7 ms·

1Password rolling out “privacy-preserving” telemetry system

74 points by LopRabbit 3y ago

imwillofficial 3y ago
So wait, what was the last system?
- andrewmunsell 3y ago
  > Up until this point, we’ve used our own usage and your feedback to inform our decision-making. We’ve learned and improved a lot this way. But there’s always been a drawback to this approach: we don’t know what your 1Password experience is like unless you tell us.
  - imwillofficial 3y ago
    Thanks!
sneak 3y ago
Ahh yes, a feature every user wishes to have in a sensitive, critical, local encryption tool - something that silently exfiltrates data to the manufacturer. The only way it preserves privacy is if it defaults to off. Anything else is a lie in service of a fraud.
- sreetamdas 3y ago
  Looks like they've reversed their earlier decision and it will now be opt-in: > You’ll see this message when you open 1Password on mobile and desktop when it’s time for you to choose whether you would like to participate [...] The choice to share your data is yours. We won’t collect anything unless you’ve confirmed you’re happy to share in-app usage data moving forward.
- semiquaver 3y ago
  The post says that it does default to off: > Later this summer, you’ll see the option to participate in our telemetry system and help improve 1Password. You don’t need to take any action right now, and we won’t collect any usage data without your awareness and consent first. Developing modern software without being able to observe its operation is simply not realistic. Telemetry of this sort is an important driver of software quality and product improvement. I’m convinced that people who talk this way are not recognizing the important distinctions between google-analytics-style tracking software that is just trying to squeeze more money out of users and observability-style tracking that is a key part of the software development lifecycle. If you refuse to acknowledge any value in the latter then you deserve the buggy software that results.
  - sneak 3y ago
    > Developing modern software without being able to observe its operation is simply not realistic. Go manages to do it, as does Linux, and Debian. I think this sort of thinking is poisonous. Just because it is common does not make it ethical or justified.
    - manfre 3y ago
      Discussion of Go toolchain wanting to add telemetry for these same reasons. This casts doubts on how well they're managing to do it. https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409
      - sneak 3y ago
        They concluded (correctly) that opt-in was the only reasonable approach.
        semiquaver 3y ago
        Be careful you don’t hurt yourself moving those goalposts.
    - charcircuit 3y ago
      >as does Linux Linux has a lot of telemetry features which businesses can use to aggregate data on how it is operating. These businesses if they identify problems submit patches to fix them. >and Debian Debian has telemtry on what packages people install. https://popcon.debian.org/ https://popcon.debian.org/
  - hn_throwaway_99 3y ago
    It's like "how did we ever build functional products without the ability to spy on you all the time??" I don't disagree that telemetry is ubiquitous in modern software and pretty much built into modern software dev lifecycles, but it's not like we didn't build lots of capable software before this was the case. Heck, 1Password itself seemed to be doing fine without any telemetry in the past. The point people are making is that the one place you probably don't want telemetry software is your system critical password manager. There is a lot of potential for an "oopsie" where something accidentally gets sent that shouldn't get sent, and that's what people have an issue with.
- pfych 3y ago
  The actual post mentions the following: > We’ve designed our telemetry system to collect data on “events”. An event is essentially an action, like: Finishing our in-app onboarding, Unlocking 1Password, Creating a new item, Filling an item in a website or app. > We won’t be collecting your saved passwords, passkeys, usernames, and any URLs associated with your items. Your private information is just that – private. With it also being opt-in I dont see an issue with collecting basic numbers for how often people use the plugin or app, as long as they're telling the truth, I think it's fine.
  - sneak 3y ago
    The issue is that the data doesn't belong to the vendor - it belongs to the user. It doesn't matter that you don't personally regard it as sensitive. Also due to things like lack of ESNI and lack of onion routing to obscure client IP address, it leaks other information to the vendor and ISP like your travel history over time (via client IP geolocation) and waking/sleeping/working hours. Software that exfiltrates this information without advance consent is stealing it.
    - semiquaver 3y ago
      We are talking about a network-connected paid service. It’s revealing your IP address to the company that provides the service by its natural operation, such as synchronizing passwords between devices over the network. > Software that exfiltrates this information without advance consent is stealing it. I’m not sure who you are arguing with when you keep repeating this. I pointed out that the post clearly states they will obtain this consent. At any rate, you are obviously not a customer so why are you so mad?
    - charcircuit 3y ago
      >the data doesn't belong to the vendor - it belongs to the user The data doesn't belong to anyone. The data is just a fact of what happened. No one owns the fact that George Washington was the first US president.
