There didn't seem to be any obvious illegal content or ad hominem attacks that would warrent delisting the thread, and thus from the outside it looks like "sour grapes" when AgileBits had their feelings hurt That said, it seems to be some custom(?) forum software, so there could also be a perfectly reasonable explanation that just looks shady
  - jamiek88 4y ago
    Just fyi as I recently learned this it’s ‘brouhaha’ rather than brew as in beer. No offense meant just passing it on!
    - mdaniel 4y ago
      Yeah, I figured it was some idiomatic thing that was almost certainly incorrect, but I claim handicap cause I was born in the South :-D There are so many expressions I've heard all my life that I probably couldn't write down if my life depended upon it Thank you for warning others not to follow in my footsteps `o/`
- deleted 4y ago
  [deleted]
ilrwbwrkhv 4y ago
Moved away from 1password a long time back. 1password 5 was the last good product. Then they raised a bunch of money and went the usual VC route of losing control of the company. Bitwarden is a superior replacement in every way.
- mdaniel 4y ago
  > Bitwarden is a superior replacement in every way I'm going to regret sticking my nose into this, because BW is the Internet's darling, but that is demonstrably untrue unless one's password management needs are extremely simple One can dislike AgileBits as a business all they like, but BW has a long way to go before it's a superior replacement
  - ilrwbwrkhv 4y ago
    Maybe I should clarify. My experience with BW has been as a personal password manager. And it is superior to 1P in that category.
  - barbs 4y ago
    Which features is BitWarden missing?
    - Rebelgecko 4y ago
      Not a feature per se, but I've found that Bitwarden is less reliable at identifying password fields in apps and web pages than LastPass. Last time I used 1password it was still called 1passwd so I'm probably not qualified to compare against them. That said I still like BW enough to be a subscriber.
    - mdaniel 4y ago
      I was purposefully steering clear of a laundry list, cause it comes up so often I'm tired of typing it, and also I'm trying to get out of the "try and convince people to switch" game. If you like BW, I'm glad for you, and that I don't have to use it. I paid for BW so that I can fairly evaluate their product every so often, and my experience is that they just have a lack of attention to detail that I don't enjoy when entrusting my passwords and day-to-day UX to them I do hope they succeed, and I'm glad vaultwarden exists, but in my line of work execution matters and they have not yet demonstrated that they care about execution to the same degree that 1P does
gehsty 4y ago
If you are majority apple eco system apples password manager is great now!
- xbar 4y ago
  I am majority Apple eco system, but I type this on a PC. 1Password's seemless updates among Mac/iOS/Win is the only reason I have stayed.
- InTheArena 4y ago
  It's really short on some critical features - including web access, the ability to manage and list and share across family accounts, password recipes etc.
mdaniel 4y ago
it may be worth asking in "the Lounge" for an explanation, which would offer them an opportunity to explain themselves and, at least until the lounge thread gets delisted, make others aware of that behavior: https://1password.community/categories/general-lounge https://1password.community/categories/general-lounge that said, as someone who has offered them repeated and what I feel is constructive feedback during the Mac and Android beta periods, I can attest they DGAF about what you think about their things. That sweet private equity money invites you to pound sand
TIPSIO 4y ago
For desktop... it's definitely kind a bit more of a frustrating experience. I can definitely elaborate but the gist is it is just more painful / slower to get to passwords. I for the first time ever, installed their Chrome extension. For mobile... it's incredibly fast. I have never had an app scan my face and unlock. It's worth shouting out those devs.
- monocularvision 4y ago
  The mobile app is still fully native.
  - rstat1 4y ago
    The Android version isn't. Its built with React Native.
- deleted 4y ago
  [deleted]
replete 4y ago
Switched away from 1password recently after 10 years. Open-source KeepassXC almost as good. No regrets. Every Electron app seems to want around 400MB RAM minimum. It's not practical for too many of your day-to-day essential applications to be greedy with resources, it all adds up and not everyone has 32GB of RAM. I used Matrix chat client, Element, on Android - it's an electron app, guess what? It uses 500mb-1GB of RAM. KDE NeoChat Android used 50MB. Electron is simply not a good fit for everyone.
- Dalewyn 4y ago
  Electron is literally just Chrome with some window dressing, an abstraction placed upon abstractions to abstract way abstractions which abtract away abstractions that abstract the physical hardware. Seriously, any devs that use Electron rather than programming for an operating system's natively provided APIs are lazy and/or incompetent and very disrespectful of peoples' computers and time.
  - throwaway5959 4y ago
    In the case of 1Password it’s just greed. With so many paying customers they could definitely support native MacOS, Windows and Linux applications.
    - simongr3dal 4y ago
      And they did, pretty successfully, until a year ago.
      - mdaniel 4y ago
        as an observation, the Electron one was the first Linux client (err, sorry, read/write Linux client -- KeePassXC could/can read 1Password's .opvault format if you needed access to them for an on-call laptop)
    - roustem 4y ago
      I replied to another post earlier, hopefully it is ok to repost it here: ---- At 1Password we actually did not mind developing separately for every platform. It's been done for years. We build it for ourselves and don't mind putting extra work for better experience. However, the problem is that you end up with apps that behave differently, miss features, and have different bugs across platforms. Drives people crazy. Just one example: 1Password 7 for Windows shows different search results in a different order compared to the Mac app. Obviously it could be fixed but then a different issue pops up somewhere else. Instead of adding new features we spent time fixing (making?) various bugs in different ways. The new 1Password 8 still has a ton of platform-specific code but the core is the same across all desktop and mobile apps. It allows us to get the new features out faster and also spend time on platform-specific code.
bombcar 4y ago
1Password is getting worse and worse. It still works but it’s slow after unlocking and isn’t integrating as well. I may be up for reconsidering at some point.
- SOLAR_FIELDS 4y ago
  I've been a personal user for 4 years or so after getting a membership through the corp I was working with at the time. It's wild how different the experience is depending on what platform you are working with. In my personal stuff I use Firefox, in which the 1Password experience is not great. I also use it on iOS for personal use on safari, an experience I would also rank as "not great". In a job that I started working with recently, I use Chrome exclusively and it works very well on that platform. So it seems like not a whole lot of effort is being paid to having a unified experience on platforms by 1Password. I understand it's kind of a hard problem, but the discrepancy seems rather large from my experience. Too large for what they are charging and continue to charge. That being said, I can't say that there are preferable alternatives currently. My current company uses Lastpass and while the chrome experience is OK, it isn't a massive UX improvement over 1Password either.
- cpuguy83 4y ago
  I have the opposite experience... sort of. It's not getting slower but of course also not noticeably faster. But the app has gotten better and better over the years. --- edit fix some wording issues from starting the sentence one way and finishing it another ---
  - bombcar 4y ago
    My main problem is safari on Mac - it takes its sweet time unlocking and then I often have to click around or reload the page to get it to actually “stick”.
- ghostpepper 4y ago
  I've definitely noticed the Firefox extension (on Linux and MacOS) working more slowly and occasionally even hanging the entire browser for up to 30 seconds.
olliecornelia 4y ago
yosito 4y ago
I have literally thousands of passwords in 1Password. I'd love to migrate to something else, but it seems like a lot of work.
- diegof79 4y ago
  It’s not: https://support.1password.com/export/ https://support.1password.com/export/ Most password managers support CSV import/export. I moved all my passwords from LastPass to 1Password in a minute.
  - LilBytes 4y ago
    A little inaccurate. It's not possible to easily export attachments, so if you have private keys up there as attachments rather than in plain text, QR code screenshots, CSV's or similar. These will not come out trivially. There are some open source Python scripts up there for exporting attachments out of 1Password and BitWarden but I could never get them working.
    - mdaniel 4y ago
      I can appreciate that it's painful not having an agreed upon standard for password exchange, but for sure 1pux is a zip file that 100% includes attachments <https://support.1password.com/1pux-format/#files-folder https://support.1password.com/1pux-format/#files-folder>. I have verified that personally
      - bwoodruff 4y ago
        Can confirm. 1pux includes attachments. It should essentially be lossless if where you're going has a good importer. -Ben, 1Password
smnrchrds 4y ago
It's a bold business decision, as a password manager company, to take actions that decrease people's trust in you.
- rglover 4y ago
  Made me think of this https://www.youtube.com/watch?v=4Ru8DMW-grY https://www.youtube.com/watch?v=4Ru8DMW-grY
- userbinator 4y ago
  Honestly, in general I'm more surprised that people would be willing to trust a thirdparty in the first place, with literally all the keys to their online lives. (I'm excluding those who use password managers mainly for throwaway accounts.)
- krainboltgreene 4y ago
  This increases my trust in them. I don't want them focusing on this nonsense garbage.
  - drcongo 4y ago
    You prefer a password manager that is only installable from a zip download with no SHA hash for verification? Interesting.
    - krainboltgreene 4y ago
      No, I prefer a team who isn't willing to be bothered by nonsense anti-electron trendy commentary.
filereaper 4y ago
I'm trying to find an alternative to LastPass given their announcement today and was thinking of moving to 1Password. Many responses here are recommending against 1Password. What's a good alternative, specifically for families, as I've moved members of my family to LP? I'll specifically need some recovery mechanism for them in the event they lose access, as they're still getting used to this workflow. Its not ideal but what's needed realistically.
- abfan1127 4y ago
  I missed LastPass's announcement. can you share? Edit: here it is: https://blog.lastpass.com/2022/08/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/08/notice-of-recent-security-...
  - andrewflnr 4y ago
    Unless there's evidence they're lying about the scope, that alone doesn't seem like reason enough to ditch them. Not that I'm opposed to switching to keepassxc.
- mtgx 4y ago
  Bitwarden.
- sethherr 4y ago
  Bitwarden
- Analemma_ 4y ago
  I moved from 1Password to Bitwarden about a month ago and am perfectly happy. Bitwarden is missing a small number of nice "quality of life" features like Touch ID support on Macs and large type mode, but these aren't even close to dealbreakers. There is a family plan available for up to 6 people, and for recovery there is an "encrypted export" function so you can have an encrypted vault in cold storage. Would recommend.
  - jacko0 4y ago
replete 4y ago
The main reason I switched from 1password 7 is that at some point they removed the option to disable code signature checks, meaning they had to update 1Password whenever a browser vendor changed their signature. This effectively means that Firefox working with the old version is going to end at some point, they just happen to have kept the same signature or some time. The other side of this, is that it will not work with LibreFox, which isn't signed. Frustratingly, they had the option to disable checks for years in 1Password and removed it. KeePassXC is the way to go. Similar experience on android and desktop to 1Password (non-SaaS) local vault.
