1Password: Standalone / Local Vault Option Gone?
discussions.agilebits.com
discussions.agilebits.com
The OP just wanted to know if the feature was gone, and if so when did it get removed (maybe to find an archived version of the app?), and lastly why it wasn't clearly communicated, but you can just smell the smug in the responses. It's hard for me to read their little "cute" emoji as anything but sarcastic, which is reinforced by one of the developers chiming in about how they must be asking to "make their mobile apps free" and the other guy talking about how with so many users anything they do will of course be found out.
What if I have an issue in the future? Will I also be treated poorly?
I chose to migrate to storing everything in iCloud Keychain instead. I understand why companies want to move to the subscription model, but I can't justify spending $36/year for an app to store my passwords.
I'm trying Bitwarden now and it seems to be ok. Maybe it's time for a change.
Bitwarden's clients are FOSS. There's a 3rd party FOSS server for it available written in Ruby. So you could even self-host.
[EDIT: there's one written in Rust as well! [1] [2]]
The free tier supports 2 users sharing.
If I ever need to sign into something on a non-Apple OS, I look up the desired iCloud KeyChain-stored password on my iPhone, then manually retype it on the other device.
I feel that gives me extra security.
Actually, manually typing or pasting your password (assuming you aren’t using WebAuthN) opens you up to phishing attacks because you could be fooled by the URL, whereas password managers and hardware tokens will activate only for the associated domain.
With Apple there's only one party involved.
I did the same when 1Password moved in this direction after version 6. It was clear then that the stand alone version was going away.
My workflow involves sharing certain accounts with family members and 1Password supports that. For now, that's the killer feature for me.
We use GSuite, but that isn’t really relevant other than for controlling default ACLs to the document; you can just make a private Sheet and then share it by email to whoever you like.
Google Sheets works okay (for this use-case) pretty much everywhere you need it, including on mobile. Doesn’t auto-fill anything, of course, but since the point is sharing the password, not restricting the ACLs of the password in any enterprise sense (i.e. so people that could use a password before can then lose access to it), it’s fine to allow people to just cache the password into iCloud Keychain and/or Chrome Sync. So it’s not as much of a speed bump as you’d think.
I can punt on the cloud problems, but I'll pay for the convenience of a password manager in this case.
what?
it’s not just storing your passwords. you could use a spreadsheet or plain text file for that.
$36/yr is NOTHING. this is great value for money.
> one of the developers chiming in about how they must be asking to "make their mobile apps free"
That isn't the actual quote. The developer is pointing out that the apps are "free to use as companions to our desktop apps".
> the other guy talking about how with so many users anything they do will of course be found out
This did come across clumsily, but it was in response to the false dilemma "Was it forgotten, or deliberately not mentioned in the hopes nobody [would notice]?"
I'll be much more open to alternatives now than I would have been yesterday.
The UI in general also just feels clunky. It's missing that polish the mac app has.
In many ways, I feel that the Windows and Android clients in particular are still second class citizens compared to their Mac/IOS counterparts.
Simple tasks like resetting a password or adding an entry in 1Pass can often be frustrating now.
Previously, with every restart of the phone, you needed to enter master. After, only when the pin is misentered once. They added this ‘new feature’ right when I was installing everything on a new personal laptop. As I recall it, I was entering the master password on my phone, over and over. One of the characters had a shift, which was a pain in the . On iPhone. So I made it lower case. Then, I updated my phone, got the 1password update, and didn’t enter the master for over a month.
Finally, I misentered the pin, and got kicked to the master. Well, you can guess what happened. I was locked out.
You know, a password works because you remember it. My situation revealed the design flaw of bypassing that. If you don’t enter the master for a long time, you lose the habit and increase the risk of losing it.
For me this is the classic example of the corrosive drive to renew a perfectly good product, which ruins the product for some users. But as a designer, I think it’s a fail, but you can’t tell them that.
The pin thing is a big time saver because typing on mobile still sucks, and I'd have to re-type the master everytime I switch between an app and 1Pass. I certainly wouldn't qualify it as a bad feature.
It's a complex system. I had a use-pattern that naturally emerged from the UI (which required the master after reboot), and my habit of turning off my phone every night. So this "feature enhancement" seemed innocuous, but had, I would argue, the unintended consequence that I lost my memory of the master because of a new feature.
I believe this is exactly the sort of thing a smart company, making a security product, should think about before they decide to add a "feature enhancement".
I mistook the great design of the original 1Password product as an indication of a "smart company" who made great decisions, and great products through testing and design.
Now I feel differently. Now I just see another one-hit wonder, who makes improvements by the wiz-bang theory. New! New! New and improved!
The unpopular decisions to drop the standalone version (local vault) is just more evidence to me that AgileBits isn't special. I put them on a pedestal with devotion and evangelism, but they're no different, and maybe worse.
And if you like this rant, you might also like my rant on TransitApp. hahah!
[1]: Before with 1Password I would have to enter the master once every 1-2 weeks. Now with Bitwarden using the same 1-fail bin to master UI, I think I've not defaulted into master for, I dunno, 6-8 months? But I've learned my lesson. I wrote the master on a piece of paper and tucked it away in a book somewhere on my bookshelf. What could go wrong?
I feel like it may be an inexorable and unavoidable consequence of an aging codebase.
Keepass comunity solutions are strong and open source. And free.
Will keep this in mind when recommending to family and friends, which I do a lot, and will definitely keep an eye out for alternatives moving forward.
The latest extension for Chrome on Windows and Mac barely works for me half the time with the latest update.
When you have sync issues, the workaround in the absence of a Force Sync button (which used to exist) is to create a dummy secure note or to log out and log in again.