      - dns_snek 3y ago
kgwxd 3y ago
Nope. Opt-in or opt-out doesn't matter. I don't even want the code in there, settings flags get ignored all the time, accidentally and intentionally. I don't know why anyone would choose a proprietary password manager.
jperras 3y ago
I really hope that they're using the Prio system (https://crypto.stanford.edu/prio/ https://crypto.stanford.edu/prio/), perhaps via Divvi Up (https://divviup.org/ https://divviup.org/), which is offered by the fine folks at ISRG. But, the fact that they don't mention anything other than "All event data will be de-identified and processed in aggregate before it’s used for analysis" leads me to believe it's an in-house solution for a very complicated problem, if one chooses to do it correctly.
et-al 3y ago
Will this new data actually lead them to acknowledge that 1Password v8 on Electron is trash?
- doublepg23 3y ago
  Indeed, if you’re already ignoring feedback as loud as the v8 pushback what could you possibly listen to via telemetry?
  - DANmode 3y ago
    What's in memory, filenames, app lists,
  - pocketarc 3y ago
    It's funny, isn't it? They claim to need telemetry to learn how they can make things better, but v8 just plain isn't better. I believe the reality is they need telemetry so they can use it to validate their own decisions. They can produce nice charts and tell each other they're doing a great job and feel good about it, even if users are complaining about it (or just silently accepting it, until some last straw causes them to leave). If you were to measure my metrics, they'd still look the same as in v7, and they'd tell them nothing about the fact that I think v8 is crap, and that v8 means that one day I might just wake up and say "yeah let's try that bitwarden that HN always talks about".
- CharlesW 3y ago
  It was — I complained as much as anyone, both publicly and directly to them — but to their credit they addressed all of my many issues. I’d bet that this anonymous, opt-in telemetry system is a direct result of that FUBAR’d launch.
neilv 3y ago
> And at this time, our telemetry system won’t be rolled out to any team or business using 1Password. The fact that they're doing this at all, as well as that they're dangling it as a "we may alter the agreement", makes me more hesitant to buy a team/business subscription to 1Password. > We know that in the technology industry, “analytics” and “usage data” can be an excuse to invade your privacy. In this case, it seems like unnecessary leakage and implementation complexity in a "you had ONE job" highly security-sensitive service.
- NoMoreNicksLeft 3y ago
  I don't know why anyone would subscribe at all. I think it was 7 or 8 years ago, I bought it for $50 (since moved on to another)... but it was a one-time payment with on-going rights. Y'all have some pathologically high tolerance to subscription load or something. For the record, I had to give up on it when they offered no self-hosted sync mechanisms... I don't trust the cloud services with my passwords, even if they are encrypted. And then I found the forum comment where they were bitching about webdav, and I just knew that it was never not going to be a shitshow.
  - rich_sasha 3y ago
    I draw some comfort from knowing that there is a stable source of funding to the security and bug fix efforts. And a persistent incentive to not abandon this software. I hate coffee, keyboard and software "subscriptions" which are just overpriced purchases but to me, this ain't it.
quincepie 3y ago
While they state it's opt-in, the image they provided shows that the share button is enabled by default. I hope it is not the case, but I personally dislike having opt-in telemetry with a button/checkbox that's enabled by default.
SanjayMehta 3y ago
Disappointing, but on IOS it appears Keychain is a viable replacement. Maybe this is the last straw to migrate.
- sacnoradhq 3y ago
  Unnecessary. iOS supports third-party password manager apps. Bitwarden is one that works and crosses platforms other than Apple. Keeper also. https://bitwarden.com https://bitwarden.com https://www.keepersecurity.com https://www.keepersecurity.com
arbus5672 3y ago
We currently use 1Password at work and actions like this from a company whose only job is to make sure that passwords are kept securely make me very nervous. Are there any alternative password management tools that folks here have had a good experience with at a 100+ headcount org with varying levels of technical expertise?
- x3n0ph3n3 3y ago
  Bitwarden!
  - asabla 3y ago
    +1 for bitwarden It has served me and my family well for years now.
  - CharlesW 3y ago
    According to Bitwarden’s privacy policy, they do the same thing that 1Password is proposing, only without the anonymity promises. Why do you think it’s better?
    - arbus5672 3y ago
      Just read through the policy that is available here: https://bitwarden.com/privacy/ https://bitwarden.com/privacy/ Yikes! Here are some quotes: > we analyze data about your visits to our Site to do things like optimize product design. We use a variety of tools to do this, including Google Analytics. When you visit the Site using Google Analytics, we and Google may link information about your activity from that site with activity from other sites that use Google Analytics services. > Bitwarden may use the Personal Information collected by the Site to provide you with services, ..., including: For research and development to improve the Bitwarden Service, Site and other Bitwarden services;
      - tsuujin 3y ago
        I was ok with that except all the way through the words “product design”, because I do think that’s a fair thing to collect data for… but it kind of went off the rails after that.
