Don't use 1Password (2017) | Hacker News Reader

Don't use 1Password (2017)

blog.goodstuff.im

33 pointskaptain17 comments

One bad support rep interaction doesn't sink the security model of the company.

If they were lying in their documentation, or the software itself, that would be a different story.

Agreed. This just reads like a bad rant.

Yeah I couldn’t finish it. Was there anything of substance other than he got bad info from a rep on Twitter?

The blog author additonally emailed support with a lengthy overview of the changes and reponse from the rep and received the reply that v6 of their product has always been a cloud subscription only offering, which according to the author's experience was not the case.

The primary contention of the blog post and the tl;dr is v6 of the product allowed for a 'local' vault until a particular build and AgileBits isn't being open about this change, which the author feels is some slippery slope to other, hypothetical compromises.

True. But HN does invite this kind of thing..

I didn't finish it either.

AgileBits are trying to change their business/revenue model and that transition is not suiting this user. Shame for AgileBits but you can't please everybody.

One thing I noticed is that he's not happy to have his encrypted password file in the AgileBits cloud. This is the way LastPass works too. I get some folks don't prefer this but I don't see it as a major risk. If you're using any reputable password manager (a set that includes 1Password IMO) then you're 100x safer than the mainstream even using the vendors cloud hosting.

> as of LAST NIGHT, there was a mention on 1password.com of using DropBox and other mechanisms for syncing vaults

Below is exactly what the cited page said on February 1st – as far as I can tell, this post offers absolutely no support for this claim.

> Dropbox requires:

> 1Password 4 on Windows [1]

[1] https://web.archive.org/web/20180201210656/https://support.1...

My biggest reason for not using 1Password, Lastpass, etc, is that they are all walled gardens. If any go under, you lose the service and everything locked away in it. Since they're based on proprietary shit, it is lost for good.

That's way bigger (and simpler to understand), to me, than the corporate drama that the author drums up to justify ditching it.

I use BitWarden with monthly (manual) backups that I encrypt and store on my NAS

I’ve stopped myself from getting the 1Password subscription for exactly this reason. I’m still comfortable using the standalone version as I have control of my keychain.

I love using LastPass, and it's very easy to export all of your passwords and notes as CSV. If they go under, it would be easy to migrate to a different service. A quick Google search brings up many API clients for KeePass, so it should be simple to read the CSV and import all my passwords into KeePass.

I used to use KeePass, but I think LastPass is much nicer and more convenient. I also like using the LastPass Authenticator app for 2FA.

This guy's priorities are backward. He blows a gasket over 1Password not being 100% clear about their feature set (and somehow this offense is great enough to warrant dropping the product entirely), but seems unconcerned that he's entrusting his passwords to closed-source software. Why would any security-conscious person give 1Password a second thought when there are open-source alternatives?

This argument is just degrees of risk. He's much safer using any password manager than not one at all.

> Why would any security-conscious person give 1Password a second thought when there are open-source alternatives?

I trust the security team behind 1Password more than a community of volunteers around open source password managers.

Fully agreed. When it comes to security, most people don’t know half as much as they think they do.

I completely get the business model.

What I don't understand is why they are coupling the business model to enforced storage in the cloud. Could someone explain why the one necessitates the other, from their point of view?

I saddened that they're going to force me to stop using 1Password after all this time. I really like the software, but I don't like handing over a lifetime of secrets to a third party—any third party.

(2017)

I appreciated the article, but I was expecting in the end a suggestion for an open source alternative. Finding it and proving that it is better than 1Password is the hard part.

Reply on news.ycombinator.com