Most users won't know this workaround without spending several minutes Googling and digging through search results.
I complained about the lack of a Force Sync button on the clients in the forums, and was told this:
"The reason we don't want too easy an option to force a sync is precisely because folks will choose to use that rather than reaching out to find the root cause"
Needless to say, I wasn't pleased to find out that they wanted to use their paying customers as free testers.
I'd like to switch away, but most of the alternatives I've looked at don't compare very favorably from a UI/UX perspective.
That all being said, I absolutely agree the emojis almost always are perceived in a way that’s opposite of the intent, e.g. smug, sarcastic, or some other negative tone.
It's difficult to explain, but every time something like this comes up their responses frequently seem "off" and tone deaf.
I'm not sure they understand how much their product can become a part of how people go about their daily life, and how changing that, no matter how small, can have pretty significant effects, with an accompanying emotional response.
A while back they changed the way their vaults worked and you had to upgrade them. I've never been more nervous about an update to anything than I was with that update. The way the software communicated what was going to happen really didn't help, and there was a real feeling that this could all go horribly wrong.
Something I respect from Basecamp is their commitment to keeping their old products around (and keeping them maintained, even if they get no new features). They understand that they become a part of people's lives, and you mess that up at your peril. "Sunsetting" products or features has an impact on your customers that you need to be prepared for.
For reasons that are difficult to articulate I just don't trust AgileBits to not completely bugger up things for me in some way by changing something that they regard as unimportant, but to me is significant.
Even to me, this feels like I'm probably overreacting, but my passwords and online identities are so important that even the smallest hint of untrustworthyness is unnerving. The impact of losing all those details would be massive.
For me, 1Password wifi syncing (with local vaults) never worked quite right, and I don't think that feature has been touched by its developers in all the years since I first bought a 1Password license. It's never going to be. They're all in on their own cloud service and subscriptions.
I don't hate 1Password for using subscriptions -- that's their prerogative -- but I wish I'd known they were going to bail on the Mac-as-digital-hub architecture. That was 100% why I bought it.
I'd describe that pivot, too, as a communications breakdown.
While this might be true in general, one of the main advantages in choosing FOSS is that features used by a small subset of users are more likely to be kept than for proprietary software.
When a software package starts out, early-adopting power users build its popularity and help shape its growth ... until the package becomes so useful that it is now marketable to the masses. Then, for proprietary software at least, there's a strong incentive to streamline and remove anything the masses don't care about...which can alienate the same people who helped make their package great.
For FOSS, there's powerful motiviation to retain features that even only a handful of power users rely on -- lest that project be forked.
I can't remember the last time I've been feature-burned by a FOSS project. My feature-burn scars for proprietary software, however, are many -- and at least a few are quite deep.
The GNOME project comes to mind as free software which regularly feature-burns their users, arguing that people who really needed the feature can monkey-patch their DE's javascript to add it back in.
You're right though, most FOSS seems way less likely to remove features people actually depend on that most proprietary software.
If there is an obscure setting somewhere which makes something work well for you while you become a minority of users in the process, you would not use it?
>I never want to be outside of the primary use case.
You've extrapolated too far from their statement. Most people have probably been in this kind of situation and most of us have probably been burned by it at some point: Use a product for an edge case of its intended function and you risk losing that functionality at some point.
Vendors will generally cater for the masses. Where possible, avoid building your usage model around niche features. Assume that free products/features are a loss leader and will disappear at some point. Have a contingency plan if the at-risk feature is particularly important to you.
Depending on what you mean by "in some future update" and "pretty much guaranteed" (given an infinite timespan everything will disappear) I don't think that's true. I've kept my Firefox user.js (my manual about:config changes) under git over the past 3 years[0], and of the 44 options that I customised, 36 are still present and (seem[1] to be) active.
6 of the about:config user_prefs customised add-ons, so they no longer work due to the shift to Webextensions (but I can still make 5 of the customisations via another interface).
1 customised the GCLI, which was removed, and 1 customised Panorama, which was also removed. (However, most of what GCLI did, can be done some other way, and there are a couple of Webextensions faithfully emulating Panorama.)
[0] The file is older, but I added it to git only three years ago. Hence, many of the about:config changes have been "alive" for longer, but I have no record of those that were removed earlier than 3 years ago.
[1] Cursorily glancing through my comments above each entry to make sure that it still does what it was supposed to.
Developers should stick to implementing features they're likely to maintain.
1Password can be both worth paying $3 a month for an also making a really bad anti-user decision here. These are not mutually exclusive.
As a former long-time 1Password user, I recently moved to using pass [1] after using their cloud features for some time. At the time I mostly moved for better change tracking with git, but I'm feeling pretty glad about the decision now that they've made this awful change. I'd highly recommend moving to pass or some other FOSS for this class of tool. Why trust your passwords to something outside your control?
except that that’s the most important part! without that, a text file is sufficient.
luckily there are 3p browser integrations for keypass. i’ve not used them but i assume they are reasonable considering the importance as well as the nature of the community that would write such things.
The only "issue" I've had is formatting my phone, but forgetting to first back up the GPG key I used. The solution is just to create a new key and (from my desktop) reencrypt all the passes. It's not hard, but it does take about 10 minutes.
- lied about the reasoning by claiming apple mandated the change despite apple's change only affecting safari which I'm guessing makes up the minority of their browser userbase
- consistently deleted comments on their forums that pointed out they could have kept their already existing, working code in place for chrome
I rolled back to version 6 and suggest anyone else do the same.
I had paid well over $150 by buying all their apps and they were forcing me to throw that investment down the drain because they didn’t want to spend a couple of cents a year on hosting my vault themselves.
There was a long discussion in the forum. I moved to LastPass. The UI is not as good but it does the job and it’s free now.