roughly 3y ago
Oh right, they took a bunch of venture funding a bit ago, didn’t they?
1123581321 3y ago
They wrote that they were testing this system company-wide. They employ several hundred employees, so they must have learned some things about their product during those tests. I wonder how much more they will learn from their customers. Has anyone been in a similar position and seen what kind of difference that can make?
ratg13 3y ago
this is what happens when you hire people that want to adopt industry standard solutions instead of taking the time to understand their product and their audience. or rather technical people making decisions instead of product manager type people. password management is as simple of a feature set as you can get. less is generally more. all of the information you would ever need to know can be gathered from a user survey. the people involved would need skillsets for interacting with users though. this sounds like it's developers trying to gather this data, and this data will tell them absolutely nothing and only piss people off that they are even thinking about wanting it.
hoistbypetard 3y ago
If their insistence on killing off the "bring-your-own" sync options hadn't made me leave their platform in 2018, this would do it now. Even if I believe it's completely benign, I don't want my password manager phoning home. I still don't think BitWarden is quite as nice to use as 1Password, but it's close, and my self-hosted bitwarden-rs (now VaultWarden) instance has been pretty hassle free for quite a while now.
ilrwbwrkhv 3y ago
Moved away from it a long time back. Between raising a ton of money, building an electron app and adding telemetry and sketchy agreements, I am glad I got out when I did.
- SOLAR_FIELDS 3y ago
  I’ve only really ever otherwise used Lastpass (not of my own volition) and Keepass. Lastpass is its own dumpster fire and KeePass is sort of like “why do you need Dropbox when you can achieve what it does with rsync”. At least 1Password has decent (not great) UX. Are there other, better solutions out there? One particular rant of mine for 1Password is that its iOS app seemingly doesn’t remember any context whatsoever. It doesn’t matter how recently you entered your password, it will prompt you for it again if the auto paste went wrong or some other trivial thing caused the entry of credentials to not go correctly.
  - ShowalkKama 3y ago
    bitwarden
    - alberth 3y ago
      FYI - they raised $100M late last year. https://techcrunch.com/2022/09/06/open-source-password-manager-bitwarden-raises-100m/ https://techcrunch.com/2022/09/06/open-source-password-manag...
    - ttarr 3y ago
      See https://news.ycombinator.com/item?id=36428107 https://news.ycombinator.com/item?id=36428107 I'm definitely switch away from Bitwarden.
      - Fnoord 3y ago
        I self-host it, and I'm sticking to that.
eshack94 3y ago
It's beyond me why anyone would willingly choose a service like this when perfectly good (and free + open-source) services like KeePassXC and pass exist. Maybe in the corporate space, but I can't understand why an individual would choose to outsource their personal security to a for-profit corporation. Seems like this just introduces additional risk by outsourcing such an important function to a third party outside of your control.
- dcsommer 3y ago
  Convenience, of course. Secondarily, lack of awareness of alternatives.
  - eshack94 3y ago
    This seems accurate. I forget how much people value convenience
- dangus 3y ago
  I can explain why. I migrated from KeePass to 1Password. The short version of the story is that I used a mess of tooling to get a KeePass-based workflow going, and it resulted in data loss that I had to recover. I stored my database on a cloud storage provider, and then I would read that database with various clients on my various platforms. At that time, just about none of the (good) clients were cross-platform (KeePassXC that you brought up has no mobile apps). At that time, an open-source Mac client had a bug that caused some extra fields to be cleared/not saved. I put some important information in those notes and they were lost due to this one client being buggy. Luckily, my cloud provider kept a backup of previous database files. That's when I realized that having someone else manage all this was way better than saving a few bucks. I've used 1Password through a lot of new version changes and complete rewrites and I can't recommend it enough. It integrates deeply with all my devices, supports the latest developer frameworks on those devices (e.g., delivering a Safari for iOS extension as soon as extensions were added to iOS), and it's packed full of features that I never dreamed of having with KeePass. This optional opt-in telemetry seems way more reasonable and respectful than comparable SaaS services and commercial applications, but, alas, "telemetry" is a boogie-man word. Maybe that KeePass app that dropped my data could have used some telemetry to spot that error a bit faster.
deleted 3y ago
[deleted]
CatWChainsaw 3y ago
My password manager is my memory + a notebook in a fireproof safe and I never have issues like this.
- gaws 3y ago
  Assuming your password manager creates unique, complex passwords for each online account, how do you handle logging in when you're away from your primary machine or on your phone?
  - CatWChainsaw 3y ago
    I don't let browsers/devices remember my passwords. The reason I can remember as many as I do is because I have to input them on a consistent basis.

