Hacker News Reader

Comment by cdumler | Hacker News Reader

So, I'll join the chorus here by saying that I've picked up the subscription fee.

I've been using their software daily for over three years. During that time, they have consistently improved their product and have been open about issues (as far as I am concerned). I was a little irked when I saw the subscription model. I was like, "hey, I paid for this." So, I looked up how much I paid in licenses by looking them up.. in 1Password. Turns out I paid about $40 for the Mac, Windows, iOS, and Android clients. That's $40 over three years for something that I use daily.

Then, look at the $5/mo subscription for families. I get something that gives me access to all their software versions (Mac, Windows, iOS and Android) for five people, my entire family (if my cat ever decides to get a computer). I am a software professional. I pay for tools that keep me going and return me money because they offer me productivity. I pay for Things, Bear, iThoughts, and may other apps that have helped me greatly.

One important statement I make to people is: _the price for security is eternal vigilance_. There are always new ways things get attacked and new ways to be more secure. I realized that I was gladly willing to pay $60/year to keep me and my family going while keeping AgileBits running as well. If there was anything that deserves a subscription, it is your security software. If its any consolation, several of my developer friends feel the same way.

My two cents.

View on HN

As time goes on, I've gotten less and less comfortable using proprietary software for critical tasks. If 1Password were open source, I'd actually be pretty happy to subscribe. But as it stands, I have no faith that the product won't change out from under me in the future, whether due to a pivot, an acquisition, or some other reason. The incentives align in favor of the business, not the customer. IMHO, subscriptions are already pointing in that direction.

I'd rather use something like pass and deal with the downsides. (Though I admittedly haven't switched yet.)

For me, something related: can I remove the data in a usable form? 1Password makes that easy, so like others here, I'm happy to pay them to perform the 'eternal vigilance' that secret-keeping entails.

We also allow export in something called 1PIF. It's a JSON format export of your data. It doesn't currently handle everything super smoothly, notably Documents which are new.

We'll have another solution in the not too distant future that should cover things and be a documented format that anyone with the know how could use.

Also important to note, that if your account ever lapses due to lack of payment. The account is still read-only. You can export your data if you wish even when the account is read-only. We do not lock you out of your data, we just prevent normal use of the application (browser extension, editing items, adding new items, etc). But the data you've already entered is entirely accessible if you want to copy/paste or export.

Kyle

AgileBits

Password Store (AKA 'pass') stores each password as a GPG-encrypted text file, so with gpg, $EDITOR, and cp/mv you have full control over your password data at all times without pass even having to get involved.

It’s nice to see a team of marketers working so hard to convince the masses. Kudos.

Yes, you can export it as a CSV file. They even warn you that it’s not secure.

> They even warn you that it’s not secure.

I don't think anyone who uses a password manager is exporting to CSV for security purposes.

I was trying to illustrate that not only can you extract data in an open format, they also are responsible enough to warn end users that the data is no longer encrypted. This isn’t for the benefit of your typical HN reader.

For now...

Removing the ability to get your own passwords out of your password management utility that you paid for would be corporate suicide.

Crippling it, not so much.

I moved away from 1password at the time of the subscription palaver. I managed to move everything to Keepass but each entry has it's own folder.

I don't blame 1Password for the state of my Keepass db (although they pretty much forced my hand) but the closed nature of 1Password does bite you in the arse when you decide to leave.

I switched from 1Password to LastPass last year and it was a smooth transition. If they’d had a Linux version I’d still be a customer right now.

They now have a chrome extension that supports Linux[1] and a command line app.[2]

[1] https://support.1password.com/getting-started-1password-x/

[2] https://support.1password.com/command-line-getting-started/

We evaluated Lastpass about a year ago and the UI was borderline unusable. Doesn't matter so much for technical teams, but it does in broader use cases.

What did you settle on? It’s basically just a browser extension.

I keep meaning to write some Applescript and/or browser glue for pass(1). Uses GPG, checks into Git, and even has an iOS app.

"Corporate suicide"? 99% of the users wont even notice the feature existed...

They will if you go out of business or decide to spin off the product.

"Corporate suicide" implies that it would be a problem for the company.