The fact that you bought their product in the past does not entitle you to demand that they build and maintain a free web hosting service. If that's your attitude, then I'm sure they're happy that you're no longer their customer.
I mean the apps seemed overpriced in the first place, and due to their decision to change their business model they decided not to provide ongoing support in a way that one might have expected they would based on what the product seemed to be and how their business seemed to operate when you purchased the product. They don't technically or legally owe you anything but nonetheless I would not want to buy anything from them after that.
The idea that they should be happy to lose a happy paying customer is absurd, is that how to build a successful business?
No, it isn't. I'm not sure what brought out the agilebits apologists but they ABSOLUTELY said you were entitled to updates with your license purchase.
AgileBits is not culpable for Dropbox removing a feature.
I genuinely do not understand how Dropbox removing a feature gets people mad at AgileBits instead of mad at Dropbox. Why does Dropbox get a pass for this?
AgileBits advertised the online web vault as a feature of 1Password when I bought the software. This can be demonstrated by looking at previous versions of their website on the internet time machine. They were in obligation to provide a solution for that.
The fact that they could have spent cents per paying customer to fix this and they didn't, or that they didn't even offer some form of transition from paying customers to the subscription service is just the cherry on the cake.
That's patently false. The paid version of 1Password came with "Free updates" as listed on their site. Updates were bundled into the life of the product - if *they weren't, nobody would've ever bought it at the prices they were charging.
>Historically, AgileBits has been very generous with upgrades. Your purchase entitles you to free updates until the next major version upgrade. That means if you buy a license for version 2 of a product, you will get all 2.x releases for free, but upgrading to version 3 might require another purchase.
https://web.archive.org/web/20160304084145/https://agilebits...
The 1Password chrome extension (not 1Password X) used to work great, then it started crashing about daily for me after one of the updates, forcing me to quit Chrome to fix it. The final straw was when they "updated" the extension to a design that looks 2 years old and is far less functional.
I finally gave in and tried out the subscription model. Here's why it's worse:
- The 1Password X extension is standalone (doesn't need the desktop app) so when you have three different Chrome profiles as I do, you have to sign in to 1Password 3 times. Super annoying.
- They force me to store my data with them. Sure they're the most trusted in the industry and do their security audits, but if they get breached, I'm fucked.
- The Command + \ shortcut to autofill and login doesn't work on 1Password X
- They could have just said that their current business model wasn't achieving the goals and that they needed to charge more (I would have paid more/for a subscription) but instead, they beat around the bush by creating a new product that is inferior.
This part is not true -- your data is encrypted with a randomly generated key that is kept locally. You could freely post the data they have all over the internet and it would be fine.
Well you can set an application firewall to block all internet access of the 1Password app. So, it can't update automatically, and when you manually update it and it would contain malicious code, it still can't connect/upload anything to the internet. You can even use 1Password sync via iCloud, which is handled externally - not by 1Password, but by macOS.
Unfortunately, this can not be done on an iOS device (no app firewall), since Apple locks down everything and decided users may not control their own devices anymore :'(
You can only block hostnames/ip-addresses, and these often change with updates, so you'd have to constantly monitor and block new hosts after the app starts leaking again.
I've always used the Dropbox approach + backups. If Dropbox has an outage the file is still synced locally. If Dropbox deletes the file via a sync operation I still have my backups. If I delete the files Dropbox has an undelete option.
All I want is control over the files.
I'm one of the many people who are both dropping 1P and advising friends and family to do the same as a result of this episode.
Local data should be backed up as always, don’t rely on a cloud service to sync.
Personally I use two hard drives on my machine with time machine and regularly rotate them to ensure I have a recent backup and a less recent, network disconnected backup in case something like this should happen.
Do we know this is true? I assume it is, but I haven't checked the source or verified that I can encrypt/decrypt my data with my key, or that there isn't a master key that 1password has that can access it.
Edit: also there seems to be a lot of this:
> We’re sorry. This section of this document is not yet ready. Any- thing you see in this section is at most an outline of things to come.
> Edit: also there seems to be a lot of this:
Some, yes. I'm not sure I'd say 'a lot', but yes, it is a work in progress. Our security team should be able to elaborate on any points that we have yet to detail, though, if you're interested.
I used to use iCloud, and recommended it to anyone. Sign ons have become more, and more... complicated. There is 2FA, and others now, that 1Password also covers. How are you handing those with iCloud?
For what it's worth, you can manually create a "Secure Note" in Keychain Access and put whatever you want in there.
It doesn't do any of the other stuff you mentioned though, just thought it was a nifty mostly-unknown feature.
- They force me to store my data with them. Sure they're the most trusted in the industry and do their security audits, but if they get breached, I'm fucked.
- The Command + \ shortcut to autofill and login doesn't work on 1Password X
- They could have just said that their current business model wasn't achieving the goals and that they needed to charge more (I would have paid more/for a subscription) but instead, they beat around the bush by creating a new product that is inferior.
To address the concerns about 1Password X...
- We have desktop integration in beta which can help with point #1: https://discussions.agilebits.com/discussion/101231/introduc...
- Our security model has never relied on the sync service that you choose: https://support.1password.com/1password-security/
- Last time I looked into the Cmd+\ issue the primary difficulty was that not all browsers (Chrome, notably) supported \ as a keyboard shortcut for extensions. The reason we are able to get around this with the "traditional" extension is that 1Password for Mac is actually what listens for the shortcut, not the extension. The same functionality is still possible with 1Password X, just not with that specific shortcut.
- 1Password for Mac can be used with the subscription offering. It isn't necessary to use 1Password X. 1Password X is a great alternative for those who cannot install desktop software, particularly those on ChromeOS or Linux.