74 points by LopRabbit 3y ago

imwillofficial 3y ago

So wait, what was the last system?

andrewmunsell 3y ago
> Up until this point, we’ve used our own usage and your feedback to inform our decision-making. We’ve learned and improved a lot this way. But there’s always been a drawback to this approach: we don’t know what your 1Password experience is like unless you tell us.
- imwillofficial 3y ago
  Thanks!

sneak 3y ago

Ahh yes, a feature every user wishes to have in a sensitive, critical, local encryption tool - something that silently exfiltrates data to the manufacturer. The only way it preserves privacy is if it defaults to off. Anything else is a lie in service of a fraud.

sreetamdas 3y ago
Looks like they've reversed their earlier decision and it will now be opt-in: > You’ll see this message when you open 1Password on mobile and desktop when it’s time for you to choose whether you would like to participate [...] The choice to share your data is yours. We won’t collect anything unless you’ve confirmed you’re happy to share in-app usage data moving forward.
semiquaver 3y ago
The post says that it does default to off: > Later this summer, you’ll see the option to participate in our telemetry system and help improve 1Password. You don’t need to take any action right now, and we won’t collect any usage data without your awareness and consent first. Developing modern software without being able to observe its operation is simply not realistic. Telemetry of this sort is an important driver of software quality and product improvement. I’m convinced that people who talk this way are not recognizing the important distinctions between google-analytics-style tracking software that is just trying to squeeze more money out of users and observability-style tracking that is a key part of the software development lifecycle. If you refuse to acknowledge any value in the latter then you deserve the buggy software that results.
- sneak 3y ago
  > Developing modern software without being able to observe its operation is simply not realistic. Go manages to do it, as does Linux, and Debian. I think this sort of thinking is poisonous. Just because it is common does not make it ethical or justified.
  - manfre 3y ago
    Discussion of Go toolchain wanting to add telemetry for these same reasons. This casts doubts on how well they're managing to do it. https://github.com/golang/go/discussions/58409 https://github.com/golang/go/discussions/58409
    - sneak 3y ago
      They concluded (correctly) that opt-in was the only reasonable approach.
      - semiquaver 3y ago
        Be careful you don’t hurt yourself moving those goalposts.
  - charcircuit 3y ago
    >as does Linux Linux has a lot of telemetry features which businesses can use to aggregate data on how it is operating. These businesses if they identify problems submit patches to fix them. >and Debian Debian has telemtry on what packages people install. https://popcon.debian.org/ https://popcon.debian.org/
- hn_throwaway_99 3y ago
  It's like "how did we ever build functional products without the ability to spy on you all the time??" I don't disagree that telemetry is ubiquitous in modern software and pretty much built into modern software dev lifecycles, but it's not like we didn't build lots of capable software before this was the case. Heck, 1Password itself seemed to be doing fine without any telemetry in the past. The point people are making is that the one place you probably don't want telemetry software is your system critical password manager. There is a lot of potential for an "oopsie" where something accidentally gets sent that shouldn't get sent, and that's what people have an issue with.
pfych 3y ago