Users noticing it after the company is already "going out of business" does not qualify as such.

Yes, you're right, an already-dead company can't die a second time in this highly-hypothethical scenario. They're still dead.

For ever.

At some point you have to value people. The 1Password folks have never let me down, and have been very honest, so I trust them. The product has done nothing but improve over the years for me, increasing in value and ease of use. And then with how often LastPass has had security breaches, it was a no brainer for me to leave LastPass years ago, and I don't regret it.

Shifty Jelly has never let me down either, but they got acquired by NPR. Neither has Q Branch, but they ran out of money and had to shut down. Business for indies isn't predictable. Is AgileBits going to be around in 10 years? I hope so, but I think it's far more likely that they'll be swallowed up by some other company, at best. After getting burned by this over and over again, I just think it's more sensible to stick to OSS options that will probably exist in some compilable state even in the distant future.

> Shifty Jelly has never let me down either, but they got acquired by NPR.

Of all the entities they could be acquired by, I think NPR is the least offensive of all. And they've stated the intent is not to change how PocketCasts works. The other partners are WNYC, WBEZ, and PRX (helmed by Ira Glass). These are all major publishers of podcasts who have a vested interest in keeping PocketCasts a good app, and growing it. I think this is a bad example.

> Neither has Q Branch, but they ran out of money and had to shut down.

They would still be around if they had subscription revenue. Guess who has subscription revenue?

> Is AgileBits going to be around in 10 years?

They started 12 years ago. If you asked 12 years ago if they would still be around in 10 years, the answer would be yes.

> After getting burned by this over and over again, I just think it's more sensible to stick to OSS options that will probably exist in some compilable state even in the distant future.

Well, don't go LastPass if you want OSS.

There are open source 3d party applications on Linux that I've used to access 1Password password archives. The code is closed source but everything they're using to encrypt the passwords are open standards. You can build your own 3rd party open source platform to access them.

Do you have any suggestions for such software? I've been looking into this as I migrate to Linux and have yet to find something that does read and write for stuff stored in my Vault. I'd honestly be willing to pay for software that provided this.

The official solution is to subscribe to their subscription service (any tier works) and use 1Password X in-browser: https://support.1password.com/getting-started-1password-x/

Not sure about other solutions, open or closed; I moved over to their subscription service a few months ago and haven't looked back.

I work for AgileBits, makers of 1Password

We don't prevent people from writing 3rd party tools, but I would also be very wary of using them. Our stance is outlined here:

https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do...

> We have to advise you to never enter your 1Password Master Password into anything that isn’t 1Password. We aren’t casting aspersions on the integrity or competence of any developers, but we simply can’t advise otherwise.

So as long as you're mindful of this advice from us, go forth and conquer.

Kyle

AgileBits

So if the app were open source and the maintainers decided to abandon it, are you going to download the code and keep it updated? If it is forked are you going to trust the new maintainers? Are you going to audit the source code?

This is the big fallacy I see whenever someone uses open source just because the source code is public. Unless you're able to perform a full audit yourself, is it really any better than a closed offering like 1Password?

I suppose the theory is that open source is better (a) because you can audit it if you want to, and (b) it's more likely that someone out there has audited it.

In practice, (a) falls apart if the user doesn't have the knowledge, experience, or time necessary to perform an audit, which is quite likely for security software. And I feel like (b) isn't great either, as there are plenty of examples of major flaws in open source projects that went undetected for long periods - heartbleed is just one example.

I agree with that assessment, but how many vulnerabilities have been found in closed sourced software? If the software is popular enough, someone somewhere is going to find a vulnerability whether it's open or closed source. Look at all of vulnerabilities that Google has found in closed sourced software. It just takes more skill to find vulnerabilities and incentives. The black hats have found vulnerabilities in iOS that Apple still hasn't managed to patch - like the one that lets law enforcement break into a locked iPhone and bypass the fail login attempts.

I think the question is is the likelihood of the party finding the vulnerability being a “good guy” or a “bad guy” different between closed and open source. I’d suspect not, but who knows.

Stuxnet didn’t rely on open source software.

There are major unrevealed flaws in all software more complicated than “hello, world.”

Agree, open source is rights for the users, no matter they have the ability to audit or not.