- mdaniel 4y ago
  FWIW, my experience is that it isn't "code signatures," it's on-disk file ownership: https://1password.community/discussion/comment/641113/#Comment_641113 https://1password.community/discussion/comment/641113/#Comme...
  - replete 4y ago
    I investigated the browser extension not working with LibreWolf, broke down the logs and it was definitely code signature verification check. LibreWolf is unsigned and that is why it didn't work. It stopped working with Chrome at some point for the same reason
alfiedotwtf 4y ago
Am I the only one that still uses a plaintext file for passwords?
- 42e6e8c8-f7b8-4 4y ago
  Consider an open source password vault: https://keepass.info/ https://keepass.info/ . Bummer to have all your passwords in the clear on compromise because it isn't encrypted.
- glerk 4y ago
  I am using a schema to derive the password based on the website/application which is stored only in my brain.
- cdelsolar 4y ago
  My wife uses a little notebook with an encoding scheme known only to her.
rdl 4y ago
They lost their way a few years ago when they stopped supporting user synced vaults, relying on cloud services. Then, deprioritizing even iCloud/Dropbox backed synced vaults. With 1Password 8 they went full clownworld by eliminating local vaults entirely. I’m glad to have months to transition off 1Password 7 but haven’t yet found the ideal consumer replacement.
- deleted 4y ago
  [deleted]
- ohCh6zos 4y ago
  I dropped them in favor of self hosted bitwarden and I've been much happier.
  - rdl 4y ago
    I use bitwarden in corp/client environments but the mobile experience is inferior to 1Password. I wish Futo would pay for a great fully open source (and reproducible build, multiple competing vendor backend, self hostable backend, etc.) project. Keepass, bitwarden, enpass are tolerable. Something which could both integrate with hashicorp vault and with some shared sessions/no sharing of passwords thing would be cool too (via weird proxy tricks or a browser trick; basically to let a browser log into my session without the user/computer ever seeing the password, only auth delegation.)
    - ohCh6zos 4y ago
      YMMV of course, but I've found using bitwarden on iOS with the built in password integration seems to work identically to 1Password.
- xyzzy_plugh 4y ago
  If you're using local vaults then you don't need the vast majority of features they're building. I think it makes a lot of sense to de-prioritize that type of user. Stuff like one time shares (or any sharing really), travel mode, multi account management, not to mention all the enterprise features. It's basically an entirely different product, and I don't fault them for going in a different direction when there are so many other, free products which fill that niche. The communication could've maybe been better, but overall it's hard to say that the rug was pulled out from under you when you were not using a subscription nor obligated to receive updates. The old binaries still work fine.
n42 4y ago
Why does 1Password always bring so much controversy in discussion forums? I’ve been a happy paying customer for 10 (!) years. I was there for the migration to a subscription model. I introduced Teams at my company eagerly when it launched. I updated to 1P8 recently without thinking about it, saw the new UI, thought “huh, neat” and moved on. Performance is fine. I barely noticed the change. I am a professional, and don’t mind paying their very reasonable subscription so they can continue to actively maintain the security and functionality of the software that literally protects my entire digital identity. I’m baffled by how many people in our industry are upset by their business model. If you’re making six figures writing software and think $3/month for a cornerstone of your security suite is offensive, you need to grow the fuck up, frankly. Likewise, I don’t care how they moderate their forums. The comments in these threads always feel so self entitled. Use another piece of software if those things are important to you. Plenty of us understand and appreciate the value these guys are creating for us. For me, nothing compares. I’ve tried Keepass, Bitwarden, Apple’s built-in thing, Enpass; they are all either amateurish or missing key functionality that 1Password has that I use every day. All the same, I’m happy they exist. Some day I may need them. I hope more pop up. Anyways, if you’re a dev or employee at 1P I’m writing this for you. Sorry about the jerks. Plenty of us out here love what you are doing.
- replete 4y ago
  Some people simply don't want to put their passwords onto someone else's computer... I've had little problems with their software, but I don't want to pay a subscription for password hosting because I don't want password hosting
- gonehome 4y ago
  +1 1Password is really great, the best among the available options by far imo. Most of the negative commentary about it doesn’t matter (I personally prefer native apps to electron apps). The complaints about it being a subscription are weak - software doesn’t exist in a closed system. Keeping up with all the platforms and the OS updates etc. takes perpetual maintenance even if they shipped zero new features. And the features they do ship (family vaults, built in OTP) are really useful. It’s a refreshing escape from the “free” ad-driven hellscape many of the HN commenters complaining are probably employed by.
beardicus 4y ago
1Password is fine, and the constant Electron whining is boring and probably quite duplicative in their forums by now. I don't love some of the changes with 1Password 8, but Electron has nothing to do with it.
- tjohns 4y ago
  > the constant Electron whining is boring and probably quite duplicative in their forums by now I would take this as a signal that, in the eyes of many of their users, it's not fine.
  - quantumduck 4y ago
    Many vocal users, tiny set of their overall users.
    - thecoppinger 4y ago
      Agreed. The anti-Electron crusaders seem to be some of the loudest folks out there, too. 1Pass is great in my opinion, it's a shame it's being so negatively portrayed through-out this thread.
JediPig 4y ago
electron apps are near instant no install with me and others. Exceptions exist, but taking a gb of ram to edit a 9.2k file is insanity. I think 1Password lost its way, especially on the subscription model.
- sys_64738 4y ago
  Totally agree. Electron is the modern data java to be avoided at all costs.
deleted 4y ago
[deleted]
danyala 4y ago
1Password has been good to me. I did have a strange encounter with their customer support last year; I had asked whether it might be possible to have native support to show when a credential was set up to use Sign In with Apple, or Google sign-in, etc. Their customer service didn't even consider the suggestion, advising me instead that using single sign-on solutions was a security risk. At the time I thought the agent was just confused, but with hindsight I realised it might fit a password manager's agenda to keep people using an email, password and 2FA combo, perhaps with an eye on whatever other solutions 1Password may have in the oven.
- mdaniel 4y ago
  and yet, they did either arrive at that same conclusion or did hear you, because it now knows if one uses a Sign in With Google and stores that fact in the Item: https://blog.1password.com/sign-in-with-anything-browser-beta/ https://blog.1password.com/sign-in-with-anything-browser-bet...
  - danyala 4y ago
    Well damn, haha. They just didn't want to have to put my name in the credits then. Thank you :)
radicaldreamer 4y ago
Their Mac app (version 8 built with electron) had a nasty bug in it where it would consume 80-100% of single core CPU and when made aware, it took them over a week to push out a patch. Whatever they think they're doing taking a native app which rarely (if ever) had such regressions and rewriting as an electron app, they've embarked on a boondoggle.
jcoletti 4y ago
Putting the Electron and subscription model debates to the side, if you're unhappy with 1Password and on macOS, consider switching to Minimalist Password. Currently a fair fixed price model, solid native apps for macOS, iOS & iPadOS, and iCloud syncing. They release updates often enough, and have been super responsive via Twitter about making small tweaks. The only thing missing are Chrome/FF extensions but they're coming (have to copy/paste on desktop unless you use Safari).
- LionTamer 4y ago
  What important differences are there between Apple’s iCloud Keychain password management and Minimalist Password? Is it just the (coming soon) Chrome support?
  - jcoletti 4y ago
    iCloud Keychain password manager is becoming more capable but still pretty limited. Aside from the extensions to support more browsers soon, Minimalist Password provides some of the sugar that 1Password has, like the ability to store different things beyond just passwords (credit cards, crypto wallet keys for hot wallets, software licenses, secure notes, etc.) It also includes the ability to add custom fields of various types to password entries, and tags for grouping. It's more of a comprehensive secrets manager.
AA-BA-94-2A-56 4y ago
I love 1P and would wholeheartedly recommend it to anyone. But... They are cagey around this fact. They are not just trying to remove criticisms of the fact that 1Password 8 is based on Electron, they are actually trying to gaslight. Whenever you mention that 1P8 is backed by Electron (I myself am very neutral towards that fact), they will quickly correct you and tell you it's backed by Rust instead. For whatever reason, they are choosing not to just own the truth. This is a real shame because new 1Password 8 is really good, and I recommend it.
- artdigital 4y ago
  > This is a real shame because new 1Password 8 is really good, and I recommend it. This is subjective. For me I feel everything is a bit more clunky, especially when using the standalone extensions. I have it constantly that the extension doesn’t unlock, the desktop version not showing up when I hit the global shortcut, rendering delays and and and Been using 8 since the pre release to give it a chance but much much prefer 7. I never had this many problems with 1Password and I’m a loyal user since they very early versions 7 was a perfect product that worked flawlessly, 8 is an ok product that does its job. Can’t say I like AgileBits though, too much shady behavior: the subscription migration (hiding one time purchase licenses completely), removing standalone vaults, showing ads within the app, and now this crap
- bdougherty 4y ago
  Yep. Somebody asked on Reddit the other day what happened to the Apple Watch app with 1P 8 for iOS and the lead guy responded with: > FYI, Support for Apple Watch was not dropped. The old Apple Watch app could not be included in 1Password for compatibility reasons. We are still exploring how we can include an Apple Watch app in 1Password 8. So the Apple Watch app is no longer included, but support wasn't dropped?? I don't understand why they cannot just tell the truth about things. Why do they seem to be doing so many things that erode trust when their entire business is based around it?
  - krainboltgreene 4y ago
    If the server is down for maintenance and patches that doesn't mean the server is gone forever, you know that right?
leach 4y ago
1P8 is fine, I didn’t notice any decrease in performance at all.
aetherspawn 4y ago
The new 1Password 8 is a lot better than the old 1Password in my opinion. We just switched our whole company over. I'm not sure of the basis for the key criticism, as 1Password 8 feels more responsive than 1Password 7 -- which used to take several seconds to appear on the desktop if it was locked.
- oofbey 4y ago
  What do you think is better about it?
  - aetherspawn 4y ago
