Hacker News Reader

Comment by Esau | Hacker News Reader

I wasn't aware of this change, so I read the entire linked support thread. Although the company responders did some nice verbal gymnastics, I think it is pretty obvious that this is just mainly just a money grab on behalf of AgileBits.

Additionally, several comments implied that AgileBits was hiding the option to buy a standalone license, so I looked at their pricing page[1]. I have to say I agree; it is not listed as an option alongside the two subscription options. In fact, you have to scroll all the way down, to the end of the FAQ, to even find a mention of it.

[1]https://1password.com/sign-up/

I'll concede that a subscription option might be better for some users, especially those using it on multiple devices, but I think AgileBits should not be hiding the regular license option.

View on HN

Completely agree.

I personally have no problem using commercial software, but my password manager is one place where I suspect that I should be moving to open source in case I don't want to renew my license over some future pricing disagreement, and I lose access to some of my critically important property (passwords).

It's tempting to think that we'll be able to keep our currently purchased standalone licenses in perpetuity, but I've already been dragged through at least one major version upgrade of 1Password to keep pace with new OS developments (for OS X and iOS). There were no new features that I needed or even wanted, but I paid the $50 (or whatever it was, I notice a new license is now $64.99!) anyway to maintain compatibility.

Unfortunately, the landscape for open source alternatives doesn't seem particularly good. Some of those mentioned here like Keepass [1] look like they're usable, but are quite a far shot from 1Password's quality.

[1] http://keepass.info/

In another comment I mentioned these 3 KeePass ports:

[1] https://keeweb.info/

[2] http://keepass2android.codeplex.com/

[3] https://minikeepass.github.io/

I'm a former 1Password user and these work fine. The Android app is actually better than 1Password, and KeeWeb is better for me because it works on Linux as well and it gives me a full history of all edits (not just the password field). Plus being just one file, it is also easier to go back in time using Dropbox's version history.

What you'll miss is the fancy browser extension, but for me that's fine, because a browser extension represents a huge security risk, and selecting a field in KeeWeb is painless as it has keyboard shortcuts. 1Password also has the capability for local network Wifi sync, which is really cool, but at least in my opinion they are moving away from this model and that feature will be gone.

So you'd rather copy and paste passwords because KeePass doesn't have browser extensions? No, thanks. How are extensions security risks? You still need to enter your master password to decrypt passwords. And extensions are siloed by the browser.

For example, Lastpass recently had an exploit in their extension: https://news.ycombinator.com/item?id=12171547

I see nothing wrong with copy/paste. On Android it is a security risk, because apps can get notified and wake up when it happens, but Keepass2Android that I mentioned provides a keyboard for input which works better than 1Password.

And on desktops, I just don't think it's a real threat. Bruce Schneider doesn't thinks so either, while at the same time he recommends against auto-fill: https://www.schneier.com/blog/archives/2014/09/security_of_p...

But even so, KeeWeb and KeePass give you this "auto-type" facility that types the password for you in any password field, without going through copy/paste. It's not much, but it works if you're worried.

There are browser extensions that interface with KeePass to do what you are asking.

I don't use them, I simply use KeePass' autotype feature.

I'd like to see websites make copy/paste easier by allowing you to enter user name and password in a combined field. Have separate fields that can be used the normal way, but also allow submission with the username field left blank and the password field containing username:password.

The fancy browser extensions are important in protecting you from phishing. They will refuse to fill in your password unless the domain matches exactly.

As a multi device user, it's definitely better for me. I have 2x windows desktop, a Mac laptop, an iPhone and an android tablet. With the current non-subscriptioin pricing model, it will cost me 65 dollars for the two desktop apps, plus another 20 dollars for the android + ios apps - that's a fairly hefty upfront fee. 3 dollars a month (after 6 months) is far more appealing really.

As an aside, it's extremely difficult to find out how much the android pro feature currently costs, I ended up finding it in the comments sectino of one of their posts rather than the google play store or on their website.

But the idea behind a password manager is that you effectively use it in perpetuity. I bought 1Password in 2013 for $50, and the iPhone app for $9. I use it several times a day, and don't see that changing at any point in the near future. At $3/month, I would have be approaching twice what I actually paid, with no prospect for being done with that payment. I get why AgileBits is going to a subscription model; I'm sure they would prefer that I had paid them $96 by now, rather than $59, and that I would go on to pay them another $36 per year every year forever. But the idea that you, as a consumer, are looking at this and seeing an appealing deal suggests you haven't really thought it through very well.

I'm seeing a more appealing deal than putting out 80 dollars up front. The amount of software that I have paid for up front, and continued to use for longer than 2 years I can count on one hand. I wouldn't be surprised if in 2 years time I had moved to another service. Given that 62 + 20 is the break even point, that's 27 months paid, plus the 6 months up front, just shy of 3 years.

Out of curiosity, when new versions of iOS and macOS get released over the next several years, are you willing to pay for the upgrades the developers will have to inevitably release in order to maintain compatibility with the OS?

Or do you expect your initial $59 purchase in 2013 to truly last in perpetuity?

You will definitely not pay again for the Android / iOS apps, unless they release it with another name in the app store, or they introduce another paid option, hiding new features under some switch in their code, otherwise for both Android and iOS it's a pay once model.

I've also had 1Password 6 for at least a year. Nothing new happened since I first bought it. And the Windows client still sucks so horribly that indeed that price isn't justified.

But btw, for 3x desktop licenses I don't think you'll get away with 3 dollars per month ;-)

Well I haven't paid for it, I'm currently using lastpass. Why wouldn't I be able to use their $3 plan for 3 desktop machines? They're all my machines (work desktop, personal desktop, personal laptop) and amount of time I am using more than one at a time is minimal.

You're right, you can use it on all three. Btw, the OS X version is great, more than great, it's the best, but the Windows version is old and kind of unmaintained. Make sure you like it.

Eh, I don't consider it hidden as much as they just rolled out this brand new version of the product (the subscription version), so of course they're going to emphasize what's new.

As a 1Password user, I actually prefer this model. Many of us believe that subscription service pricing leads to more sustainable software companies, and for that reason I'm happy to see the AgileBits team take a forward looking perspective.

Reply on news.ycombinator.com