If it was a matter of OS compatibility, I'd certainly be able to do it for iOS or macOS. Security, less so, but with luck there would be others to do that work, if the app had enough users. Surely it would be better than just implicitly trusting some company with a profit motive?

I'm not expecting anyone to do the work for free, by the way. You could still charge money for cloud sync or even app extensions and still keep the main repo open. Maybe the code could be a few revisions behind to incentivize people to pay.

In any case, from looking around, it seems that KeePass and possibly Bitwarden fit this bill.

Bitwarden has been great for me. After going from LastPass to 1Pass to KeePassXC to Bitwarden, I really appreciate the simplicity of a simple browser extension without the requirement for a local client.

Bitwarden just works and checks the boxes for me. I haven't tried it yet, but there is also a fork [1] that allows us to use our own hosting.

[1] https://github.com/jakeswenson/BitBetter

Of course, the answer to all your questions is "not necessarily". Sure, it's totally possible for people to not audit the code, or let it be abandoned–but open source makes this probability much lower, whereas with closed-source software you have no choice in the matter at all.

I think you’re making a lot of assumptions when assuming the probability is much lower. I’d trust a really proficient small team being paid to produce secure, closed software more than a team of disinterested volunteers. I’d also trust a small group of passionate volunteers over a paid team of crappy engineers. I guess the point is that source being open or not isn’t really the important part, at least in my opinion.

I agree. I try and use solutions that have open source formats, and are preferably open source.

I have made an exception for 1Password, as it is so good. I hate subscription for software, unless there is a clear benefit. In this case, I don't see the benefit.

While our code is not, our vault formats are open. :)

Ben Woodruff AgileBits

I didn't know that. That adds to the esteem in which I hold 1Password and AgileBits. I think an open source format is almost as important as open source software.

Especially security related software companies, they have a tendency of degenerating into user-hostile malware businesses.

Comodo, Tripwire, Symantec, McAfee... on and on.

https://github.com/OblivionCloudControl/opvault

opvault file access has open source tools. It would suck if they changed out from under me in the future (1password is the best password manager and it’s really not even close) but my passwords are at least accessible.

Bitwarden is the answer for your concerns. I've moved to it and never looked back.

https://bitwarden.com

Interesting suggestion, thanks! Can you comment on how good the mobile apps work?

I agree, especially around subscriptions. Too many light burnings already.

I use and love 1Password, but there's no way I'm switching to the subscription model. When my version stops working (either through incompatibility or serious security flaw), I'll begrudgingly find something else to use.

KeePass works for me, and it's available on all the platforms I use.

You are making the same mistake with these arguments as many people make; nobody is complaining about paying for software.

People are complaining about subscriptions, because for example you easily loose track of what exactly it is your paying for.

Paying for an upgrade clearly shows you that you're paying some amount for some list of new features. You can then choose whether or not it's worth paying for. (just to name 1 disadvantage.)

For customers there are 0 benefits to a subscription model. For companies of course there are many.

> For customers there are 0 benefits to a subscription model. For companies of course there are many.

OP described in detail the benefit for customers--constantly updated software. Critical for something as security conscience as a password manager.

People updated software before they started using subscription models.

Paying for software meant they had to make more compelling updates.

You need software companies to provide you with security updates for their products. Insisting that you won’t pay for security updates without new features or that security updates should be offered gratis won’t lead to quality software - it just leads to feature bloat. Attaching a separate price to security updates aligns your needs with a software company’s incentives. Why is that a bad thing in your view?

If you are paying for a subscription there isn’t necessarily an incentive to provide security updates even more, since they have the functionality of your app hostage if you decide to cancel and the automatic monthly billing has no ties to the quantity or wuality of updates they push out.

That being said, security updates shouldbe part of the price you already paid, since a security flaw is a flaw in their original software.

> If you are paying for a subscription there isn’t necessarily an incentive to provide security updates even more

I'm not so sure - it'd be much easier to write the email saying "Sorry, we screwed up and got a critical security but wrong, but here's an update that fixes it." if a significant portion of your users are paying a subscription - compared to writing that same email just as marketing are preparing to try and convince everybody to pay for a new upgrade...