    1. A lot of the core functions i.e. search seem to have better performance. 2. It opens quicker, whereas 1P 7 seemed to sometimes take several seconds to open. By comparison, 1P 8 is always instant, and that's important if you're trying to login to a website via the browser plugin and your Vault is locked. 3. It looks more integrated with Windows 11, as the UX and iconography matches. Also the bigger scale on text and clickable areas makes it nicer to use on a touchpad. I also prefer how the login screen covers the whole screen now. It wasn't always easy to see which monitor popped up the prompt in 1P 7 if you have many. Some minor criticism: It's less "nice" to customize your Login items in 1P 8. The label editor and UX to add extra items to Logins is not as good as in 1P 7, but I can't quite put my finger on it. I think it is because the editable parts don't clearly turn into text fields when you press them.
wanderingmind 4y ago
HN community with all their hacker ethos and dev skills should be fully behind Bitwarden, a superior password manager with some rough edges on UI. Bitwarden is fully FOSS and heck they charge much less than 1P ($10/yr for premium). If shit like this happens, you can always leave Bitwarden and start self hosting using VaultWarden (its rust clone).
- noirbot 4y ago
  I was really into it until I hit some bug/corruption where it just stopped accepting my password to unlock it, and then I had literally 0 recourse and had to spend hours recovering it, since they wouldn't even let me just delete the account and start over.
  - wanderingmind 4y ago
    Thats strange and I have never heard this issue before. Did you have any issue filed in github with them. One way to go around is to export and download your data. You can then import it into a new account or an account run on Vaultwarden.
stereoradonc 4y ago
BitWarden user here. Everything in 1Password minus the toxic optimism, standards compliant migration (1Password can't import from BitWarden, but other way round works) and one fourth of the subscription costs. BitWarden is easy to manage - I got my mother to install it on her Android device, and she can easily manage passwords. Their shift to an expensive subscription genuinely disappointed me with subpar applications. When alternatives work, why consider 1Password? Best option is to stay away from them.
- InTheArena 4y ago
  It's on 1Password that they can export in a reasonable way that Bitwarden understands, but Bitwarden can't export that way? Or to put it another way, you claim 1Password is not standards compliant. What standard should they be? My experience is that Bitwarden has a clunky user interface, and I just don't trust them (yet) security-wise. I have no problem paying for an interface that my family can use. 1Password and Bitwarden are both really good options. If you are more in the Apple ecosystem, and prefer a great UX, then go 1Password. If you trust bitwarden, and are in other ecosystems, I think that's great too. Throwing around phrases like "toxic optimism" and "standards compliant migration" is a bit low. https://www.nytimes.com/wirecutter/reviews/best-password-managers/ https://www.nytimes.com/wirecutter/reviews/best-password-man...
  - stereoradonc 4y ago
    I expressed my opinion about the toxic optimism part. As for the "migration"- they refer you to a tool (MRC converter) to convert the Bitwarden import to transfer to 1Password. (Read more here: https://1password.community/discussion/102118/import-from-bitwarden-solved-converter-available https://1password.community/discussion/102118/import-from-bi...) Here's more I found: https://support.1password.com/cs/import-mac/ https://support.1password.com/cs/import-mac/ Something on github: https://github.com/torshinalexey/bitwarden-to-1password-csv https://github.com/torshinalexey/bitwarden-to-1password-csv I found this on Reddit: https://www.reddit.com/r/1Password/comments/r9cfd1/comment/hniw80l/?context=3 https://www.reddit.com/r/1Password/comments/r9cfd1/comment/h... If 1Password expects me to pay for their services, they make it impossible for a non-technical user. As for the Wirecutter review, it's hard to decide on a publication that makes money from affiliate referrals. 1Password is uniformly bad; either way you look at it. If its value for money, Bitwarden offers the best one. I am NOT affiliated to either company but speaking from a user perspective.
InTheArena 4y ago
I'm not sure this is correct. I am seeing all of the posts just fine as a normal logged in user?
malshe 4y ago
From the forum comments it seems that another major complaint is the absence of 1PW from Mac App Store. I totally get that. I also found it was bizarre that the update had to be downloaded from a website.
_23sd 4y ago
They should just lock the thread if it’s getting unproductive. Sounds like the developers aren’t interested in putting it on the Mac App Store and don’t want to discuss the reasons, so of course the thread is going to be nothing but complaints and sometimes hyperbole.
hombre_fatal 4y ago
The thread is actually about the app not being on the Mac App Store anymore. Electron apps can be published to the app store, so Electron is kind of a distraction here.
eduction 4y ago
About 10-15 years ago they were behaving the same way. I made a post in their forums complaining that their on disk file storage left your list of domain names in cleartext so someone with access to your files could see where you have accounts, which reduced the benefit of them encrypting the actual passwords, something they made a big deal about in their marketing. They moved the post from the high traffic forum section about 1Password to an obscure forum section about random topics. (Their justification for leaving the domains in cleartext was that it was needed to make the browser extension work.) I still use the product but the company is flawed. They are just less flawed than others.
- TheNewsIsHere 4y ago
  As someone who has had professional involvement with them, I was thinking about this the other day. I would summarize them exactly the same way. When it comes to security and privacy in cryptographic terms, they seldom make a misstep. They rightly uphold Kerckhoff’s principle. They do the most important technical things right and reliably. They deserve credit for that. When it comes to all of the soft/human/marketing/product management decisions, they have some really bad calls under their belts. They deserve criticism for that.
c23gooey 4y ago
I'm curious where the evidence for the headline is? I clicked the link but I just see some forum posts about the app not being in the App Store. Are all the comments on this thread just people commenting based off the headline?
- mdaniel 4y ago
  no, observe that the latest post in that thread is Aug 25 <https://1password.community/discussion/comment/653739/#Comment_653739 https://1password.community/discussion/comment/653739/#Comme...> but if one clicks on the "Topics > Mac" header to go back to the threads list <https://1password.community/categories/1password-for-mac https://1password.community/categories/1password-for-mac> it does not show up alongside the other Aug 25 updates (command-f for "Apple" or "App Store") The thread does show up in the search results, but if one were interested in seeing a thread with 6 pages worth of replies, and untold number of views, in order to know that topic is ... receiving a lot of attention ... then you'd have to come to HN :-)
  - c23gooey 4y ago
    thanks!
CodeWriter23 4y ago
Doesn't using Electron imply their user's passwords are now vulnerable to any compromised npm package they happen to use?
- krainboltgreene 4y ago
  No.
moltar 4y ago
One of the primary reason for selecting 1Password was a native app. But at this point isn’t much holding me back from switching to BitWarden. I already use it for my business. I guess it’s time to switch my personal too.
moltar 4y ago
I’m really wondering how 1P is able to audit the NPM dependency tree on every build.
- whydid 4y ago
  Probably with a local gated mirror, and very careful upgrades. I hope...
- krainboltgreene 4y ago
  You know you can lock dependencies, right?
  - moltar 4y ago
    I know of course. But you still need to audit them before. And then on every npm update you do. It can be a full time job. But even then there’s no guarantee you’ll slip and miss. I can definitely see a potential targeted attack. Since you could reverse the 1P bundle and see what packages it uses and then try to insert some malicious code. And then gain access to millions of 1P vaults.
nikolay 4y ago
Honestly, their street cred went down the drain when they switched to Electron! I can imagine them making this decision 5 years ago, but today, there are options!
kylehotchkiss 4y ago
I am no electron fan but 1password’s new desktop apps have been a huge improvement from 7 for me and the new mobile apps are equally impressive. I’m not gonna let up on electron complaints for other companies because a lot of them are just taking the easy way out with it (ugh why can’t slack just be a little more simple and native) but 1pass proved to me an electron app can be decent if a company pours in the resources
brian-armstrong 4y ago
Easy solution here - switch to an open source password manager and don't look back. They're way less likely to suddenly betray you in an update. I recommend https://keepassxc.org/ https://keepassxc.org/
caycep 4y ago
I’m still on seven… Still works OK, and I haven’t gotten a lot of pressure from them to upgrade. Since I’m mostly on Mac – has anyone made a transition to OSX keychain? I’ve used it a lot back in the day but I can’t really remember… But modern day iOS/os x seems to have a lot of integrations
- LionTamer 4y ago
  I use that and chrome keychain - it’s honestly very good on the iPhone and great on the computer for safari although it doesn’t work on other browsers
AnonC 4y ago
AgileBits and its forums have always been hostile places for customers who ask questions that the company is not comfortable with (like dark patterns, anti-customer policies, etc.). Nothing new here. The problem starts right at the top, and that “we know better than you at all times” culture flows down to all the customer support representatives. By whatever chance, I think older forum posts are still there for anyone to go and verify for how long these toxic reactions have been around.
rcarmo 4y ago
Again, I have switched away successfully and have a list of alternatives for various platforms: https://taoofmac.com/space/apps/1password https://taoofmac.com/space/apps/1password
ghusto 4y ago
I am confusion. I upgraded (unthinkingly) and don't see what the fuss is about? In fact they've added something that I've wanted for a long time, which is universal password suggestions (for applications). ¯\_(ツ)_/¯ works on my machine? EDIT: Ooooooh, just read the support thread and now I understand. Goddammit, I wish I knew all this before I upgraded. Seems like there's a trust issue with people trying to get an answer as to why three months in, it still can't be downloaded from the App Store. They suspect Apple isn't approving it due to some shadiness and/or security issues. I really hope not, but their responses and the way this has happened does look _well_ shady.
Dwedit 4y ago
Anything made in Electron could be replaced by a <1MB .EXE that imports the OS's default web browser.
bacan 4y ago
I will cancel my sub and shift to KeePass before installing an Electron Version of 1Password Not only is Electron heavy, but also inherits all the security vulnerabilities of Chromium. This is compounded further by the fact that Electron uses its own bundled version of Chromium and so needs to be separately updated, before the app is compiled by the devs. So many app developers are not even aware of this and so will not bother updating the SDK.
skyzyx 4y ago
Like it or not (I don’t), but the Electron apps are here to stay. It’s the direction they’ve decided on. Arguing about it does nothing to move the needle forward. It’s a done deal. I imagine that posts about it are simply unproductive. I’ve posted about it, and my posts are still there. This past year was the first time since 2009 that I’ve actively looked at alternatives, and there are none. 1Password is in a class entirely its own. Are there things I wish that were different? Yes. Do I wish they’d bring back features that they’ve dropped? Absolutely. But it’s still the single best product in its category. Nothing else comes remotely close. And they are years ahead of #2. What’re you gonna do?

