Hacker News Reader

Comment by archagon | Hacker News Reader

As time goes on, I've gotten less and less comfortable using proprietary software for critical tasks. If 1Password were open source, I'd actually be pretty happy to subscribe. But as it stands, I have no faith that the product won't change out from under me in the future, whether due to a pivot, an acquisition, or some other reason. The incentives align in favor of the business, not the customer. IMHO, subscriptions are already pointing in that direction.

I'd rather use something like pass and deal with the downsides. (Though I admittedly haven't switched yet.)

View on HN

For me, something related: can I remove the data in a usable form? 1Password makes that easy, so like others here, I'm happy to pay them to perform the 'eternal vigilance' that secret-keeping entails.

We also allow export in something called 1PIF. It's a JSON format export of your data. It doesn't currently handle everything super smoothly, notably Documents which are new.

We'll have another solution in the not too distant future that should cover things and be a documented format that anyone with the know how could use.

Also important to note, that if your account ever lapses due to lack of payment. The account is still read-only. You can export your data if you wish even when the account is read-only. We do not lock you out of your data, we just prevent normal use of the application (browser extension, editing items, adding new items, etc). But the data you've already entered is entirely accessible if you want to copy/paste or export.

Kyle

AgileBits

Password Store (AKA 'pass') stores each password as a GPG-encrypted text file, so with gpg, $EDITOR, and cp/mv you have full control over your password data at all times without pass even having to get involved.

It’s nice to see a team of marketers working so hard to convince the masses. Kudos.

Yes, you can export it as a CSV file. They even warn you that it’s not secure.

> They even warn you that it’s not secure.

I don't think anyone who uses a password manager is exporting to CSV for security purposes.

I was trying to illustrate that not only can you extract data in an open format, they also are responsible enough to warn end users that the data is no longer encrypted. This isn’t for the benefit of your typical HN reader.

For now...

Removing the ability to get your own passwords out of your password management utility that you paid for would be corporate suicide.

Crippling it, not so much.

I moved away from 1password at the time of the subscription palaver. I managed to move everything to Keepass but each entry has it's own folder.

I don't blame 1Password for the state of my Keepass db (although they pretty much forced my hand) but the closed nature of 1Password does bite you in the arse when you decide to leave.

I switched from 1Password to LastPass last year and it was a smooth transition. If they’d had a Linux version I’d still be a customer right now.

They now have a chrome extension that supports Linux[1] and a command line app.[2]

[1] https://support.1password.com/getting-started-1password-x/

[2] https://support.1password.com/command-line-getting-started/

We evaluated Lastpass about a year ago and the UI was borderline unusable. Doesn't matter so much for technical teams, but it does in broader use cases.

What did you settle on? It’s basically just a browser extension.

I keep meaning to write some Applescript and/or browser glue for pass(1). Uses GPG, checks into Git, and even has an iOS app.

"Corporate suicide"? 99% of the users wont even notice the feature existed...

They will if you go out of business or decide to spin off the product.

"Corporate suicide" implies that it would be a problem for the company.

Users noticing it after the company is already "going out of business" does not qualify as such.

Yes, you're right, an already-dead company can't die a second time in this highly-hypothethical scenario. They're still dead.

For ever.

At some point you have to value people. The 1Password folks have never let me down, and have been very honest, so I trust them. The product has done nothing but improve over the years for me, increasing in value and ease of use. And then with how often LastPass has had security breaches, it was a no brainer for me to leave LastPass years ago, and I don't regret it.

Shifty Jelly has never let me down either, but they got acquired by NPR. Neither has Q Branch, but they ran out of money and had to shut down. Business for indies isn't predictable. Is AgileBits going to be around in 10 years? I hope so, but I think it's far more likely that they'll be swallowed up by some other company, at best. After getting burned by this over and over again, I just think it's more sensible to stick to OSS options that will probably exist in some compilable state even in the distant future.

> Shifty Jelly has never let me down either, but they got acquired by NPR.

Of all the entities they could be acquired by, I think NPR is the least offensive of all. And they've stated the intent is not to change how PocketCasts works. The other partners are WNYC, WBEZ, and PRX (helmed by Ira Glass). These are all major publishers of podcasts who have a vested interest in keeping PocketCasts a good app, and growing it. I think this is a bad example.

> Neither has Q Branch, but they ran out of money and had to shut down.

They would still be around if they had subscription revenue. Guess who has subscription revenue?

> Is AgileBits going to be around in 10 years?

They started 12 years ago. If you asked 12 years ago if they would still be around in 10 years, the answer would be yes.

> After getting burned by this over and over again, I just think it's more sensible to stick to OSS options that will probably exist in some compilable state even in the distant future.

Well, don't go LastPass if you want OSS.

There are open source 3d party applications on Linux that I've used to access 1Password password archives. The code is closed source but everything they're using to encrypt the passwords are open standards. You can build your own 3rd party open source platform to access them.