> That being said, security updates should be part of the price you already paid, since a security flaw is a flaw in their original software.

If that was how everything worked - our industry would be _very_ different. If everybody who ever charge money fo a piece of software was on the hook forever for all flaws it might have, you'd only ever be able to buy software from Apple or Oracle or Microsoft - there would need to be almost as any lawyers as developers in any software company.

I understand your idea - but it's the same idea as people who call up my work saying "Hey, the app you made us doesn't work any more, you need to fix it!" and everybody here is like "Who the hell are _they???_ Never even heard of them." and it turns out its a 32 bit iOS app that they paid for in 2013 and we haven't heard from since (and there's only 3 people left in the whole company who were around in '13, and none of them are iOS devs). We do not fix that for them as "part of the price they paid".

That being said, security updates shouldbe part of the price you already paid, since a security flaw is a flaw in their original software.

Security vulnerabilities generally aren’t considers latent defects under warranty laws (at least not in NA). I’m not sure what the tech world would look like if it were - for one thing, software teams would probably need a P.Eng. on their teams to ship. For another, using open source software would be even harder to do without an intermediary like Red Hat who would be willing to accept tort liability.

At any rate, your software vendor has no legal responsibility to provide you with security updates. Maybe they should. But you’ll pay for that anyways. How do you want to amortize those security updates? By paying the dividend discount price of the updates up front and risk having the product abandoned in a few years (cheating you out of your ‘dividend’), or by paying directly through a subscription?

That makes no sense - you have it completely backwards. Their incentive to provide me with timely security updates is my continued subscription fees. On the other hand, if you pay the dividend discount price for those security updates up front, they have every incentive to stop releasing updates and cheat you out of your update ‘dividend’.

> That makes no sense - you have it completely backwards. Their incentive to provide me with timely security updates is my continued subscription fees

You pay one subscription fee for both "I can use my app at all" and "security updates" together. Once there is enough inertia for you to not want to switch off, you'll probably keep paying (to use the app at all) even if they don't provide security updates.

If there were two fees - #1 a one time lifetime usage fee and #2 a security updates subscription fee then maybe that would make sense, but I don't think so otherwise

Agreed. This is the main distinction. If they are explicitly charging for security updates and being upfront that would be a completely different story. That being said, if they could do that then they can also charge for security updates piece-meal.

> At any rate, your software vendor has no legal responsibility to provide you with security updates. Maybe they should. But you’ll pay for that anyways.

Yes, those costs will ultimately be embedded in product pricing and borne by the customer, but that's good. It gives vendors a financial incentive to develop more secure software and reduce their security update costs (and earn more profit). (Nothing is perfectly secure, but a culture change and following certain practices can help. Think Microsoft pre-trustworthy computing memo and Microsoft today.)

> Maybe they should.

True in the traditional model. But the Mac App Store model doesn’t have paid upgrades, which meant there was no incentive for them to keep updating. With a subscription system, there’s (theoretically at least) the possibility that customers would jump ship if they feel the developers aren’t pulling their weight.

Lucky for MacOS users we don’t have to use it like iOS users on the iOS app store.

For something like a password manager, the most compelling updates are security fixes, but there are several problems with charging for these:

- It's unreasonable to expect people to pay the full price for minor security fixes that still need to go out

- Because security upgrades are invisible to the user, it may be harder for the customer to see their value v. new features

- The timeline of when security updates need to go out is less predictable than that of feature upgrades, resulting in unpredictable revenue and expenditure for both the vendor and the customer and the customer may not have the budget to pay for an unexpected security fix

- Customers often want to take time to consider whether it is worth paying for upgrades, whereas security fixes should be applied as soon as possible

- The vendor must invest a lot of resources in testing the security of their software even when no security upgrades are warranted

> - It's unreasonable to expect people to pay the full price for minor security fixes that still need to go out

The ideal model for locally-run software, in my opinion, is to sell perpetual licenses to each major version for a one-time cost and promise security and maintenance updates for a certain period. New features can go into new major versions that users have to pay for (sometimes with discounted upgrade pricing), or, on a discretionary basis, as free updates.