269 points by smcleod 4y ago

vaultwarden is a free Rust-based implementation of Bitwarden that works with the Bitwarden client. Password Store (pass) is also a great password manager with multiple clients and frontends.

smoldesu 4y ago
KeePass is an even simpler solution, the only thing you need to provide yourself is a folder to sync it in.
- munk-a 4y ago
  Yea but for non-techie users the cloud based storage the majority of the value proposition. I'm going to be setting up a password manager for my mother shortly (since she's trying to get to grips with a ring binder full of passwords my dad left behind) and cloud based storage is a hard requirement for whatever software I end up choosing. Some other big features are no timeout auto-lock and the ability to assist with recovery codes remotely (in case she locks herself out of the system). Edited to add: I would mention that I personally use KeePass and love it to death though - my SO and I have vaults we occasionally sync and it's a wonderfully simple and easy to use application for anyone with confidence in keeping the password vault secured and a backup ready.
  - Nikbul 4y ago
    I would think cloud storage of some kind is default in the current devices. I use dropbox as storage for DB file and it autosync with other PC and phones. Also you can get access to file in browser if needed. Google drive might be even better for it.

denimnerd42 4y ago

ok great but I don't want a LOCAL vault. I used keepass for a years and it was such a hassle. I used to make all these arguments to myself too, but I finally gave in. 1password has all the features I could ever want and I never have to mess with it.