Do you have any suggestions for such software? I've been looking into this as I migrate to Linux and have yet to find something that does read and write for stuff stored in my Vault. I'd honestly be willing to pay for software that provided this.

The official solution is to subscribe to their subscription service (any tier works) and use 1Password X in-browser: https://support.1password.com/getting-started-1password-x/

Not sure about other solutions, open or closed; I moved over to their subscription service a few months ago and haven't looked back.

I work for AgileBits, makers of 1Password

We don't prevent people from writing 3rd party tools, but I would also be very wary of using them. Our stance is outlined here:

https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do...

> We have to advise you to never enter your 1Password Master Password into anything that isn’t 1Password. We aren’t casting aspersions on the integrity or competence of any developers, but we simply can’t advise otherwise.

So as long as you're mindful of this advice from us, go forth and conquer.

Kyle

AgileBits

So if the app were open source and the maintainers decided to abandon it, are you going to download the code and keep it updated? If it is forked are you going to trust the new maintainers? Are you going to audit the source code?

This is the big fallacy I see whenever someone uses open source just because the source code is public. Unless you're able to perform a full audit yourself, is it really any better than a closed offering like 1Password?

I suppose the theory is that open source is better (a) because you can audit it if you want to, and (b) it's more likely that someone out there has audited it.

In practice, (a) falls apart if the user doesn't have the knowledge, experience, or time necessary to perform an audit, which is quite likely for security software. And I feel like (b) isn't great either, as there are plenty of examples of major flaws in open source projects that went undetected for long periods - heartbleed is just one example.

I agree with that assessment, but how many vulnerabilities have been found in closed sourced software? If the software is popular enough, someone somewhere is going to find a vulnerability whether it's open or closed source. Look at all of vulnerabilities that Google has found in closed sourced software. It just takes more skill to find vulnerabilities and incentives. The black hats have found vulnerabilities in iOS that Apple still hasn't managed to patch - like the one that lets law enforcement break into a locked iPhone and bypass the fail login attempts.

I think the question is is the likelihood of the party finding the vulnerability being a “good guy” or a “bad guy” different between closed and open source. I’d suspect not, but who knows.

Stuxnet didn’t rely on open source software.

There are major unrevealed flaws in all software more complicated than “hello, world.”

Agree, open source is rights for the users, no matter they have the ability to audit or not.

If it was a matter of OS compatibility, I'd certainly be able to do it for iOS or macOS. Security, less so, but with luck there would be others to do that work, if the app had enough users. Surely it would be better than just implicitly trusting some company with a profit motive?

I'm not expecting anyone to do the work for free, by the way. You could still charge money for cloud sync or even app extensions and still keep the main repo open. Maybe the code could be a few revisions behind to incentivize people to pay.

In any case, from looking around, it seems that KeePass and possibly Bitwarden fit this bill.

Bitwarden has been great for me. After going from LastPass to 1Pass to KeePassXC to Bitwarden, I really appreciate the simplicity of a simple browser extension without the requirement for a local client.

Bitwarden just works and checks the boxes for me. I haven't tried it yet, but there is also a fork [1] that allows us to use our own hosting.

[1] https://github.com/jakeswenson/BitBetter

Of course, the answer to all your questions is "not necessarily". Sure, it's totally possible for people to not audit the code, or let it be abandoned–but open source makes this probability much lower, whereas with closed-source software you have no choice in the matter at all.

I think you’re making a lot of assumptions when assuming the probability is much lower. I’d trust a really proficient small team being paid to produce secure, closed software more than a team of disinterested volunteers. I’d also trust a small group of passionate volunteers over a paid team of crappy engineers. I guess the point is that source being open or not isn’t really the important part, at least in my opinion.

I agree. I try and use solutions that have open source formats, and are preferably open source.

I have made an exception for 1Password, as it is so good. I hate subscription for software, unless there is a clear benefit. In this case, I don't see the benefit.

While our code is not, our vault formats are open. :)

Ben Woodruff AgileBits

I didn't know that. That adds to the esteem in which I hold 1Password and AgileBits. I think an open source format is almost as important as open source software.

Especially security related software companies, they have a tendency of degenerating into user-hostile malware businesses.

Comodo, Tripwire, Symantec, McAfee... on and on.

https://github.com/OblivionCloudControl/opvault

opvault file access has open source tools. It would suck if they changed out from under me in the future (1password is the best password manager and it’s really not even close) but my passwords are at least accessible.

Bitwarden is the answer for your concerns. I've moved to it and never looked back.

https://bitwarden.com

Interesting suggestion, thanks! Can you comment on how good the mobile apps work?

I agree, especially around subscriptions. Too many light burnings already.

I use and love 1Password, but there's no way I'm switching to the subscription model. When my version stops working (either through incompatibility or serious security flaw), I'll begrudgingly find something else to use.

KeePass works for me, and it's available on all the platforms I use.

Reply on news.ycombinator.com