This used to be the typical business model for locally-run software. Microsoft, for example, sold Windows versions for a one-time cost, promised security and some other level of updates until a certain year (and new features could be added on a discretionary basis), and provided upgrade pricing for new major versions that added new features. This kept control in users' hands, as their paid-for software could be used forever (at least until and unless external factors, like hardware incompatibilities, prevented it from working), though of course it would be very dumb to use, say, XP today on an Internet-connected machine. I am generally against subscription models for local software where there is no legitimate reliance on an outside service, and also against the trend of trying to create such a reliance for no legitimate reason ("We've added cloud sync and that's what the subscription is for. Servers cost money every month, which is why we're charging you every month." - except I can handle my own file storage and don't want your sync service).

Ugh, this trend of 'cloud sync' is highly annoying. Let me put an encrypted file on something that resembles a filesystem. If I want cloud sync, I'll put that file on Dropbox/OneDrive/GDrive/Whatever else.

It's only become a big thing after iOS and it's lack-of-a-filesystem and lack of inter-app data flows locked users out of their own devices.

Quite often I don't want many of the "new features". For me, bug fixes and security fixes are the main thing, followed by compatibility updates. I'm quite happy to pay for the latter when it was me that caused the issue by updating my OS/hardware in the first place. I'd quite like some amount of the former to be included in the original cost.

It's become a big thing because it's convenient. Every time I sign into 1Password on any of my devices, all of my passwords are there. I don't need an account with Google, Dropbox, or Microsoft for it to work and I don't need to do any manual setup. It "just works", which is exactly what the average person wants their software to do.

Manually dealing with files is a sign of poor software design for simple use cases, in my opinion. I quite like the iOS model that abstracts the idea of a filesystem away from the user because the user never cared about the file system anyways. They just had to deal with it to do whatever they really wanted to do.

To be honest, if a password manager needs to be regularly updated in order to remain safe, I'm not sure I trust it with my passwords.

> "To be honest, if a password manager needs to be regularly updated in order to remain safe, I'm not sure I trust it with my passwords."

Huh. For my part, I'd have trouble trusting a password manager (or browser, or OS) that claimed it _didn't_ need regular updates in order to remain secure.

Everything on your computer, including the OS itself needs to be regularly updated in order to remain safe...

It's not just security, it needs to be updated to continue to run on your devices. New versions of iOS, Android, Windows and Mac OS change things that need to be taken into account. The browser extensions must be kept up to date. There is a lot of work to do just to keep things running without adding any new features.

The point was requiring regular updates to stay safe, so yes, security updates. The attack surface of a password manager would be infinitesimally smaller than that of an OS.

As far as general updates go, I agree with you, but these shouldn't need to be that frequent. I still have software from the XP era running on my computer.

Of course it's all upside for the company and down for the customer. Which company wouldn't love predictable revenue from customers every month. It's an amazing business model for software businesses, especially when the customer completely forgets about it and just let's their card be charged every month.

Just gonna piggyback off this and say the family plan is an amazing value if you have aging parents.

I recently upgraded to one, set up each of my parents with accounts, and moved all of their passwords out the physical and digital notes that their passwords were strung across and into 1password.

This means no more iCloud password resets every time they need an app or call me for IT support. It means I can help them securely manage their financial accounts and photos as they get older. I can share with them my Netflix login. And I sleep better at night knowing they’ll be aware when one of their previously common recycled passwords is compromised.

The family plan is honestly the best feature hands down. I setup my partner and my mom in it. There was some resistance at first to learning a "new thing". But now they love that they only have to remember one secure password and all their other passwords are automatically generated for them. No more pet names as passwords!

I am a long time 1Password user, purchased Mac licenses, IOS and Android over the years.

I was annoyed when it changed to being subscription based, the price wasn't an issue I think for the value it gives the price is fair, 1Password is the only thing now keeping me on a Mac.

The issue i had with it is you don't own the software and when my credit card expired and i forgot to update it losing access to passwords even if temporarily until updating the card details left a bad taste and showed the downside of being subscription only.

It's been on my list to move away ever since. 12 months on I've still not done it, there's lot's of alternatives but 1Password have the UX and functionality just right however i know i should move as i now don't own my passwords.