reissbaker 4y ago

Glad I stopped using them many years ago and switched to the open-source KeePass ecosystem... Which also lets you bring your own file sync (e.g. Dropbox, OneDrive, etc) instead of paying a subscription. 1Password used to work that way too!

saos 4y ago

Those comments are hilarious

smcleod 4y ago

I've seen this happen a couple of times but didn't think to screenshot them at the time like this person has.

torstenvl 4y ago

Truly a sketchy company. I'm extremely glad I moved away from them. I think the beginning of the end was pushing an update to the iOS app that deliberately took away previous functionality if you didn't have a subscription account.

utdoctor 4y ago
Could you elaborate? I've used them for years and have been very happy with their service
kelt 4y ago
I was a legacy user too, they finally got rid of me I guess The update to version 8 forces a login to the app and I could not use my own storage to sync vaults, out of the blue it just happened, I wasn't a paying customer The workaround? Create an account, export your vault(not in the older version, the export formats are limited), and off I went to Bitwarden

moomoo11 4y ago

Can someone explain what this means or why it is bad? Thanks!

mroche 4y ago
Doing a quick scan through the linked thread and the final screenshot that this post's title is about (re: delisting forums posts)... the thread issue isn't criticism of the new app version per se (there is some) but the fact it's not available in Apple's Mac App Store (it is in the iOS App Store). The screenshot just shows the thread as visible from the "latest post" view, but doesn't actually show up in the Mac forum area.
mdaniel 4y ago
If one looks at all the brew-haha over DDG delisting some search results, it's the same thing: no one likes having pseudo-censorship applied to what seemed like a good-faith ~~rant~~ forum thread. There didn't seem to be any obvious illegal content or ad hominem attacks that would warrent delisting the thread, and thus from the outside it looks like "sour grapes" when AgileBits had their feelings hurt That said, it seems to be some custom(?) forum software, so there could also be a perfectly reasonable explanation that just looks shady
- jamiek88 4y ago
  Just fyi as I recently learned this it’s ‘brouhaha’ rather than brew as in beer. No offense meant just passing it on!
  - mdaniel 4y ago
    Yeah, I figured it was some idiomatic thing that was almost certainly incorrect, but I claim handicap cause I was born in the South :-D There are so many expressions I've heard all my life that I probably couldn't write down if my life depended upon it Thank you for warning others not to follow in my footsteps `o/`
deleted 4y ago
[deleted]

ilrwbwrkhv 4y ago

Moved away from 1password a long time back. 1password 5 was the last good product. Then they raised a bunch of money and went the usual VC route of losing control of the company. Bitwarden is a superior replacement in every way.

mdaniel 4y ago
> Bitwarden is a superior replacement in every way I'm going to regret sticking my nose into this, because BW is the Internet's darling, but that is demonstrably untrue unless one's password management needs are extremely simple One can dislike AgileBits as a business all they like, but BW has a long way to go before it's a superior replacement
- ilrwbwrkhv 4y ago
  Maybe I should clarify. My experience with BW has been as a personal password manager. And it is superior to 1P in that category.
- barbs 4y ago
  Which features is BitWarden missing?
  - Rebelgecko 4y ago
    Not a feature per se, but I've found that Bitwarden is less reliable at identifying password fields in apps and web pages than LastPass. Last time I used 1password it was still called 1passwd so I'm probably not qualified to compare against them. That said I still like BW enough to be a subscriber.
  - mdaniel 4y ago
    I was purposefully steering clear of a laundry list, cause it comes up so often I'm tired of typing it, and also I'm trying to get out of the "try and convince people to switch" game. If you like BW, I'm glad for you, and that I don't have to use it. I paid for BW so that I can fairly evaluate their product every so often, and my experience is that they just have a lack of attention to detail that I don't enjoy when entrusting my passwords and day-to-day UX to them I do hope they succeed, and I'm glad vaultwarden exists, but in my line of work execution matters and they have not yet demonstrated that they care about execution to the same degree that 1P does

gehsty 4y ago

If you are majority apple eco system apples password manager is great now!

xbar 4y ago
I am majority Apple eco system, but I type this on a PC. 1Password's seemless updates among Mac/iOS/Win is the only reason I have stayed.
InTheArena 4y ago
It's really short on some critical features - including web access, the ability to manage and list and share across family accounts, password recipes etc.

mdaniel 4y ago

it may be worth asking in "the Lounge" for an explanation, which would offer them an opportunity to explain themselves and, at least until the lounge thread gets delisted, make others aware of that behavior: https://1password.community/categories/general-lounge https://1password.community/categories/general-lounge that said, as someone who has offered them repeated and what I feel is constructive feedback during the Mac and Android beta periods, I can attest they DGAF about what you think about their things. That sweet private equity money invites you to pound sand

TIPSIO 4y ago

For desktop... it's definitely kind a bit more of a frustrating experience. I can definitely elaborate but the gist is it is just more painful / slower to get to passwords. I for the first time ever, installed their Chrome extension. For mobile... it's incredibly fast. I have never had an app scan my face and unlock. It's worth shouting out those devs.

monocularvision 4y ago
The mobile app is still fully native.
- rstat1 4y ago
  The Android version isn't. Its built with React Native.
deleted 4y ago
[deleted]

replete 4y ago

Switched away from 1password recently after 10 years. Open-source KeepassXC almost as good. No regrets. Every Electron app seems to want around 400MB RAM minimum. It's not practical for too many of your day-to-day essential applications to be greedy with resources, it all adds up and not everyone has 32GB of RAM. I used Matrix chat client, Element, on Android - it's an electron app, guess what? It uses 500mb-1GB of RAM. KDE NeoChat Android used 50MB. Electron is simply not a good fit for everyone.

Dalewyn 4y ago
Electron is literally just Chrome with some window dressing, an abstraction placed upon abstractions to abstract way abstractions which abtract away abstractions that abstract the physical hardware. Seriously, any devs that use Electron rather than programming for an operating system's natively provided APIs are lazy and/or incompetent and very disrespectful of peoples' computers and time.
- throwaway5959 4y ago
  In the case of 1Password it’s just greed. With so many paying customers they could definitely support native MacOS, Windows and Linux applications.
  - simongr3dal 4y ago
    And they did, pretty successfully, until a year ago.
    - mdaniel 4y ago
      as an observation, the Electron one was the first Linux client (err, sorry, read/write Linux client -- KeePassXC could/can read 1Password's .opvault format if you needed access to them for an on-call laptop)
  - roustem 4y ago
    I replied to another post earlier, hopefully it is ok to repost it here: ---- At 1Password we actually did not mind developing separately for every platform. It's been done for years. We build it for ourselves and don't mind putting extra work for better experience. However, the problem is that you end up with apps that behave differently, miss features, and have different bugs across platforms. Drives people crazy. Just one example: 1Password 7 for Windows shows different search results in a different order compared to the Mac app. Obviously it could be fixed but then a different issue pops up somewhere else. Instead of adding new features we spent time fixing (making?) various bugs in different ways. The new 1Password 8 still has a ton of platform-specific code but the core is the same across all desktop and mobile apps. It allows us to get the new features out faster and also spend time on platform-specific code.

bombcar 4y ago

1Password is getting worse and worse. It still works but it’s slow after unlocking and isn’t integrating as well. I may be up for reconsidering at some point.