I'm sorry to hear you're no longer using or recommending 1Password but I hope that helps address some of your questions/concerns.
I'd like to see AgileBits continue supporting the old 1P extension (i.e. fix the crashing problem) or bring that functionality (Desktop link, only sign in once across multiple Chrome profiles, etc) into the 1PX extension.
So I don't know more about password management than Agilebits. They have a long history of really good ideas for their software. If they want me to use their cloud instead of local vault, that's probably a good idea. I'm more than happy to pay the $2-3 per month to have access to this, and knowing they have recurring revenue gives me confidence that they'll be around for a while.
1Password does have a good UX, but it's not the only option that does.
It works great although the app looks for app names instead of URLs sometimes so you'll have to hit the search button. Takes two seconds longer but it's no sweat.
You can use any file sharing service you want.
That said, a browser-based 1Password is really not what I want. I just really don't try web technologies for keeping my passwords safe. If I really was going to use it, this might be the only instance in which I'd actually prefer an Electron version to using it my main browser, just for the additional isolation.
I used 1PW with Dropbox for years and and years and it was a great solution — but I trust 1PW more than Dropbox to protect my stuff (and certainly more than I trust myself to setup and maintain a secure sync server), and I love 1PX. Also, the Windows app is lightyears ahead of where it was (the Windows Hello support is great), which I never thought I’d say.
Yes, I know other solutions are cheaper, but I have been a 1PW user for 12 years and I want to ensure it’ll be there for 12 more.
Plus, for me, the UX matters. I don’t just use 1PW for passwords, I keep software license, secure notes, all kinds of stuff in it. I’m not a fan of the subscriptionfication of course of everything, but this is one product I’ll make an exception for.
1. That's not true in the browser extension for chrome at least, where it is possible to type in numbers in the password length field.
2. Some people would consider the fact that it doesn't leak last information about use by retaining context as a feature.
Same for Firefox extension. Best feature is that nowadays Bitwarden has support for password sentences.
On the desktop, I have nothing against Electron in theory — but I prefer native apps for something like passwords, if only because of speed — I have a few thousand items in my vaults and BW was slow and 1PW is not.
Browser integration for auto fill isn’t as smooth, at least on macOS and I miss having a dedicated area for my software licenses/loyalty cards (like airlines). I haven’t used it in a while so I’d need to try it again to give it a fair assessment, but the subjective answer is “it doesn’t ‘feel’ as good.”
And unrelated to UX, I’m sure the main person behind BitWarden is a great guy, but in 2019, I’m not trusting my password manager to what is largely a one person team. When I started using 1PW in 2007, I know it was a small team. But 12 years later, I’ve been burned too often when small shops close/sell/burn-out and a password manager is too important for me to switch from something I know/trust to something that reminds me of where 1PW was a decade ago. Open source doesn’t mean open development or an active developer community. I also wasn’t impressed with the response to the critique of the cryptographic design in the security audit BW did last year. Not rotating encryption keys when you change your master password is a red flag and the problems BW faces on its own cloud are understandable, but not something I want to trust/deal with.
I’d gladly recommend BW over LastPass, but I prefer 1PW and have no intention of switching.
This is not to imply that your preference for a larger team is invalid, but I don’t think Bitwarden and its clones are going away anytime soon.
I personally only use the browser extension. I never understood why a desktop app would be necessary since I have the browser window open at all times. If there was a native app I don't think I would use it.
> Browser integration for auto fill isn’t as smooth, at least on macOS and I miss having a dedicated area for my software licenses/loyalty cards (like airlines). I haven’t used it in a while so I’d need to try it again to give it a fair assessment, but the subjective answer is “it doesn’t ‘feel’ as good.”
I haven't had any problems with autofill personally. In the browser it's pretty decent. It also offers saving/updating passwords automatically when your vault is unlocked. ⌘⇧Y and ⌘⇧L shortcuts made my life easier when I discovered them. On iOS you can use the autofill if the app implements password fields properly (most apps don't). There is an option to choose Bitwarden instead of the default keychain application.
For license and memberships I simply create a folder named "Licenses" and add secure notes, create a folder named "Memberships" and add cards etc. Both entry types support key value fields inside them so you can add additional info too if it's necessary.
> And unrelated to UX, I’m sure the main person behind BitWarden is a great guy, but in 2019, I’m not trusting my password manager to what is largely a one person team. When I started using 1PW in 2007, I know it was a small team. But 12 years later, I’ve been burned too often when small shops close/sell/burn-out and a password manager is too important for me to switch from something I know/trust to something that reminds me of where 1PW was a decade ago. Open source doesn’t mean open development or an active developer community.
If 1Password isn't profitable one day it would shut down and you would be forced to switch. If Bitwarden's core developer disappeared anyone can fork it and continue development. If operations seize you can spin up your own Bitwarden server and continue from there without having to switch client apps right away. I also think there would be economic incentive to run an alternative service if Bitwarden stops functioning for some reason (+1 code quality, +1 permissive licensing).
> I also wasn’t impressed with the response to the critique of the cryptographic design in the security audit BW did last year. Not rotating encryption keys when you change your master password is a red flag and the problems BW faces on its own cloud are understandable, but not something I want to trust/deal with.
I followed Bitwarden security assessment closely. https://cdn.bitwarden.net/misc/Bitwarden%20Security%20Assess...
I agree the key rotation problem was a serious one (which is fixed now). Apart from that, I've read the assessment in detail and couldn't identify any case that would cause a problem for me as a personal account user. I use the browser extension on a Chromium based fork (auto-locked after ~5m) and the iOS app (w/ PIN). I also have 2FA enabled.