I was annoyed when it changed to being subscription based, the price wasn't an issue I think for the value it gives the price is fair, 1Password is the only thing now keeping me on a Mac.

1Password X works on Firefox and Chrome on Linux.

>1Password is the only thing now keeping me on a Mac

I was in the same position. Switched to Keepass and have had no issues using it on Linux and iOS (the latter as KyPass)

there's not even a grace period to export your passwords? If not, wow that's a major downside!

Comment elsewhere in this thread points out they have a Linux CLI app now as well.

When accounts are frozen (which is what happens if you stop paying) 1Password enters a read-only state. You can’t use the browser extensions, make modifications, or add new data, but you’ll have read-only access to your data.

We do have a CLI that runs on Linux (as well as Mac and Windows).

Ben Woodruff

AgileBits

Thanks for clarifying.

Well this one tool is 'only' $60 per year[0]. But what if your compiler moved to subscription, and your text editor and your e-mail client and ...

It's the thousand-cuts problem. And once you start on that path you can't go back, or else the tool stops working.

[0] which is a substantial chunk of a day's after-tax pay for many people in the UK, for example. 1/400th of their salary for a password database.

My compiler (MSVC) is subscription. My go-to editor for other stuff (PyCharm and other JetBrains editors) is a subscription. My email client isn't, but my email hosting (FastMail), which has a web client, is.

It doesn't even register -- they are tools I need for my work and I'm happy to pay yearly for them. It's worth nothing that with the exception of email (which, being on my own domain, I can always move elsewhere), I still keep usable licenses if I stop subscribing, I am not locked-in.

> And once you start on that path you can't go back, or else the tool stops working.

How would you feel about a subscription service that guaranteed updates? Essentially, upgrade pricing, but charged every month.

Will my compiler or IDE stop working if I don't pay the subscription fee? You can guess how I'd feel about that.

No: you’re paying for updates, not the privilege of getting to use the software.

So, you have a perpetual license to use the latest version of the software that you paid for?

Perfect.

... But JetBrains attempted to explain why this doesn't work with the subscription model. And failed IMO, but regardless.

You're absolutely right. I use over 400 tools. I'd be completely broke if I had to subscribe to them all.

It sounds like you feel like you underpaid. Then the solution is for them to charge more or charge for more of their products, not a subscription. A subscription basically forces you into paying for upgrades.

The only thing a subscription model is good for is it wrestes power from the consumer.

With the traditional model if they decide to stop updating the app, you wouldn’t buy the next version, and that would be your leverage. With a subscription model, they can decide to stop deivering updates, or deliver lower quality updates, and you’d be forced to pay perpetually just to keep the existing software operational.

Here's a counterpoint:

If someone pays $40 for, say, 1Password 5, they have no incentive to upgrade. It works well enough, and there's no reason to pay again. So, 1Password is stuck supporting a legacy product (and servers / APIs for it), the user is frustrated by an old version of the software, and the company gets no money so they're at risk of folding (which would hurt both the customer and 1Password).

I agree that subscriptions can get annoying. However, if it ultimately is about the same price, it ends up working out much better for both sides. And hey, they can always stop their subscription and go somewhere else if things get bad. They don't lose their buying power completely.

If they have no incentive to upgrade, that's because the newer versions don't add any value for the user. This makes sense: 1Password is a pretty mature product at this point and there probably isn't much room to add new features, unless you want to expand the scope of the product.

That is to say that I personally (and again, this is just my opinion) don't care about any new features and would be unlikely to upgrade from version 6 on that basis. I may upgrade to ensure I will continue receiving security updates and OS and browser extension compatibility updates, but it would be nice to know how long such updates to version 7 are guaranteed for (presumably they will eventually release version 8 for a new fee and discontinue such updates to version 7).

> (and servers / APIs for it)

The users (like me) who are against subscriptions are only using local vaults (managing the storage sync ourselves) and do not care for or want the web/sync services.

> newer versions don't add any value for the user

I disagree. Security software (as opposed to boxed titles prior to the Internet era), subject to frequent review and that is updated regularly does offer continuing value in a steady stream of updates.

As another commenter said, the price of security is eternal vigilance.