SOLAR_FIELDS 4y ago
I've been a personal user for 4 years or so after getting a membership through the corp I was working with at the time. It's wild how different the experience is depending on what platform you are working with. In my personal stuff I use Firefox, in which the 1Password experience is not great. I also use it on iOS for personal use on safari, an experience I would also rank as "not great". In a job that I started working with recently, I use Chrome exclusively and it works very well on that platform. So it seems like not a whole lot of effort is being paid to having a unified experience on platforms by 1Password. I understand it's kind of a hard problem, but the discrepancy seems rather large from my experience. Too large for what they are charging and continue to charge. That being said, I can't say that there are preferable alternatives currently. My current company uses Lastpass and while the chrome experience is OK, it isn't a massive UX improvement over 1Password either.
cpuguy83 4y ago
I have the opposite experience... sort of. It's not getting slower but of course also not noticeably faster. But the app has gotten better and better over the years. --- edit fix some wording issues from starting the sentence one way and finishing it another ---
- bombcar 4y ago
  My main problem is safari on Mac - it takes its sweet time unlocking and then I often have to click around or reload the page to get it to actually “stick”.
ghostpepper 4y ago
I've definitely noticed the Firefox extension (on Linux and MacOS) working more slowly and occasionally even hanging the entire browser for up to 30 seconds.

olliecornelia 4y ago

yosito 4y ago

I have literally thousands of passwords in 1Password. I'd love to migrate to something else, but it seems like a lot of work.

diegof79 4y ago
It’s not: https://support.1password.com/export/ https://support.1password.com/export/ Most password managers support CSV import/export. I moved all my passwords from LastPass to 1Password in a minute.
- LilBytes 4y ago
  A little inaccurate. It's not possible to easily export attachments, so if you have private keys up there as attachments rather than in plain text, QR code screenshots, CSV's or similar. These will not come out trivially. There are some open source Python scripts up there for exporting attachments out of 1Password and BitWarden but I could never get them working.
  - mdaniel 4y ago
    I can appreciate that it's painful not having an agreed upon standard for password exchange, but for sure 1pux is a zip file that 100% includes attachments <https://support.1password.com/1pux-format/#files-folder https://support.1password.com/1pux-format/#files-folder>. I have verified that personally
    - bwoodruff 4y ago
      Can confirm. 1pux includes attachments. It should essentially be lossless if where you're going has a good importer. -Ben, 1Password

smnrchrds 4y ago

It's a bold business decision, as a password manager company, to take actions that decrease people's trust in you.

rglover 4y ago
Made me think of this https://www.youtube.com/watch?v=4Ru8DMW-grY https://www.youtube.com/watch?v=4Ru8DMW-grY
userbinator 4y ago
Honestly, in general I'm more surprised that people would be willing to trust a thirdparty in the first place, with literally all the keys to their online lives. (I'm excluding those who use password managers mainly for throwaway accounts.)
krainboltgreene 4y ago
This increases my trust in them. I don't want them focusing on this nonsense garbage.
- drcongo 4y ago
  You prefer a password manager that is only installable from a zip download with no SHA hash for verification? Interesting.
  - krainboltgreene 4y ago
    No, I prefer a team who isn't willing to be bothered by nonsense anti-electron trendy commentary.

filereaper 4y ago

I'm trying to find an alternative to LastPass given their announcement today and was thinking of moving to 1Password. Many responses here are recommending against 1Password. What's a good alternative, specifically for families, as I've moved members of my family to LP? I'll specifically need some recovery mechanism for them in the event they lose access, as they're still getting used to this workflow. Its not ideal but what's needed realistically.

abfan1127 4y ago
I missed LastPass's announcement. can you share? Edit: here it is: https://blog.lastpass.com/2022/08/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/08/notice-of-recent-security-...
- andrewflnr 4y ago
  Unless there's evidence they're lying about the scope, that alone doesn't seem like reason enough to ditch them. Not that I'm opposed to switching to keepassxc.
mtgx 4y ago
Bitwarden.
sethherr 4y ago
Bitwarden
Analemma_ 4y ago
I moved from 1Password to Bitwarden about a month ago and am perfectly happy. Bitwarden is missing a small number of nice "quality of life" features like Touch ID support on Macs and large type mode, but these aren't even close to dealbreakers. There is a family plan available for up to 6 people, and for recovery there is an "encrypted export" function so you can have an encrypted vault in cold storage. Would recommend.
- jacko0 4y ago

replete 4y ago

The main reason I switched from 1password 7 is that at some point they removed the option to disable code signature checks, meaning they had to update 1Password whenever a browser vendor changed their signature. This effectively means that Firefox working with the old version is going to end at some point, they just happen to have kept the same signature or some time. The other side of this, is that it will not work with LibreFox, which isn't signed. Frustratingly, they had the option to disable checks for years in 1Password and removed it. KeePassXC is the way to go. Similar experience on android and desktop to 1Password (non-SaaS) local vault.

mdaniel 4y ago
FWIW, my experience is that it isn't "code signatures," it's on-disk file ownership: https://1password.community/discussion/comment/641113/#Comment_641113 https://1password.community/discussion/comment/641113/#Comme...
- replete 4y ago
  I investigated the browser extension not working with LibreWolf, broke down the logs and it was definitely code signature verification check. LibreWolf is unsigned and that is why it didn't work. It stopped working with Chrome at some point for the same reason

alfiedotwtf 4y ago

Am I the only one that still uses a plaintext file for passwords?

42e6e8c8-f7b8-4 4y ago
Consider an open source password vault: https://keepass.info/ https://keepass.info/ . Bummer to have all your passwords in the clear on compromise because it isn't encrypted.
glerk 4y ago
I am using a schema to derive the password based on the website/application which is stored only in my brain.
cdelsolar 4y ago
My wife uses a little notebook with an encoding scheme known only to her.

rdl 4y ago

They lost their way a few years ago when they stopped supporting user synced vaults, relying on cloud services. Then, deprioritizing even iCloud/Dropbox backed synced vaults. With 1Password 8 they went full clownworld by eliminating local vaults entirely. I’m glad to have months to transition off 1Password 7 but haven’t yet found the ideal consumer replacement.

deleted 4y ago
[deleted]
ohCh6zos 4y ago
I dropped them in favor of self hosted bitwarden and I've been much happier.
- rdl 4y ago
  I use bitwarden in corp/client environments but the mobile experience is inferior to 1Password. I wish Futo would pay for a great fully open source (and reproducible build, multiple competing vendor backend, self hostable backend, etc.) project. Keepass, bitwarden, enpass are tolerable. Something which could both integrate with hashicorp vault and with some shared sessions/no sharing of passwords thing would be cool too (via weird proxy tricks or a browser trick; basically to let a browser log into my session without the user/computer ever seeing the password, only auth delegation.)
  - ohCh6zos 4y ago
    YMMV of course, but I've found using bitwarden on iOS with the built in password integration seems to work identically to 1Password.
xyzzy_plugh 4y ago
If you're using local vaults then you don't need the vast majority of features they're building. I think it makes a lot of sense to de-prioritize that type of user. Stuff like one time shares (or any sharing really), travel mode, multi account management, not to mention all the enterprise features. It's basically an entirely different product, and I don't fault them for going in a different direction when there are so many other, free products which fill that niche. The communication could've maybe been better, but overall it's hard to say that the rug was pulled out from under you when you were not using a subscription nor obligated to receive updates. The old binaries still work fine.

n42 4y ago

Why does 1Password always bring so much controversy in discussion forums? I’ve been a happy paying customer for 10 (!) years. I was there for the migration to a subscription model. I introduced Teams at my company eagerly when it launched. I updated to 1P8 recently without thinking about it, saw the new UI, thought “huh, neat” and moved on. Performance is fine. I barely noticed the change. I am a professional, and don’t mind paying their very reasonable subscription so they can continue to actively maintain the security and functionality of the software that literally protects my entire digital identity. I’m baffled by how many people in our industry are upset by their business model. If you’re making six figures writing software and think $3/month for a cornerstone of your security suite is offensive, you need to grow the fuck up, frankly. Likewise, I don’t care how they moderate their forums. The comments in these threads always feel so self entitled. Use another piece of software if those things are important to you. Plenty of us understand and appreciate the value these guys are creating for us. For me, nothing compares. I’ve tried Keepass, Bitwarden, Apple’s built-in thing, Enpass; they are all either amateurish or missing key functionality that 1Password has that I use every day. All the same, I’m happy they exist. Some day I may need them. I hope more pop up. Anyways, if you’re a dev or employee at 1P I’m writing this for you. Sorry about the jerks. Plenty of us out here love what you are doing.

replete 4y ago
Some people simply don't want to put their passwords onto someone else's computer... I've had little problems with their software, but I don't want to pay a subscription for password hosting because I don't want password hosting
gonehome 4y ago
+1 1Password is really great, the best among the available options by far imo. Most of the negative commentary about it doesn’t matter (I personally prefer native apps to electron apps). The complaints about it being a subscription are weak - software doesn’t exist in a closed system. Keeping up with all the platforms and the OS updates etc. takes perpetual maintenance even if they shipped zero new features. And the features they do ship (family vaults, built in OTP) are really useful. It’s a refreshing escape from the “free” ad-driven hellscape many of the HN commenters complaining are probably employed by.

beardicus 4y ago

1Password is fine, and the constant Electron whining is boring and probably quite duplicative in their forums by now. I don't love some of the changes with 1Password 8, but Electron has nothing to do with it.

tjohns 4y ago
> the constant Electron whining is boring and probably quite duplicative in their forums by now I would take this as a signal that, in the eyes of many of their users, it's not fine.
- quantumduck 4y ago
  Many vocal users, tiny set of their overall users.
  - thecoppinger 4y ago
    Agreed. The anti-Electron crusaders seem to be some of the loudest folks out there, too. 1Pass is great in my opinion, it's a shame it's being so negatively portrayed through-out this thread.

