Comment by wonder_er | Hacker News Reader

Comment by wonder_er | Hacker News Reader

Parent Full thread

I'm surprised at how little advocacy there is for 1password.

Yes, it's a single point of failure (probably more, depending on how you choose to define them) but it is invariably more secure than me remembering my super-nifty password algorithm.

It's not perfect, but I trivially generate very long passwords for every service, and have to remember the master password only of my email and my 1password account.

If anything is truly important, it will have 2 factor authentication.

If someone has access to my unlocked physical machine and an unlocked 1password UI, I'm screwed. Additionally, they could use the wrench approach [0] to gain my credentials.

This is not a use-case I'm actively trying to prevent. Nor is protection against state-level actors targeting me in particular.

Further benefit of 1password: my wife and I both use certain shared logins to access things like credit card accounts.

Instead of me having to get her on board with my password book, or special algorithm, I can just move a login into our shared password vault.

I suspect most people reading this are in a similar boat - we're more than happy to pay a few dollars to hire millions of dollars of specialized security knowledge to outsource this problem for us.

This is just too mundane a solution for most people to comment on.

Long live 1Password!

[0] https://xkcd.com/538/

I switched to this after being a long time lastpass user, I'm regretting it. It's visually a lot better but it is terrible at generating passwords and saving them. On both windows and mac with chrome I click the 1pass icon and click generate (nothing happens). If something happens it shows up as a new entry if I go into the vault with no site or anything just a random string that I then maybe copy paste? (ugh). There also is nothing that pops up that lets me alter the specifications for the randomly generated password. Lastpass did an amazing job of this, 1password just seems broken all over the place.

When I did the export/import it ruined tons of passwords because if it had an ampersand symbol (&) it turned it into & resulting in me editing tons of passwords manually. It sucks at saving passwords too, lastpass just worked.

Plus no check on password integrity or strength or leaks. It was nice to do a scan and check on what passwords should be updated, what my duplicates are (if any), mass update, etc. So, basically I went from free but kinda ugly to pretty but broken and more $. This has been the worst trade deal in the history of trade deals, maybe ever.

YMMV but I wish I didn't switch and to move back would be another annoyance that I might do if I didn't just pay for the year.

Hm. I just checked on both of these comments, and it seems 1password manages both quite well.

re: password generation in-browser - this is working just fine for me. [0]

And re: pw integrity or strength - this might not be everything you're looking for, but it's close.

under a 'Security Audit' tab, it has categories for:

- Watchtower (logins associated w/sites that are known vulnurable/exploited)

- Weak Passwords

- Duplicates

- 3+ year old PWs

- 1-3 year old pws

- 6-12 month old pws.

I'm not trying to be a 1password apologist, but I find it to cover my day-to-day use _very_ well. To be sure, I still tweak things in the UI at times. It doesn't capture login URLs perfectly all the time. Etc. But it's pretty good.

[0] https://cl.ly/07072T0e1P2C/Add_Comment___Hacker_News.jpg

Wow, this is not at all what my screen looks like. Maybe it's the extension itself that's lacking? [0]

I don't have any of these other options either. If I click on generate password the box just goes away. Maybe I should scrap the extension and just use the mac/windows application? I was reading a number of reports about not syncing between these. If I have both on maybe it'll cause issues?

[0] https://imgur.com/a/msydX

whoa. Something is not right indeed.

I'd delete the extension and re-install from AgileBit's website, and make sure the 1password app on mac is talking to the extension.

This is odd, but good luck! Obv. their support team would help square things away way better than this random internet stranger could!

Thanks wonder_er! Apparently that did the trick. I'll give this a fair shake now and maybe my harsh comments will be irrelevant soon. :)

it is terrible at generating passwords and saving them

1Password used to be better at this. Generating a password was pretty obvious, it was consistent across mobile/desktop, and the save workflow was better. It’s been several versions since that was the case (v. 3, maybe?). Now I have to hunt for the functionality and then it gets put someplace with no reference to what it is.