- BWN-01-001: You're safe unless you deliberately want to self-XSS yourself
- BWN-01-006: Minor issue, schemes:// are white-listed now.
- BWN-01-008: I don't use organization account so it doesn't effect me.
- BWN-01-010: Fixed, you can rotate keys now. I hadn't changed a compromised password before so it wouldn't affect me.
- BWN-01-009: You're safe unless you go to settings and decrease the KDF iteration count (why would anyone do that?). The first thing I did was to increase it when the option first came out. Not that the default value is unsafe, but higher is better.
- BWN-01-003, BWN-01-004 are related to the Electron desktop app. I don't know why anyone would use an Electron desktop app when they can use the browser plugin so I didn't even read these.
Overall, I'm sure 1Password is a little more polished on the UI department but I can't imagine myself using a proprietary password manager for security reasons. I made extensive research when I planned switching from my KeePass+WebDAV solution to an online password manager and decided to use Bitwarden after considering all the options. So far I'm pretty happy with it. I wanted to share my experience in case anyone else is looking for a similar solution.
Or more precisely it makes a person wonder what the next step will be to alienate users which aren't aligned with the vendor's interests.
Yeah, no. 1PX has no means of data export. After 10 years on Lastpass, tried to give 1P a shot. Quickly grew frustrated within a month of the linux experience, and decided to move to Bitwarden. Turns out 1PX has no means of export, and I was stuck having to migrate each account by hand, and redoing the TOTPs. Bitwarden is substantially worse in terms of the UI, but at least I don't have to deal with vendor lockin.
People mostly complains about how they handled the situation, not about the product directly (there's many people that say that the product is superior yet will migrate because of their response).
They weren't respectful and they didn't acknowledge their mistake of not showing any warning anywhere (instead deflecting to absurd justification).
> knowing they have recurring revenue gives me confidence that they'll be around for a while.
Recurring revenue is a thing that help sure, but supporting your existing user base (which he was part of) is another one. That thread show how they treat them. That give me confidence that if I get an issue, I'll get treated just as badly.
I'll personally will be looking at an alternative, even though the product is pretty great, support is part of it (and in the case of a password manager, that's quite an important part of it).
My guess is that he's doing this when he crosses borders or in other situations where he might be subject to an intrusive search. So he carries a minimal set of passwords that he needs for that trip in a local vault. Maybe just his airline login, a throwaway email account, and an innocuous credit card account. If he's forced to login to his 1Password account during a search or inspection, he won't reveal his lifetime accumulation of accounts and passwords.
The reverse I could imagine.
Travel mode works because it can’t be changed on device and so moves the vault out of border security jurisdiction.
They can have probable cause to search your phone and will if they want to but they are unable to put you in a room with a browser and make you download something, so hence it’s out reach.
I would much rather just keep using the “local app” license, which sadly isn’t even available for sale anymore. In fact, I can’t even use my Windows license I bought back in the day.
One of these days I’ll probably just stop using 1Password and move on to something else. Are there any good free/one-time purchase locally syncable password apps that works on Mac/iOS?
It's free.
I've moved from dropbox to google drive for synchronizing my keepass database because of the recent changes to dropbox, where you can only sync 3 devices for free accounts.
In the past, they moved the standalone license page from 1password.com to agilebits.com, and made it purposely difficult, if not impossible to get to.
Now here's how you do it for the most recent version:
Download and install the app. When it asks you about a subscription, there is another link that you can click, but I don't remember what it says, but it should be at the bottom of the pop-up. It will take you to a checkout page where you can get a standalone license.
They'll probably change it yet again in the next major release so YMMV in the future.
https://1password.onfastspring.com/in-app/1password-7-for-wi...
https://1password.onfastspring.com/in-app/1password-7-for-ma...
This seems bogus. I bought it on mobile for $10 or whatever it was and on Mac and the migration to the subscription model was basically a forced deal as far as I could tell when the update a year or two ago to the free apps on subscription change happened. Hate that aspect.
And “thanks for your feedback” seems to be the new F off.
What're people's experiences with alternatives to 1PW - ones that do device-device sync and work at least across iOS/macos and ideally integrate nicely with browsers and apps on both those platforms? Is BitWarden ready for prime time for something as critical as secure password storage yet? Does it's iOS app take advantage of the secure enclave features of iPhones?
Having the developer respond quickly on email is delightful, it works great on Ubuntu, macOS, Windows, Chrome OS, Android, Firefox, and sharing credentials between accounts works seamlessly.
I might have a closer look at it myself.
It works fairly well. Some sites (banking, mostly) don't work, but the UI lets you easily copy the username or password so you can paste it where it should go.
> Does it work in Chrome on Android
Yes, and Firefox on Android.
> Can you authenticate with a fingerprint
That's how I have it set up.
> Can you force a non-fingerprint method after device reboot or a certain period of time?
Maybe? I haven't seen (nor looked for) that feature.
I don't think I ever had any issues with it.
It looks like it might use some old code from 1Password:
https://github.com/bitwarden/browser/blob/280f6f495f9f8bdfe3...
You can authenticate with a fingerprints and afaik no, you can't force pin after a reboot/period of time.
I never had trouble with it regarding that part and still recommend it. It also accepts 2FA with an YubiKey.
I switched to the Keepass world a while back when 1Password started to try to nudge me into paying a monthly fee for software that I already paid for on multiple platforms. The Keepass variants aren’t as slick but who cares.
[1] https://apps.apple.com/us/app/strongbox-password-safe/id8972...
Haven’t had any issues, I switched from LastPass and the only feature I miss for personal use is password sharing. I think it was in the free version of LastPass but not part of Bitwarden. I didn’t really use that feature much anyway though.