JediPig 4y ago

electron apps are near instant no install with me and others. Exceptions exist, but taking a gb of ram to edit a 9.2k file is insanity. I think 1Password lost its way, especially on the subscription model.

sys_64738 4y ago
Totally agree. Electron is the modern data java to be avoided at all costs.

deleted 4y ago

[deleted]

danyala 4y ago

1Password has been good to me. I did have a strange encounter with their customer support last year; I had asked whether it might be possible to have native support to show when a credential was set up to use Sign In with Apple, or Google sign-in, etc. Their customer service didn't even consider the suggestion, advising me instead that using single sign-on solutions was a security risk. At the time I thought the agent was just confused, but with hindsight I realised it might fit a password manager's agenda to keep people using an email, password and 2FA combo, perhaps with an eye on whatever other solutions 1Password may have in the oven.

mdaniel 4y ago
and yet, they did either arrive at that same conclusion or did hear you, because it now knows if one uses a Sign in With Google and stores that fact in the Item: https://blog.1password.com/sign-in-with-anything-browser-beta/ https://blog.1password.com/sign-in-with-anything-browser-bet...
- danyala 4y ago
  Well damn, haha. They just didn't want to have to put my name in the credits then. Thank you :)

radicaldreamer 4y ago

Their Mac app (version 8 built with electron) had a nasty bug in it where it would consume 80-100% of single core CPU and when made aware, it took them over a week to push out a patch. Whatever they think they're doing taking a native app which rarely (if ever) had such regressions and rewriting as an electron app, they've embarked on a boondoggle.

jcoletti 4y ago

Putting the Electron and subscription model debates to the side, if you're unhappy with 1Password and on macOS, consider switching to Minimalist Password. Currently a fair fixed price model, solid native apps for macOS, iOS & iPadOS, and iCloud syncing. They release updates often enough, and have been super responsive via Twitter about making small tweaks. The only thing missing are Chrome/FF extensions but they're coming (have to copy/paste on desktop unless you use Safari).

LionTamer 4y ago
What important differences are there between Apple’s iCloud Keychain password management and Minimalist Password? Is it just the (coming soon) Chrome support?
- jcoletti 4y ago
  iCloud Keychain password manager is becoming more capable but still pretty limited. Aside from the extensions to support more browsers soon, Minimalist Password provides some of the sugar that 1Password has, like the ability to store different things beyond just passwords (credit cards, crypto wallet keys for hot wallets, software licenses, secure notes, etc.) It also includes the ability to add custom fields of various types to password entries, and tags for grouping. It's more of a comprehensive secrets manager.

AA-BA-94-2A-56 4y ago

I love 1P and would wholeheartedly recommend it to anyone. But... They are cagey around this fact. They are not just trying to remove criticisms of the fact that 1Password 8 is based on Electron, they are actually trying to gaslight. Whenever you mention that 1P8 is backed by Electron (I myself am very neutral towards that fact), they will quickly correct you and tell you it's backed by Rust instead. For whatever reason, they are choosing not to just own the truth. This is a real shame because new 1Password 8 is really good, and I recommend it.

artdigital 4y ago
> This is a real shame because new 1Password 8 is really good, and I recommend it. This is subjective. For me I feel everything is a bit more clunky, especially when using the standalone extensions. I have it constantly that the extension doesn’t unlock, the desktop version not showing up when I hit the global shortcut, rendering delays and and and Been using 8 since the pre release to give it a chance but much much prefer 7. I never had this many problems with 1Password and I’m a loyal user since they very early versions 7 was a perfect product that worked flawlessly, 8 is an ok product that does its job. Can’t say I like AgileBits though, too much shady behavior: the subscription migration (hiding one time purchase licenses completely), removing standalone vaults, showing ads within the app, and now this crap
bdougherty 4y ago
Yep. Somebody asked on Reddit the other day what happened to the Apple Watch app with 1P 8 for iOS and the lead guy responded with: > FYI, Support for Apple Watch was not dropped. The old Apple Watch app could not be included in 1Password for compatibility reasons. We are still exploring how we can include an Apple Watch app in 1Password 8. So the Apple Watch app is no longer included, but support wasn't dropped?? I don't understand why they cannot just tell the truth about things. Why do they seem to be doing so many things that erode trust when their entire business is based around it?
- krainboltgreene 4y ago
  If the server is down for maintenance and patches that doesn't mean the server is gone forever, you know that right?

leach 4y ago

1P8 is fine, I didn’t notice any decrease in performance at all.

aetherspawn 4y ago

The new 1Password 8 is a lot better than the old 1Password in my opinion. We just switched our whole company over. I'm not sure of the basis for the key criticism, as 1Password 8 feels more responsive than 1Password 7 -- which used to take several seconds to appear on the desktop if it was locked.

oofbey 4y ago
What do you think is better about it?
- aetherspawn 4y ago
  1. A lot of the core functions i.e. search seem to have better performance. 2. It opens quicker, whereas 1P 7 seemed to sometimes take several seconds to open. By comparison, 1P 8 is always instant, and that's important if you're trying to login to a website via the browser plugin and your Vault is locked. 3. It looks more integrated with Windows 11, as the UX and iconography matches. Also the bigger scale on text and clickable areas makes it nicer to use on a touchpad. I also prefer how the login screen covers the whole screen now. It wasn't always easy to see which monitor popped up the prompt in 1P 7 if you have many. Some minor criticism: It's less "nice" to customize your Login items in 1P 8. The label editor and UX to add extra items to Logins is not as good as in 1P 7, but I can't quite put my finger on it. I think it is because the editable parts don't clearly turn into text fields when you press them.

wanderingmind 4y ago

HN community with all their hacker ethos and dev skills should be fully behind Bitwarden, a superior password manager with some rough edges on UI. Bitwarden is fully FOSS and heck they charge much less than 1P ($10/yr for premium). If shit like this happens, you can always leave Bitwarden and start self hosting using VaultWarden (its rust clone).

noirbot 4y ago
I was really into it until I hit some bug/corruption where it just stopped accepting my password to unlock it, and then I had literally 0 recourse and had to spend hours recovering it, since they wouldn't even let me just delete the account and start over.
- wanderingmind 4y ago
  Thats strange and I have never heard this issue before. Did you have any issue filed in github with them. One way to go around is to export and download your data. You can then import it into a new account or an account run on Vaultwarden.

stereoradonc 4y ago

BitWarden user here. Everything in 1Password minus the toxic optimism, standards compliant migration (1Password can't import from BitWarden, but other way round works) and one fourth of the subscription costs. BitWarden is easy to manage - I got my mother to install it on her Android device, and she can easily manage passwords. Their shift to an expensive subscription genuinely disappointed me with subpar applications. When alternatives work, why consider 1Password? Best option is to stay away from them.