The actual post mentions the following: > We’ve designed our telemetry system to collect data on “events”. An event is essentially an action, like: Finishing our in-app onboarding, Unlocking 1Password, Creating a new item, Filling an item in a website or app. > We won’t be collecting your saved passwords, passkeys, usernames, and any URLs associated with your items. Your private information is just that – private. With it also being opt-in I dont see an issue with collecting basic numbers for how often people use the plugin or app, as long as they're telling the truth, I think it's fine.
- sneak 3y ago
  The issue is that the data doesn't belong to the vendor - it belongs to the user. It doesn't matter that you don't personally regard it as sensitive. Also due to things like lack of ESNI and lack of onion routing to obscure client IP address, it leaks other information to the vendor and ISP like your travel history over time (via client IP geolocation) and waking/sleeping/working hours. Software that exfiltrates this information without advance consent is stealing it.
  - semiquaver 3y ago
    We are talking about a network-connected paid service. It’s revealing your IP address to the company that provides the service by its natural operation, such as synchronizing passwords between devices over the network. > Software that exfiltrates this information without advance consent is stealing it. I’m not sure who you are arguing with when you keep repeating this. I pointed out that the post clearly states they will obtain this consent. At any rate, you are obviously not a customer so why are you so mad?
  - charcircuit 3y ago
    >the data doesn't belong to the vendor - it belongs to the user The data doesn't belong to anyone. The data is just a fact of what happened. No one owns the fact that George Washington was the first US president.
    - dns_snek 3y ago

kgwxd 3y ago

Nope. Opt-in or opt-out doesn't matter. I don't even want the code in there, settings flags get ignored all the time, accidentally and intentionally. I don't know why anyone would choose a proprietary password manager.

jperras 3y ago

I really hope that they're using the Prio system (https://crypto.stanford.edu/prio/ https://crypto.stanford.edu/prio/), perhaps via Divvi Up (https://divviup.org/ https://divviup.org/), which is offered by the fine folks at ISRG. But, the fact that they don't mention anything other than "All event data will be de-identified and processed in aggregate before it’s used for analysis" leads me to believe it's an in-house solution for a very complicated problem, if one chooses to do it correctly.

et-al 3y ago

Will this new data actually lead them to acknowledge that 1Password v8 on Electron is trash?

doublepg23 3y ago
Indeed, if you’re already ignoring feedback as loud as the v8 pushback what could you possibly listen to via telemetry?
- DANmode 3y ago
  What's in memory, filenames, app lists,
- pocketarc 3y ago
  It's funny, isn't it? They claim to need telemetry to learn how they can make things better, but v8 just plain isn't better. I believe the reality is they need telemetry so they can use it to validate their own decisions. They can produce nice charts and tell each other they're doing a great job and feel good about it, even if users are complaining about it (or just silently accepting it, until some last straw causes them to leave). If you were to measure my metrics, they'd still look the same as in v7, and they'd tell them nothing about the fact that I think v8 is crap, and that v8 means that one day I might just wake up and say "yeah let's try that bitwarden that HN always talks about".
CharlesW 3y ago
It was — I complained as much as anyone, both publicly and directly to them — but to their credit they addressed all of my many issues. I’d bet that this anonymous, opt-in telemetry system is a direct result of that FUBAR’d launch.