They should not be supporting new features on old versions, and 1Password does not require servers or APIs. If you are paying for their cloud hosting then that is a justifiable subscription cost, but I’m already use Dropbox.

They should be supporting security updates and this should be built into their costs. Security updates represent flaws in their product.

If the user is frustrated by an old oversion and looks to upgrade (whether to a competitor or a new version), then that makes upgrading justified, transparent, and intentional.

Their subscription model just serves to make upgrading less intentional, less transparent, and takes away power from the consumer. Also at their current pricing it’s a massive increase in cost without really deliverying much more value. You’re paying more than what it normally costs in a year, to only be able to use it for a year. It’s like forcing me to pay for their product on an installment plan, but I don’t rven get to keep using it in the end.

Whatever benefits they claim a subscription provides can also be achieved by having more frequent, smaller, incremental updates for features you can pay for.

Yes. This.

But don't forget compatibility updates. Underlying platforms change all the time, it makes sense for users to have to pay for these updates outside a certain time period.

They're not stuck supporting it. The original purchase can come with an amount of support. If the user needs more, they can pay for more.

This is how software worked for multiple decades before subscriptions came about.

You can look at it from a different perspective.

The customer could pay $5 and then cancel the subscription if they do not like the service.

With the license purchase they have to make a large commitment upfront.

In the old days with perpetually-licensed software, this was handled with a trial period (30-day demo or similar), or, where feasible, a feature-limited demo version (e.g. a game with one level as a demo). This is not a new problem or a problem without solutions.

[To play devil's advocate:] which were often cracked and released as warez...

I'd be highly skeptical of running a warez version of my password manager.

That's good for customers who ultimately cancel. For those actually using the service it will be a worse deal.

Is it possible to pay for a subscription and use a local vault?

I've no problem with the business model, but I'd rather keep the data to myself.

Edit: Answered my own question

> 1Password 7 from the Mac App Store will only support our hosted service, as that’s what you’re purchasing with a 1Password membership. If you install from our website, you’ll have to option to use a standalone vault synced via iCloud if you purchase a standalone license, or use our hosted service if you purchase a 1Password membership.

Yes it is. The new release even brings local vault to Windows.

From what I'm reading now, it seems like it's read-only. Only to get things from a vault onto their servers.

I still don't understand how the revenue model (subscriptions) necessitates the technical solution (cloud storage).

> From what I'm reading now, it seems like it's read-only. Only to get things from a vault onto their servers.

With 1Password 6 for Windows that is the case, but not with 1Password 7.

> I still don't understand how the revenue model (subscriptions) necessitates the technical solution (cloud storage).

It doesn't. But that is the recommended solution. You _can_ subscribe and use a standalone vault. But you're missing out on functionality that you're paying for that way.

Ben Woodruff

AgileBits

Thank you Ben. Yes, I get that. There's a subset (maybe 10-20%) of data that I can't (in some cases because of legislation)/don't want to put in the cloud, while the majority would be just fine. So, yes, I'd have to accept the compromise.

Thank you again, I have now acquired a subscription and version 7 looks very nice indeed.

> Is it possible to pay for a subscription and use a local vault?

Yes, with 1Password 7 this is possible. It isn’t the recommended situation, and we don’t advertise it, but it is possible.

Ben Woodruff

AgileBits

I've been happy with 1password as well, other than two times my vault would not unlock until I restarted my computer.

Making it seem like you lost access to all your passwords seems just below security issues as far as high priority bugs, in my opinion..

https://discussions.agilebits.com/discussion/82915/why-cant-...

I have two free password managers. Both iOS. One open source, and one just free. https://github.com/UCFirefly/Pythonista Or https://itunes.apple.com/us/app/dyfynderx/id1345759526?mt=8

This story is similar to mine. I really don't want to have lots of subscriptions, but I use 1Password sooo much, it is a clear winner for my money.

not just that there’s a cost to keeping this kind of software useful, for the subscription agilebits is actually adding value.

unlike say adobe.

I had purchased a bundle for Win/OSX/Android a while ago, several years, bu somewhere around 2ish years ago, I jumped into the subscription model to support it going forward. Worth every penny to me.

Reply on news.ycombinator.com