InTheArena 4y ago
It's on 1Password that they can export in a reasonable way that Bitwarden understands, but Bitwarden can't export that way? Or to put it another way, you claim 1Password is not standards compliant. What standard should they be? My experience is that Bitwarden has a clunky user interface, and I just don't trust them (yet) security-wise. I have no problem paying for an interface that my family can use. 1Password and Bitwarden are both really good options. If you are more in the Apple ecosystem, and prefer a great UX, then go 1Password. If you trust bitwarden, and are in other ecosystems, I think that's great too. Throwing around phrases like "toxic optimism" and "standards compliant migration" is a bit low. https://www.nytimes.com/wirecutter/reviews/best-password-managers/ https://www.nytimes.com/wirecutter/reviews/best-password-man...
- stereoradonc 4y ago
  I expressed my opinion about the toxic optimism part. As for the "migration"- they refer you to a tool (MRC converter) to convert the Bitwarden import to transfer to 1Password. (Read more here: https://1password.community/discussion/102118/import-from-bitwarden-solved-converter-available https://1password.community/discussion/102118/import-from-bi...) Here's more I found: https://support.1password.com/cs/import-mac/ https://support.1password.com/cs/import-mac/ Something on github: https://github.com/torshinalexey/bitwarden-to-1password-csv https://github.com/torshinalexey/bitwarden-to-1password-csv I found this on Reddit: https://www.reddit.com/r/1Password/comments/r9cfd1/comment/hniw80l/?context=3 https://www.reddit.com/r/1Password/comments/r9cfd1/comment/h... If 1Password expects me to pay for their services, they make it impossible for a non-technical user. As for the Wirecutter review, it's hard to decide on a publication that makes money from affiliate referrals. 1Password is uniformly bad; either way you look at it. If its value for money, Bitwarden offers the best one. I am NOT affiliated to either company but speaking from a user perspective.

InTheArena 4y ago

I'm not sure this is correct. I am seeing all of the posts just fine as a normal logged in user?

malshe 4y ago

From the forum comments it seems that another major complaint is the absence of 1PW from Mac App Store. I totally get that. I also found it was bizarre that the update had to be downloaded from a website.

_23sd 4y ago

They should just lock the thread if it’s getting unproductive. Sounds like the developers aren’t interested in putting it on the Mac App Store and don’t want to discuss the reasons, so of course the thread is going to be nothing but complaints and sometimes hyperbole.

hombre_fatal 4y ago

The thread is actually about the app not being on the Mac App Store anymore. Electron apps can be published to the app store, so Electron is kind of a distraction here.

eduction 4y ago

About 10-15 years ago they were behaving the same way. I made a post in their forums complaining that their on disk file storage left your list of domain names in cleartext so someone with access to your files could see where you have accounts, which reduced the benefit of them encrypting the actual passwords, something they made a big deal about in their marketing. They moved the post from the high traffic forum section about 1Password to an obscure forum section about random topics. (Their justification for leaving the domains in cleartext was that it was needed to make the browser extension work.) I still use the product but the company is flawed. They are just less flawed than others.

TheNewsIsHere 4y ago
As someone who has had professional involvement with them, I was thinking about this the other day. I would summarize them exactly the same way. When it comes to security and privacy in cryptographic terms, they seldom make a misstep. They rightly uphold Kerckhoff’s principle. They do the most important technical things right and reliably. They deserve credit for that. When it comes to all of the soft/human/marketing/product management decisions, they have some really bad calls under their belts. They deserve criticism for that.

c23gooey 4y ago

I'm curious where the evidence for the headline is? I clicked the link but I just see some forum posts about the app not being in the App Store. Are all the comments on this thread just people commenting based off the headline?

mdaniel 4y ago
no, observe that the latest post in that thread is Aug 25 <https://1password.community/discussion/comment/653739/#Comment_653739 https://1password.community/discussion/comment/653739/#Comme...> but if one clicks on the "Topics > Mac" header to go back to the threads list <https://1password.community/categories/1password-for-mac https://1password.community/categories/1password-for-mac> it does not show up alongside the other Aug 25 updates (command-f for "Apple" or "App Store") The thread does show up in the search results, but if one were interested in seeing a thread with 6 pages worth of replies, and untold number of views, in order to know that topic is ... receiving a lot of attention ... then you'd have to come to HN :-)
- c23gooey 4y ago
  thanks!

CodeWriter23 4y ago

Doesn't using Electron imply their user's passwords are now vulnerable to any compromised npm package they happen to use?

krainboltgreene 4y ago
No.

moltar 4y ago

One of the primary reason for selecting 1Password was a native app. But at this point isn’t much holding me back from switching to BitWarden. I already use it for my business. I guess it’s time to switch my personal too.

moltar 4y ago

I’m really wondering how 1P is able to audit the NPM dependency tree on every build.

whydid 4y ago
Probably with a local gated mirror, and very careful upgrades. I hope...
krainboltgreene 4y ago
You know you can lock dependencies, right?
- moltar 4y ago
  I know of course. But you still need to audit them before. And then on every npm update you do. It can be a full time job. But even then there’s no guarantee you’ll slip and miss. I can definitely see a potential targeted attack. Since you could reverse the 1P bundle and see what packages it uses and then try to insert some malicious code. And then gain access to millions of 1P vaults.

nikolay 4y ago

Honestly, their street cred went down the drain when they switched to Electron! I can imagine them making this decision 5 years ago, but today, there are options!

kylehotchkiss 4y ago

I am no electron fan but 1password’s new desktop apps have been a huge improvement from 7 for me and the new mobile apps are equally impressive. I’m not gonna let up on electron complaints for other companies because a lot of them are just taking the easy way out with it (ugh why can’t slack just be a little more simple and native) but 1pass proved to me an electron app can be decent if a company pours in the resources

brian-armstrong 4y ago

Easy solution here - switch to an open source password manager and don't look back. They're way less likely to suddenly betray you in an update. I recommend https://keepassxc.org/ https://keepassxc.org/

caycep 4y ago

I’m still on seven… Still works OK, and I haven’t gotten a lot of pressure from them to upgrade. Since I’m mostly on Mac – has anyone made a transition to OSX keychain? I’ve used it a lot back in the day but I can’t really remember… But modern day iOS/os x seems to have a lot of integrations

LionTamer 4y ago
I use that and chrome keychain - it’s honestly very good on the iPhone and great on the computer for safari although it doesn’t work on other browsers

AnonC 4y ago

AgileBits and its forums have always been hostile places for customers who ask questions that the company is not comfortable with (like dark patterns, anti-customer policies, etc.). Nothing new here. The problem starts right at the top, and that “we know better than you at all times” culture flows down to all the customer support representatives. By whatever chance, I think older forum posts are still there for anyone to go and verify for how long these toxic reactions have been around.

rcarmo 4y ago

Again, I have switched away successfully and have a list of alternatives for various platforms: https://taoofmac.com/space/apps/1password https://taoofmac.com/space/apps/1password

ghusto 4y ago

I am confusion. I upgraded (unthinkingly) and don't see what the fuss is about? In fact they've added something that I've wanted for a long time, which is universal password suggestions (for applications). ¯\_(ツ)_/¯ works on my machine? EDIT: Ooooooh, just read the support thread and now I understand. Goddammit, I wish I knew all this before I upgraded. Seems like there's a trust issue with people trying to get an answer as to why three months in, it still can't be downloaded from the App Store. They suspect Apple isn't approving it due to some shadiness and/or security issues. I really hope not, but their responses and the way this has happened does look _well_ shady.

Dwedit 4y ago

Anything made in Electron could be replaced by a <1MB .EXE that imports the OS's default web browser.

bacan 4y ago

I will cancel my sub and shift to KeePass before installing an Electron Version of 1Password Not only is Electron heavy, but also inherits all the security vulnerabilities of Chromium. This is compounded further by the fact that Electron uses its own bundled version of Chromium and so needs to be separately updated, before the app is compiled by the devs. So many app developers are not even aware of this and so will not bother updating the SDK.

skyzyx 4y ago

Like it or not (I don’t), but the Electron apps are here to stay. It’s the direction they’ve decided on. Arguing about it does nothing to move the needle forward. It’s a done deal. I imagine that posts about it are simply unproductive. I’ve posted about it, and my posts are still there. This past year was the first time since 2009 that I’ve actively looked at alternatives, and there are none. 1Password is in a class entirely its own. Are there things I wish that were different? Yes. Do I wish they’d bring back features that they’ve dropped? Absolutely. But it’s still the single best product in its category. Nothing else comes remotely close. And they are years ahead of #2. What’re you gonna do?