5 ms·

When I see people running to 1Password, I'm really concerned. I don't know whether 1Password has somewhat of a following cult here or they're doing some astrotu

When I see people running to 1Password, I'm really concerned. I don't know whether 1Password has somewhat of a following cult here or they're doing some astroturfing in this community. But 1Password claims are the same claims as LastPass used to have. (zero trust, secure, …) And now we're discovering that LastPass was totally lying. We have no way of knowing whether 1Password is telling the truth. For me, my password manager is the one absolute thing I want to be auditable. 1Password with its follower "who know people who designed it" reminds me of "trust me bro", "funds are SAFU" in cryptocurrency projects. Leaving LastPass in order to sign up for 1Password feels like out of the pan into the fire. I've always use and will always recommend FOSS for password manager. I install Bitwarden on my technology-illeterate friends and family and I use KeepassxXC personally. I've looked briefly how vaults are encrypted in both software. The security is sound. Bitwarden was audited by Cure53[1] which is one of my favourite security auditing firm. (I highly recommend to read their audit of dovecot[2]) Anyway, you know what they say "fool me once…". I'll be eating popcorn when some claim will turn out to be false for 1Password… [1] https://cure53.de/pentest-report_bitwarden.pdf https://cure53.de/pentest-report_bitwarden.pdf [2] https://cure53.de/pentest-report_dovecot.pdf https://cure53.de/pentest-report_dovecot.pdf

idiot900 4y ago
On top of that, they’ve made their client software prettier and slower, but not really more usable IMHO. I migrated to BitWarden and don’t think the user experience is any worse.
- zeroonetwothree 4y ago
  Indeed I think BitWarden has the better UX
- alyandon 4y ago
  My only complaint with Bitwarden is that the 1Password extension seems to have fewer issues automatically recognizing login fields for web sites. In most cases, that's an easy enough fix via custom fields in Bitwarden but the UX around that could be nicer.
- barnabee 4y ago
  I use 1Password but the slowly worsening/slowening UI and move to a subscription model, along with the fact I can’t even upgrade to the latest version because I still sync my own vault are making me look around for an escape hatch. I guess it’s the Keepass family of apps, or perhaps Bitwarden, but it’s disappointing to even have to think about switching.
- roustem 4y ago
  One of the tests we recently added to 1Password is the "Moby Dick Workout" for secure notes with Markdown rendering. Would love you to compare 1Password and Bitwarden: https://www.hogbaysoftware.com/posts/moby-dick-workout/ https://www.hogbaysoftware.com/posts/moby-dick-workout/
pentest_bob 4y ago
Not dismissing anything you said regarding 1PW but they also had cure53 audits. See e.g. - https://cure53.de/pentest-report_1password-b5.pdf https://cure53.de/pentest-report_1password-b5.pdf - https://cure53.de/pentest-report_1password-mobile.pdf https://cure53.de/pentest-report_1password-mobile.pdf Edit: overview of audits https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/
- acatton 4y ago
  These are pen-tests and black-box security audits. While they're definitely better than nothing, and they would show that their security is better than LastPass', the code was never audited.
  - bendiksolheim 4y ago
    Are we reading the same reports? At least the two latest reports by Cure53 mentions "source code audit". In addition, the audits by ISE and AppSec explicitly mentions code review as part of the audit. I am in no way familiar with these kinds of reports, but does this not mean that (at least parts of) the source code was audited?
deleted 4y ago
[deleted]
Dylan16807 4y ago
> 1Password claims are the same claims as LastPass And the whole post is about things other than the claims.
- acatton 4y ago
  The part of the post about 1Password is basically "trust me, bro, a buddy of mine used to work there".
  - Dylan16807 4y ago
    All the things about encryption don't fit that. All the things about previous breaches and bug reports don't fit that. You're describing about a tenth of the argument.

idiot900 4y ago

On top of that, they’ve made their client software prettier and slower, but not really more usable IMHO. I migrated to BitWarden and don’t think the user experience is any worse.

zeroonetwothree 4y ago
Indeed I think BitWarden has the better UX
alyandon 4y ago
My only complaint with Bitwarden is that the 1Password extension seems to have fewer issues automatically recognizing login fields for web sites. In most cases, that's an easy enough fix via custom fields in Bitwarden but the UX around that could be nicer.
barnabee 4y ago
I use 1Password but the slowly worsening/slowening UI and move to a subscription model, along with the fact I can’t even upgrade to the latest version because I still sync my own vault are making me look around for an escape hatch. I guess it’s the Keepass family of apps, or perhaps Bitwarden, but it’s disappointing to even have to think about switching.
roustem 4y ago
One of the tests we recently added to 1Password is the "Moby Dick Workout" for secure notes with Markdown rendering. Would love you to compare 1Password and Bitwarden: https://www.hogbaysoftware.com/posts/moby-dick-workout/ https://www.hogbaysoftware.com/posts/moby-dick-workout/

pentest_bob 4y ago

Not dismissing anything you said regarding 1PW but they also had cure53 audits. See e.g. - https://cure53.de/pentest-report_1password-b5.pdf https://cure53.de/pentest-report_1password-b5.pdf - https://cure53.de/pentest-report_1password-mobile.pdf https://cure53.de/pentest-report_1password-mobile.pdf Edit: overview of audits https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/

acatton 4y ago
These are pen-tests and black-box security audits. While they're definitely better than nothing, and they would show that their security is better than LastPass', the code was never audited.
- bendiksolheim 4y ago
  Are we reading the same reports? At least the two latest reports by Cure53 mentions "source code audit". In addition, the audits by ISE and AppSec explicitly mentions code review as part of the audit. I am in no way familiar with these kinds of reports, but does this not mean that (at least parts of) the source code was audited?

deleted 4y ago

[deleted]

Dylan16807 4y ago

> 1Password claims are the same claims as LastPass And the whole post is about things other than the claims.

acatton 4y ago
The part of the post about 1Password is basically "trust me, bro, a buddy of mine used to work there".
- Dylan16807 4y ago
  All the things about encryption don't fit that. All the things about previous breaches and bug reports don't fit that. You're describing about a tenth of the argument.