4 ms·

Is 1password more secure?

by shmittywerben 4y ago

jeffrallen 4y ago
I left LastPass when it was bought and migrated to 1Password. I have not had a breach notification since. Just sayin'.
- entelechy0 4y ago
  [dead]
malepoon2 4y ago
1Password does encrypt URLs. It also requires an extra Secret Key [0] in addition to your password. This makes it much, much harder to use the data even if encrypted vaults were stolen. They also have a development team that's very active. Lastpass had been coasting for years. [0] https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/
- ilyt 4y ago
  They've been coasting pretty much since buyout
  - mdaniel 4y ago
    Look, I hate the "new" 1Password as much or more than most, but to say they're coasting is disingenuous; just last week they published their "op" plugin system allowing running "gh" and "glab" and a bunch of other common commands as subprocess of their "op" binary to inject the api tokens. I think the SSH Agent behavior is also post-money They've also listen to our bitching about requiring the master password every 2 weeks even with biometrics turned on, and rolled that back to a configurable setting
    - the_lucifer 4y ago
      They’re talking about last pass buyout. Not 1password
deleted 4y ago
[deleted]
Egoist 4y ago
In my opinion, 1password is definitely more secure. 1password generates a key when registering which you cannot restore. So not only an attacker need to know your password, they also have to know the generated sequence. This is helpful for people who tend to use easy to break passwords. 1pasaword is not perfect, but it’s far better than lastpass
dzikimarian 4y ago
Today it might be, tomorrow they might be acquired by someone with all your data. Then in a year they may focus on monetization more than security. Get something that writes data in open format and does not interfere with how you store it. Eg. Keepass with some privacy focused file storage.
- scrollaway 4y ago
  Keepass is fantastic but it is unsuitable for many things, such as multi-user/teams. The browser integration is also very much not something I trust, unlike 1Password's. 1Password has a fantastic track record. Yes, tomorrow, their incentives might change. But the data is copied and available locally; if they start fucking with user data, we will see it coming. Security is a lot about trust and trade-offs. This includes trusting someone who has shown themselves to be trustworthy, even if they might not be trustworthy tomorrow.
  - dzikimarian 4y ago
    Well - guess I have no trust, when it comes to uploading my passwords to someone's else server. I remember too many SaaS companies with awesome reputation, that over time became sketchy (including Last Pass). As for the teams - you shouldn't have shared accounts. Making introducing them convinient is bad idea. Where I work, we're audited for that and honestly it's very small issue if you give it a few minutes of thought.
    - scrollaway 4y ago
      Lastpass was always sketchy, as long as I have known them. I can back this up with proof, it’s not their first leak and I’ve personally talked about how you shouldn’t use them as early as 2012… Re teams, just because you shouldn’t have shared accounts doesn’t mean you can’t have shared secrets which end up in a password manager. Or more generally, the ability to have managed employee vaults. And regardless, shared accounts do happen, because some providers just suck. Making them as secure as possible is more important.
luma 4y ago
Maybe, but we'll never know because you've just traded one cloud solution for another. You cannot audit their code and by handing over all your passwords, you've just made your entire digital life dependant upon their continued financial success. I cannot fathom why anyone would look at the situation today and decide that the solution is more of the same. Get an offline password manager and keep your valuables out of the cloud. I like Keepass, but there are plenty of FOSS solutions out there that allow you to actually own your data.
- spikej 4y ago
  Most likely for the convenience that it offers. Getting non-technical family members to actually use KeePass, etc is next to impossible.

Is 1password more secure?

jeffrallen 4y ago

I left LastPass when it was bought and migrated to 1Password. I have not had a breach notification since. Just sayin'.

entelechy0 4y ago
[dead]

malepoon2 4y ago

1Password does encrypt URLs. It also requires an extra Secret Key [0] in addition to your password. This makes it much, much harder to use the data even if encrypted vaults were stolen. They also have a development team that's very active. Lastpass had been coasting for years. [0] https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/

ilyt 4y ago
They've been coasting pretty much since buyout
- mdaniel 4y ago
  Look, I hate the "new" 1Password as much or more than most, but to say they're coasting is disingenuous; just last week they published their "op" plugin system allowing running "gh" and "glab" and a bunch of other common commands as subprocess of their "op" binary to inject the api tokens. I think the SSH Agent behavior is also post-money They've also listen to our bitching about requiring the master password every 2 weeks even with biometrics turned on, and rolled that back to a configurable setting
  - the_lucifer 4y ago
    They’re talking about last pass buyout. Not 1password

deleted 4y ago

[deleted]

Egoist 4y ago

In my opinion, 1password is definitely more secure. 1password generates a key when registering which you cannot restore. So not only an attacker need to know your password, they also have to know the generated sequence. This is helpful for people who tend to use easy to break passwords. 1pasaword is not perfect, but it’s far better than lastpass

dzikimarian 4y ago

Today it might be, tomorrow they might be acquired by someone with all your data. Then in a year they may focus on monetization more than security. Get something that writes data in open format and does not interfere with how you store it. Eg. Keepass with some privacy focused file storage.

scrollaway 4y ago
Keepass is fantastic but it is unsuitable for many things, such as multi-user/teams. The browser integration is also very much not something I trust, unlike 1Password's. 1Password has a fantastic track record. Yes, tomorrow, their incentives might change. But the data is copied and available locally; if they start fucking with user data, we will see it coming. Security is a lot about trust and trade-offs. This includes trusting someone who has shown themselves to be trustworthy, even if they might not be trustworthy tomorrow.
- dzikimarian 4y ago
  Well - guess I have no trust, when it comes to uploading my passwords to someone's else server. I remember too many SaaS companies with awesome reputation, that over time became sketchy (including Last Pass). As for the teams - you shouldn't have shared accounts. Making introducing them convinient is bad idea. Where I work, we're audited for that and honestly it's very small issue if you give it a few minutes of thought.
  - scrollaway 4y ago
    Lastpass was always sketchy, as long as I have known them. I can back this up with proof, it’s not their first leak and I’ve personally talked about how you shouldn’t use them as early as 2012… Re teams, just because you shouldn’t have shared accounts doesn’t mean you can’t have shared secrets which end up in a password manager. Or more generally, the ability to have managed employee vaults. And regardless, shared accounts do happen, because some providers just suck. Making them as secure as possible is more important.

luma 4y ago

Maybe, but we'll never know because you've just traded one cloud solution for another. You cannot audit their code and by handing over all your passwords, you've just made your entire digital life dependant upon their continued financial success. I cannot fathom why anyone would look at the situation today and decide that the solution is more of the same. Get an offline password manager and keep your valuables out of the cloud. I like Keepass, but there are plenty of FOSS solutions out there that allow you to actually own your data.

spikej 4y ago
Most likely for the convenience that it offers. Getting non-technical family members to actually use KeePass, etc is next to impossible.