Plus no check on password integrity or strength or leaks. It was nice to do a scan and check on what passwords should be updated, what my duplicates are (if any), mass update, etc

I know the Mac version will give you all of this. Compromised sites, dupes, weak passwords, old passwords, there’s a filter for each, and I think you can make your own. It does not appear that you get this on mobile, though.

I've been happily using 1Password 4 for many years, my credentials are encrypted and synced via Dropbox. But I hear the latest versions require you to use their cloud service, the self-hosted version is no longer available. Is that true?

I use 1Password for not only credentials but as a document vault for everything from passports, birth certificates, anything else that falls under "needed after the house burns down". It's one of the most elegant pieces of software I've ever used.

Whilst they do have a cloud-hosted subscription service, the self hosted version is still available.

How are you defining "self hosted" here?

The newest version of the Windows app doesn't support creating or opening local vaults, only storing data in their cloud.

They also no longer offer perpetual/non-subscription licenses, including for the older version that supports local vaults.

At the very least the first would be a requirement for any sort of "self hosted" setup.

And self-hosted can put the files in Apple's iCloud service, making it accessible on your phone. At least, that's how my own is still working.

Your weakest link is probably now iCloud, considering how easily and often it gets hacked...

Which is never, right? Has iCloud actually been “hacked” in the “Yahoo” sense of the word?

I ask because I use iCloud heavily. Nearly 1TB of photos/videos and now use 1Password with iCloud sync.

Has there been a large dump of iCloud credentials, allowing unauthorized access to accounts? Maybe, but it isn't publicly known.

Has Apple made mistakes when designing iCloud, allowing unauthorized access to accounts? Yes.

Indeed. But as the file is encrypted beyond what Apple implements, it is probably at least as safe as if it were on 1Password's own cloud.

This is accurate. I migrated to the cloud service when I wanted to add my wife to my account.

It was not an elegant process, and the friction kept me from following through for more than a few months.

I finally pulled the trigger, spent the time and hassle migrating everything, and am now glad that I did.

Also, you don't want the freemium business model because:

1) passwords are a serious stuff, so you want serious people to to some serious work behind your PM (AKA, it can't be free); 2) passwords are a too fundamental tool of our digital existences to have a monthly-based subscription. The idea of being locked out of your services when you can't afford to pay the monthly fee is just horrible.

agreed! In their defense, the old model wasn't freemium, it was a one-time fee. (I think it was $40 or $50 when I bought it.)

That said, over the time horizon of many years, $40 doesn't cover much at all. For the reasons you mentioned, I felt a sense of relief when I moved over to the monthly model.

I totally understand why they need/want to change their pricing model, and support it even. I don't understand why they've bundled a change in the product along with it and that's what I take issue with.

I'd happily pay them $5/mo to continue using their product as I've been using it - with local vaults, not with their cloud product.

I won't take their product for free if it comes with a forced "upgrade" to the cloud service.

My wife and I do the same which is hugely convenient. You can store more than website logins as well, such as credit card numbers, drivers license details or our passport information.

We do a lot of travel and financial witchcraft so having full access to each other’s into at the unlock of a thumbprint is extremely convenient.

We also have a team vault at FarmLogs which is hugely helpful for sharing access to singular accounts.

It’s such a valuable tool that I don’t even think about paying for it.

precisely! I make heavy use of 1pass document storage to keep high-quality PDFs of:

* passports

* drivers licenses

* birth certificates

* visas

* proof of residency

* vaccination records

* bank paperwork

* etc

We're in the same boat. We travel a lot, often for extended periods of time, and both work fully remotely. Any document anyone could want from me, for any reason, lives in 1password.

They could double the price, and I'd gripe a little, but would never imagine walking away from the tool.

(er, 1password, don't double your prices, if you're reading this.)

edit: formatting

Reply on news.ycombinator.com