14 ms·

Thoughts on LastPass vs 1Password?

by Zaheer 11y ago

rckclmbr 11y ago
Switched to LastPass from 1Password a year or so ago because of linux support. Haven't minded. I like 1Password more (just because of the prettier UI), but LastPass is good enough.
- johnward 11y ago
  Does 1password work on android and ios now?
  - maxmouchet 11y ago
    It works pretty well on iOS. And since iOS 8 it even supports form filling in Safari using extensions.
  - matwood 11y ago
    There is a 1Password Android client, but it's not from the 1Password people iirc.
  - HOLM814 11y ago
    Yes, 1password have official android and ios apps that are working quite well. It's possible to enter passwords without placing them in the phones paste buffer.
    - johnward 11y ago
      Nice. How do you sync the DB?
makeitsuckless 11y ago
For my personal use, I feel more comfortable with 1Password and having full control over my data. For company wide use, LastPass Enterprise is a better fit. Centralized management is essential when dealing with larger numbers of not particularly tech savvy and security conscious users. And despite this incident, I trust a specialized operation like Lastpass more with keeping the data secure 24/7 than myself or company IT.
nahname 11y ago
Switched from LastPass to 1Password two weeks ago. 1Password has a much cleaner and intuitive UI.
- Zaheer 11y ago
  How hard was it to make the switch? I'm considering doing a switch soon if it's not too painful.
  - nahname 11y ago
    Manual, so the number of accounts will determine your pain. That said, 1Password has an OSX client + Chrome extension. Day to day is much easier to use.
    - mitchty 11y ago
      Does it have extensions for safari and firefox on osx at least? Yes I use all three browsers on osx, and linux too sans safari obviously. If there is a safari extension too so my iphone can form fill too that would be good. Otherwise I'll stick to my normal new passphrase every 6 months and new passwords for each site every year approach. Tonight I'll be doing the yearly update of passwords, which is a pita but not too bad with lastpass as long as I have a show to watch.
xbryanx 11y ago
I use 1Password for personal/family stuff. It's a much better interface and has many fewer bugs. I manage a Last Pass Enterprise instance at work. I love/hate it. The interface is terrible and buggy. However, it's the only tool I've found to manage passwords across many users (some medium to non-technical) who need access to shared accounts within an organization. 1Password doesn't really do this, and sharing vaults over Dropbox doesn't really cut it. Despite all the bug pain, it's so much better than what we were doing before, sharing passwords via email and other embarrassing methods. How can there really only be one company doing what LastPass Enterprise does? There must be other systems that I just can't find in my research. Any recommendations for other managed password stores for organizations?
- orthecreedence 11y ago
  Hi, creator of Turtl here (https://turtl.it https://turtl.it). Turtl is not a password manager per-se, and is still fairly early in development, but is a client-side encrypted note-taking tool. It could conceivably be used as a primary password manager service. Some features that are useful: client-side crypto (key is derived from username/password, ALL data is encrypted by default), sharing between accounts via asym encryption, open source client & server means it could be run completely in-house if required (as opposed to using the hosted service). It doesn't have mobile apps right now, but those are coming pretty quick (either end of June or in July). One of our slated features is a password note type, and possibly eventual integration with browsers. Might be worth a look. Like I said, Turtl is new and is missing a lot of features you'd want in a pure-password-manager solution, but it has the potential to grow into this space a lot due to its security, sharing, and hosting features.
- schrodinger 11y ago
  Check out https://www.passpack.com/ https://www.passpack.com/, I can't really vouch but I do know some places that use it.
- Zaheer 11y ago
  I'm currently a LastPass user but considering 1Password for about the same reasons... 1Password seems much more consumer friendly. Annoyed at bugs and crappier interface. 1Password also recently started integrating with some apps which I found particularly useful.
tptacek 11y ago
I understand 1Password's security design, it makes sense to me, and it has a fairly minimal attack surface. It's not perfect, but it's a sound design of a very conventional cryptosystem. I do not understand LastPass's design; the shared authenticator/decrypting key, the website with HTML form fields for my master password, the public key crypto in Javascript with JSBN. Also, Steve Thomas doesn't like them, and found a vulnerability in their client/server protocol a while back. I recommend 1Password, if you can use it.
- peteretep 11y ago
  I also like that in an emergency I can log in to Dropbox (one of four passwords) I remember, and open the HTML 1Password implementation (another I remember), and start to reaccess my services if all my devices get stolen.
- skrause 11y ago
  What I really don't like about 1Password is that they actually store an item's name and domain unencrypted in the vault: https://discussions.agilebits.com/discussion/38180/vault-1password-is-storing-the-url-itemnames-in-your-vault-in-an-outside-file-in-clear-text https://discussions.agilebits.com/discussion/38180/vault-1pa... For my taste that's already too much unencrypted info being synced over Dropbox etc, an attacker can easily see on which sites I have accounts.
vitd 11y ago
I've not used LastPass, but I chose 1Password because it has the ability to sync with my iOS device over wi-fi. So I don't need to store anything in the cloud, but still get syncing between devices. It also has options for using DropBox or iCloud, so if you do sync in the cloud, it's still your own account on a different service. So there's not a single point-of-attack like there apparently is with LastPass.