I was part of the LastPass exodus after their acquision and used 1Pass with Windows and (then) OSX. The lack of Linux client was a hassle, and eventually left me shopping around. I tried Keepassx and the others, but I ran into issues with sync (most likely my error.)
I saw Bitwarden mentioned here and gave it a swing. Importing everything only took a minute, and I haven't looked back. It works on all operating systems, has 2FA, etc etc. It's perfect for my needs.
At some point in the future I may go self-hosted.
My beef with 1Pass is that they charged around $35 - $50 for their standalone product during the exodus, and about a year later moved to their subscription platform --- pretty much abandoning development for the standalone users. The OSX application was far less buggy than the Windows client. And when you needed to grab a new copy of the standalone client, it was buried on their site in a FAQ.
1Pass should have offered a few months for free to pull the standalone folks over to the new service, but instead they said 'we don't have any offers, but feel free to contact sales' -- which is a difficult sell when compared to the newly polished Bitwarden that works on all systems and browsers out of the box without any requirement for payment or a subscription.
All this said, we're technical people, so we're more aware of sketchy practices and are quick to jump to different products, and may not be their target -- especially with their previous lack of Linux support.
I just don't want to have my personal password db on other people's computers, and their ever more forceful pushing to get me off the standalone apps synced between my devices over wifi has _finally_ got me looking around for alternatives. I'm _totally_ happy to pay for an alternative - I _do_ value software (especially this type of software), and Id love to be sure whatever I use has a reasonable change of being around (and being successful) in the timeframe of at east 5-10 years.
Bit I totally get that AgileBits are heading in the direction where my work is their target customer, and I am not. That's fine. I'm pretty sure I'd be making exactly that same decision if I ran/advised AgileBits.
It works pretty well, but the user experience eventually drove me back to 1Password:
https://news.ycombinator.com/item?id=19839087
#4 in particular.
https://community.bitwarden.com/t/autofill-shortcut-should-o...
If a company writing a security product can be this incompetent about something so basic, I don’t have any interest in gambling that the rest of their product is any better.
You can pass your email and password as arguments to the "bw login [email] [password]" command, which will put them into your history, but the default way of typing "bw login" will then prompt you for them both, masking your password just like any other CLI tool does.
Whereas the company literally removed a non-trivial piece of functionality without a single mention of it in Release Notes, and then disengaged from the topic once other people came in and pointed out that this is a) bad, and b) probably a blatant attempt at pushing people into the subscription model.
Overall, I know what password manager I'm not touching now.
His key beef is they neglected to mention the change in their release notes, and the optics of the oversight could be perceived as a covert move to push people toward their cloud service. I'm surprised they didn't apologize for the release notes oversight (whether or not it was inadvertent) - they kind of act like it's just another benign collateral effect that will only impact a handful of people.
Sure, maybe he's on a free plan, but when I shilled free trial versions of my software I tried to treat all [existing or potential] customers with white gloves - even the irritating ones.
@TroyHunt are you out there; any thoughts on the software change?
Additionally, this is asynchronous communication. Take a breath. Recover. Do it right.
That person probably got testy because they were being treated so poorly.
I don’t think I saw any validation of a reasonable concern—which is like customer service 101—let alone any type of attempt to win the user (back) over. This is classic, stereotypical techie behavior and it needs to die. And I say that as a developer (who has been plenty guilty of this tendency myself…)
It's extremely disappointing that the staff are being so evasive regarding their communication. For a product that is necessarily built on trust, that's the last thing that I want to see.
You can still view your passwords after your membership is cancelled.
>Looks like it's time to consider alternatives?
I've switched to Bitwarden and haven't looked back. It's not as 'shiny' as 1Password but they seem like a great company and everything works for me so far (using iOS, android, macOS, Ubuntu, and Firefox).
You can now. But for how long? How long it would be until you need to reimage your computer or install it on other platform and new version would demand membership?
The problem here is not that it won't work right now. It's that once this mode is not supported, even if it still works you're on your own. Like using out-of-support software version - maybe it works now, but you better to have a migration plan, or one day in the future you'd be in a big trouble with nobody to help you. And passwords to every site you have login on is not exactly the type of information you want to take risks with. You need to trust the provider they have your back here, and if they are not interested in supporting users that paid their licenses but are not providing recurrent revenue, then you better have plan B.
However (writing this complaint here since I am sure they are monitoring this 3d) I am really disappointed by the way agilebits handled this matter.
1) the release notes were shitty and they know it; 2) no one asked for a free app but if you do that, taking it away is a baaaaaad idea; 3) it took me a lot of time to convince family members to use local vaults on their phones, if the feature is removed and they will complain with me I will be extremely unhappy.
With the introduction of a subscription model, i started looking for alternatives.
While i get why companies jump on the subscription bandwagon, i on the other hand flat out refuse to pay a subscription fee for software. I don't mind paying for software, but the subscription model is not for me.
First, with a paid license for version x, i decide if the "latest & greatest" is worth it to me. If it isn't, i'll just stay with my old version.
Second, I'm old enough to know that the "latest & greatest" also includes the latest & greatest bugs. I want to decide when i upgrade. (Yes, i run Debian Stable!)
Third, as everything i (used to) use has migrated to a subscription model, it's becoming rather expensive to get anything done. Yes it's only "$X.99/mo", along with the 20 other things that are also "$X.99/mo".
For this particular use case, I've been evaluating many different solution, and i've more or less settled on [pass](https://www.passwordstore.org/). It works on Mac OS and Linux, has a very decent iOS app, and "kinda" works on Windows. I use it through WSL on windows.
It's nowhere near as polished as 1Password is, but it's mine, it's free, and it fits my needs.