neilv 3y ago

> And at this time, our telemetry system won’t be rolled out to any team or business using 1Password. The fact that they're doing this at all, as well as that they're dangling it as a "we may alter the agreement", makes me more hesitant to buy a team/business subscription to 1Password. > We know that in the technology industry, “analytics” and “usage data” can be an excuse to invade your privacy. In this case, it seems like unnecessary leakage and implementation complexity in a "you had ONE job" highly security-sensitive service.

NoMoreNicksLeft 3y ago
I don't know why anyone would subscribe at all. I think it was 7 or 8 years ago, I bought it for $50 (since moved on to another)... but it was a one-time payment with on-going rights. Y'all have some pathologically high tolerance to subscription load or something. For the record, I had to give up on it when they offered no self-hosted sync mechanisms... I don't trust the cloud services with my passwords, even if they are encrypted. And then I found the forum comment where they were bitching about webdav, and I just knew that it was never not going to be a shitshow.
- rich_sasha 3y ago
  I draw some comfort from knowing that there is a stable source of funding to the security and bug fix efforts. And a persistent incentive to not abandon this software. I hate coffee, keyboard and software "subscriptions" which are just overpriced purchases but to me, this ain't it.

quincepie 3y ago

While they state it's opt-in, the image they provided shows that the share button is enabled by default. I hope it is not the case, but I personally dislike having opt-in telemetry with a button/checkbox that's enabled by default.

SanjayMehta 3y ago

Disappointing, but on IOS it appears Keychain is a viable replacement. Maybe this is the last straw to migrate.

sacnoradhq 3y ago
Unnecessary. iOS supports third-party password manager apps. Bitwarden is one that works and crosses platforms other than Apple. Keeper also. https://bitwarden.com https://bitwarden.com https://www.keepersecurity.com https://www.keepersecurity.com

arbus5672 3y ago

We currently use 1Password at work and actions like this from a company whose only job is to make sure that passwords are kept securely make me very nervous. Are there any alternative password management tools that folks here have had a good experience with at a 100+ headcount org with varying levels of technical expertise?

x3n0ph3n3 3y ago
Bitwarden!
- asabla 3y ago
  +1 for bitwarden It has served me and my family well for years now.
- CharlesW 3y ago
  According to Bitwarden’s privacy policy, they do the same thing that 1Password is proposing, only without the anonymity promises. Why do you think it’s better?
  - arbus5672 3y ago
    Just read through the policy that is available here: https://bitwarden.com/privacy/ https://bitwarden.com/privacy/ Yikes! Here are some quotes: > we analyze data about your visits to our Site to do things like optimize product design. We use a variety of tools to do this, including Google Analytics. When you visit the Site using Google Analytics, we and Google may link information about your activity from that site with activity from other sites that use Google Analytics services. > Bitwarden may use the Personal Information collected by the Site to provide you with services, ..., including: For research and development to improve the Bitwarden Service, Site and other Bitwarden services;
    - tsuujin 3y ago
      I was ok with that except all the way through the words “product design”, because I do think that’s a fair thing to collect data for… but it kind of went off the rails after that.

roughly 3y ago

Oh right, they took a bunch of venture funding a bit ago, didn’t they?