Thoughts on LastPass vs 1Password?

by Zaheer 11y ago

Thoughts on LastPass vs 1Password?

Switched to LastPass from 1Password a year or so ago because of linux support. Haven't minded. I like 1Password more (just because of the prettier UI), but LastPass is good enough.

johnward 11y ago
Does 1password work on android and ios now?
- maxmouchet 11y ago
  It works pretty well on iOS. And since iOS 8 it even supports form filling in Safari using extensions.
- matwood 11y ago
  There is a 1Password Android client, but it's not from the 1Password people iirc.
- HOLM814 11y ago
  Yes, 1password have official android and ios apps that are working quite well. It's possible to enter passwords without placing them in the phones paste buffer.
  - johnward 11y ago
    Nice. How do you sync the DB?

makeitsuckless 11y ago

For my personal use, I feel more comfortable with 1Password and having full control over my data. For company wide use, LastPass Enterprise is a better fit. Centralized management is essential when dealing with larger numbers of not particularly tech savvy and security conscious users. And despite this incident, I trust a specialized operation like Lastpass more with keeping the data secure 24/7 than myself or company IT.

nahname 11y ago

Switched from LastPass to 1Password two weeks ago. 1Password has a much cleaner and intuitive UI.

Zaheer 11y ago
How hard was it to make the switch? I'm considering doing a switch soon if it's not too painful.
- nahname 11y ago
  Manual, so the number of accounts will determine your pain. That said, 1Password has an OSX client + Chrome extension. Day to day is much easier to use.
  - mitchty 11y ago
    Does it have extensions for safari and firefox on osx at least? Yes I use all three browsers on osx, and linux too sans safari obviously. If there is a safari extension too so my iphone can form fill too that would be good. Otherwise I'll stick to my normal new passphrase every 6 months and new passwords for each site every year approach. Tonight I'll be doing the yearly update of passwords, which is a pita but not too bad with lastpass as long as I have a show to watch.

xbryanx 11y ago

I use 1Password for personal/family stuff. It's a much better interface and has many fewer bugs. I manage a Last Pass Enterprise instance at work. I love/hate it. The interface is terrible and buggy. However, it's the only tool I've found to manage passwords across many users (some medium to non-technical) who need access to shared accounts within an organization. 1Password doesn't really do this, and sharing vaults over Dropbox doesn't really cut it. Despite all the bug pain, it's so much better than what we were doing before, sharing passwords via email and other embarrassing methods. How can there really only be one company doing what LastPass Enterprise does? There must be other systems that I just can't find in my research. Any recommendations for other managed password stores for organizations?

orthecreedence 11y ago
Hi, creator of Turtl here (https://turtl.it https://turtl.it). Turtl is not a password manager per-se, and is still fairly early in development, but is a client-side encrypted note-taking tool. It could conceivably be used as a primary password manager service. Some features that are useful: client-side crypto (key is derived from username/password, ALL data is encrypted by default), sharing between accounts via asym encryption, open source client & server means it could be run completely in-house if required (as opposed to using the hosted service). It doesn't have mobile apps right now, but those are coming pretty quick (either end of June or in July). One of our slated features is a password note type, and possibly eventual integration with browsers. Might be worth a look. Like I said, Turtl is new and is missing a lot of features you'd want in a pure-password-manager solution, but it has the potential to grow into this space a lot due to its security, sharing, and hosting features.
schrodinger 11y ago
Check out https://www.passpack.com/ https://www.passpack.com/, I can't really vouch but I do know some places that use it.
Zaheer 11y ago
I'm currently a LastPass user but considering 1Password for about the same reasons... 1Password seems much more consumer friendly. Annoyed at bugs and crappier interface. 1Password also recently started integrating with some apps which I found particularly useful.

tptacek 11y ago

I understand 1Password's security design, it makes sense to me, and it has a fairly minimal attack surface. It's not perfect, but it's a sound design of a very conventional cryptosystem. I do not understand LastPass's design; the shared authenticator/decrypting key, the website with HTML form fields for my master password, the public key crypto in Javascript with JSBN. Also, Steve Thomas doesn't like them, and found a vulnerability in their client/server protocol a while back. I recommend 1Password, if you can use it.

peteretep 11y ago
I also like that in an emergency I can log in to Dropbox (one of four passwords) I remember, and open the HTML 1Password implementation (another I remember), and start to reaccess my services if all my devices get stolen.
skrause 11y ago
What I really don't like about 1Password is that they actually store an item's name and domain unencrypted in the vault: https://discussions.agilebits.com/discussion/38180/vault-1password-is-storing-the-url-itemnames-in-your-vault-in-an-outside-file-in-clear-text https://discussions.agilebits.com/discussion/38180/vault-1pa... For my taste that's already too much unencrypted info being synced over Dropbox etc, an attacker can easily see on which sites I have accounts.

vitd 11y ago

I've not used LastPass, but I chose 1Password because it has the ability to sync with my iOS device over wi-fi. So I don't need to store anything in the cloud, but still get syncing between devices. It also has options for using DropBox or iCloud, so if you do sync in the cloud, it's still your own account on a different service. So there's not a single point-of-attack like there apparently is with LastPass.