I did evaluate [Bitwarden](https://bitwarden.com/) as it seemed like the next best choice to 1Password, but the "non subscription" version doesn't support 2FA tokens,
I still use 1Password frequently, but the second the local vault is gone, i am as well.
Open source. Bruce Schnieir designed. Windows, Mac, Linux, Android, iOS versions. Dropbox and iCloud sync available as well as standalone operation. Yubikey support.
Need I say more?
[1] https://keeweb.info/ [2] https://play.google.com/store/apps/details?id=keepass2androi...
Instead of having the option of letting me pay and upgrade if I decide to, I am forced to continue a subscription in order to continue using any version of 1Password (excluding legacy versions).
https://discussions.agilebits.com/discussion/92275/how-do-i-...
- Ben, 1Password
Roo has added a couple of recent comments on our forum that I wanted to make sure were highlighted here as well:
> While it’s too late for most, I have gone back and updated our release notes to indicate that we removed this feature.
(from https://discussions.agilebits.com/discussion/comment/515669/...)
and
> The Pro Features purchase has been removed from sale, but all the features that would have been unlocked have been maintained. There is no longer anything to restore. The more I've been thinking about it, the more I am coming down on the side of restoring the single standalone vault capability for those that previously purchased the Pro Features (or the full price app when it was a paid download long ago).
(from https://discussions.agilebits.com/discussion/comment/515789/...)
We're definitely listening to all of the feedback folks have taken the time to share with us on this and are evaluating how we can best move forward.
Thank you for all the comments, both here and on our forum.
- Ben, 1Password
And its has an open source client, plugins, and server--with instructions on how to setup your own instance if you want to. This is vital, not because I want to run it myself, but it provides a check in case the company is ever bought out or starts blowing it on policy.
See https://community.bitwarden.com/t/who-is-hosting-bitwarden/1...
I recently switched to BitWarden and couldn't be happier. I can now lose my dropbox account,which is a bonus, because i was only using it for the 1password vault. Another bonus is that I can now add passwords on my mobile device, which i couldn't do with my legacy license of 1password. $10 yr get's premium service that include integrated OTP, one of my favorite features of both platforms. $10/yr is reasonable to me - after 20 years I'll only be out $200, which i feel like is a more than reasonable software license fee. I'm sure eventually they will become popular and start gauging, but for now, it's working well without having to pay a $60+ yr that 1password charges - more than the initial license fee! - and I don't need to manage that stupid vault anymore.
First, lets discuss what the Secret Key actually does. I'm going to simplify this greatly simply because I don't want to end up in the weeds here. But I think it's important to know what it does and why.
When we designed 1Password's online service we knew that our servers would be a big target if it were storing a lot of user data. And we knew, that historically, users used terribly weak passwords. Knowing this we set out to find ways to protect against these issues.
Lets compare to our standalone vaults since it's a comparison with only us and keeps things simple. Assuming an attacker gains access to your local vault they'd have to guess your Master Password.
With 1Password membership accounts you have both a Master Password and the Secret Key. If someone were to gain access to our servers they'd have to guess both your Secret Key and Master Password together (they're combined together, again simplifying, see our white paper for the full technicals here). You can't just guess the Master Password and then the Secret Key or vice versa, you have to have both of them correct.
Say a user uses a terribly weak Master Password, this would be relatively trivial to guess if someone had your encrypted data.
Say our servers are compromised and you used a weak Master Password. The Secret Key (a 128-bit randomly generated key) is going to protect that data because even if the attacker could guess the weak Master Password, the addition of the Secret Key requires that they guess both together, making the weak Master Password not nearly as weak. For those using very strong Master Passwords, the Secret Key strengthens it even further.
With the same idea in mind, breaching our servers to acquire the encrypted data means an attacker acquires nothing but encrypted data and requires guessing the Secret Key and Master Password for every account. This is a significant undertaking and effectively improbable using today's technology.
Hopefully you now see the point of the Secret Key, it's to protect your data locally on our servers. You absolutely shouldn't use a weak Master Password, but the Secret Key protects those that potentially do.
Now, to your other questions. We do have snapshots of the database made daily. We could restore to one of those.
We are also working on (and have partially implemented) a local backup solution. The Mac client creates these backups already for users who are on our memberships (for individual and family accounts only). They are not (yet) documented nor is there a tool that can read them, but they are being made. The plan is to openly document how they're created so that anyone with the technical understanding could create their own tool for reading them. The reader part of it will come in the future, and likely part of our CLI application, though nothing is for certain at this point and subject to change.
This will allow you to have your own backups and they'll be local to you in the event that something goes wrong on our servers.
Hope that gives you some idea of how it all works. If I can answer any other questions, feel free to write in to support+security@1password.com and mention me (Kyle) and this thread (ideally a link to your question so I have context and won't feel like I have to repeat in case I forget what I may have said)
Kyle
1Password
I tried to have a family member set it up and it was really hard for them.
What do people think about a simpler service that relies on SaaS and you owning your primary email address. The service is called nopassword and you log in via a link that is sent to your primary email address. When you log in you see a hashed email address that ends in @nopassword.com. to add a new account.
To add a new account you change your email at that account to the hashed email address that ends in @nopassword.com. The nopassword service will automatically detect this, confirm the email address change, and reset your password. From now on you can find your password in the nopassword website or client.
Because every service uses a new unique email address you have the privacy and spam filtering advantages of Apple ID. Since almost every web service lets you register by email and reset your password by email it is compatible with almost everything.
After you log into a service nopassword will reset your password 16 hours later. This way intercepted passwords can never be used for long. And if a webservice has a breach nopassword will proactively reset your password.
The nopassword service will have clients for iphone/android/chrome/firefox/safari that word with native authentication (FaceID, etc.) to get in the client after validating with your primary email on install.