1123581321 3y ago

They wrote that they were testing this system company-wide. They employ several hundred employees, so they must have learned some things about their product during those tests. I wonder how much more they will learn from their customers. Has anyone been in a similar position and seen what kind of difference that can make?

ratg13 3y ago

this is what happens when you hire people that want to adopt industry standard solutions instead of taking the time to understand their product and their audience. or rather technical people making decisions instead of product manager type people. password management is as simple of a feature set as you can get. less is generally more. all of the information you would ever need to know can be gathered from a user survey. the people involved would need skillsets for interacting with users though. this sounds like it's developers trying to gather this data, and this data will tell them absolutely nothing and only piss people off that they are even thinking about wanting it.

hoistbypetard 3y ago

If their insistence on killing off the "bring-your-own" sync options hadn't made me leave their platform in 2018, this would do it now. Even if I believe it's completely benign, I don't want my password manager phoning home. I still don't think BitWarden is quite as nice to use as 1Password, but it's close, and my self-hosted bitwarden-rs (now VaultWarden) instance has been pretty hassle free for quite a while now.

ilrwbwrkhv 3y ago

Moved away from it a long time back. Between raising a ton of money, building an electron app and adding telemetry and sketchy agreements, I am glad I got out when I did.

SOLAR_FIELDS 3y ago
I’ve only really ever otherwise used Lastpass (not of my own volition) and Keepass. Lastpass is its own dumpster fire and KeePass is sort of like “why do you need Dropbox when you can achieve what it does with rsync”. At least 1Password has decent (not great) UX. Are there other, better solutions out there? One particular rant of mine for 1Password is that its iOS app seemingly doesn’t remember any context whatsoever. It doesn’t matter how recently you entered your password, it will prompt you for it again if the auto paste went wrong or some other trivial thing caused the entry of credentials to not go correctly.
- ShowalkKama 3y ago
  bitwarden
  - alberth 3y ago
    FYI - they raised $100M late last year. https://techcrunch.com/2022/09/06/open-source-password-manager-bitwarden-raises-100m/ https://techcrunch.com/2022/09/06/open-source-password-manag...
  - ttarr 3y ago
    See https://news.ycombinator.com/item?id=36428107 https://news.ycombinator.com/item?id=36428107 I'm definitely switch away from Bitwarden.
    - Fnoord 3y ago
      I self-host it, and I'm sticking to that.

eshack94 3y ago

It's beyond me why anyone would willingly choose a service like this when perfectly good (and free + open-source) services like KeePassXC and pass exist. Maybe in the corporate space, but I can't understand why an individual would choose to outsource their personal security to a for-profit corporation. Seems like this just introduces additional risk by outsourcing such an important function to a third party outside of your control.

dcsommer 3y ago
Convenience, of course. Secondarily, lack of awareness of alternatives.
- eshack94 3y ago
  This seems accurate. I forget how much people value convenience
dangus 3y ago
I can explain why. I migrated from KeePass to 1Password. The short version of the story is that I used a mess of tooling to get a KeePass-based workflow going, and it resulted in data loss that I had to recover. I stored my database on a cloud storage provider, and then I would read that database with various clients on my various platforms. At that time, just about none of the (good) clients were cross-platform (KeePassXC that you brought up has no mobile apps). At that time, an open-source Mac client had a bug that caused some extra fields to be cleared/not saved. I put some important information in those notes and they were lost due to this one client being buggy. Luckily, my cloud provider kept a backup of previous database files. That's when I realized that having someone else manage all this was way better than saving a few bucks. I've used 1Password through a lot of new version changes and complete rewrites and I can't recommend it enough. It integrates deeply with all my devices, supports the latest developer frameworks on those devices (e.g., delivering a Safari for iOS extension as soon as extensions were added to iOS), and it's packed full of features that I never dreamed of having with KeePass. This optional opt-in telemetry seems way more reasonable and respectful than comparable SaaS services and commercial applications, but, alas, "telemetry" is a boogie-man word. Maybe that KeePass app that dropped my data could have used some telemetry to spot that error a bit faster.

deleted 3y ago

[deleted]

CatWChainsaw 3y ago

My password manager is my memory + a notebook in a fireproof safe and I never have issues like this.

gaws 3y ago
Assuming your password manager creates unique, complex passwords for each online account, how do you handle logging in when you're away from your primary machine or on your phone?
- CatWChainsaw 3y ago
  I don't let browsers/devices remember my passwords. The reason I can remember as many as I do is because I have to input them on a consistent basis.