Would you use this?
If a breach would occur the race would be on to reset the password before the hackers would change the email address.
You can imagine having 1% of canary accounts that give a big alert if their email is every changed leading to a race to see who can reset accounts first.
One of the alternative business models is ads and paying with my user data, and I neither like ads, nor do I want to pay with my data.
Any guesses as to what the use case here is?
I travel internationally quite a bit and have become paranoid (as someone whose entire work history consists of being a journalist and a software engineer, I’m almost certainly on several different watchlists) about entering certain countries and even re-entering the US, so I’ve created a travel vault for trivial things and secure notes with important phone numbers in the event of an emergency. It’s great. I restore my regular vault when I’m on a VPN and inside my hotel room or at home.
Of course, to get access to this feature you need to pay for a 1Password.com subscription (though you can restrict access to the vault to specific devices, meaning I could say my travel vault could only be accessed on iOS and not in a web browser, as an example), which wouldn’t help this person.
I understand why a lot of longtime 1Password users were/are angry about the shift to a subscription model. I’ve been a user for 12 years and know the founders and many current and former employees and I was still reticent to sign-up. Ultimately, their security audits of their system is what encouraged me to use it — especially when I acknowledged I was using Dropbox for sync for many years, which negates the security argument (I trust Agile Bits more than I trust Dropbox when it comes to security). I understand the appeal of the “roll your own” approach, but I trust 1PW more than myself when it comes to setting up and maintaining a secure server and sync and encryption too. I have the opposite opinion of LastPass, who I don’t trust — but if one wants to have mobile access to their passwords without having to rely on WLAN sync (which isn’t exactly seamless — I remember before 1PW had Dropbox support and the way you would sync the iPhone version was over WLAN with the Mac app), you have to use a sync server and for better or worse, I trust Agile Bits not just to encrypt my password database but to protect its own systems, more than I trust another cloud provider or myself.
It doesn’t matter if the app is great or what features it provides. The company is blatantly customer hostile, and its support staff probably echo top management’s words without much help for users.
I recently migrated to Bitwarden. It checks the boxes I need, including sharing specific information with someone in the free tier (though this is restricted to one person). The cheap paid tiers offer a lot more, and will not hurt your wallet like 1Password does.
You can also self-host Bitwarden server yourself, and there are ports available on different languages and stacks online if the base stack is not your preference.
I also can’t wait for Firefox Lockwise to become an equivalent competitor soon enough.
The days of commercial password managers with expensive subscriptions and poor support seem to be fading away. That’s good for everyone.
I will not use a 1Password.com account regardless of the country it is hosted in because I do not trust AgileBits or any government, especially not a Five Eyes entity.
Despite the lengths that AgileBits have gone to to hide the option of buying a stand-alone licence, there was one page which I can’t find now listing the benefits of each licence side by side, and it clearly stated “no wlan sync” and “no multi factor authentication” in the column for licence over subscription.
The rest of the language tries to make it sound like a good thing to have my secrets hosted on a site I do not control. In the end I bought a subscription — purely for access to wlan sync and OTP — because it’s about the same price I have been paying for previous paid upgrades and Pro features.
Also note that for 1Password 6 users who bought the Pro features, the upgrade splash screen states that 1Password 7 is a “paid upgrade” not a “subscription required for Pro features”.
For the moment I will be treating the 12 month subscription as an opportunity to explore other options before the subscription rates inevitably rise and the feature set moves inexorably towards hosting over private vault management.
Not. Happy. Jan.
But on the other hand I’ve had a great experience with 1password and I’m about as comfortable with them having my data as I am with Google having my data. Maybe even more so since I know they don’t read my data whereas Google does.
An interesting discussion would be how 1password handles backups, backup verification, and recovery.
I’ve seen Google mess up Gmail but everything always comes back, and I think it’s because their backup solution is exactly the insanely wicked setup you would expect from Google. Compare that to Hotmail or Yahoo Mail, both of which butchered my mailboxes multiple times back when I used those, or the infamous Microsoft Sidekick incident. I wonder where 1password falls between the two extremes.
It's very bad for a corporation (/the big 5) to have this much power over what we are allowed to do on our devices.
The iOS version with swiftUI is in the works as well.
My goal with both the macOS and (soon) iOS app is to do encrypted sync via bluetooth or wifi, with no external server ever seeing your passwords.
The problem is that it isn’t a seamless process. You have to initiate a sync on one client or the other. Do you have situations where you might be on your phone and not have the latest database from your laptop or desktop — or two laptops could be out of sync if they aren’t on the same network.
OK, so you set clients to sync at specific intervals in the background — this can work but still might miss things and you’ve now got a client that is constantly polling another.
The reason for the external server is access continence, because any good password manager will keep the databases encrypted regardless of where they are stored. I mean, you want the server the database is on to be secure too — not to mention any browser extension that might exist — but the database itself is the most important part.
A YubiKey or a portable version of KeepassX is probably the best option for the paranoid, IMHO, over local sync (especially something like Bluetooth). Of course, for mobile access you’ll need to be able to plug a USB key into your phone. That’s probably not a problem on Android and hopefully with iOS 13, it’ll be a better iOS option too.
These guys make a password manger product. That's it. And they encourage you to put health and passport information in there.
They should run it like a bank. Boring. Reliable. Trustworthy. That means not pulling this penny-ante nickel and diming stuff.
At least they're quick at responding and seem to respond to everything...
With that said removing a feature that allowed iOS users to use the app for free and then not putting it in the release notes is going to look like you’re trying to trick users into upgrading.
It’s obvious that if the release notes specified that it removed this feature, people would have avoided upgrading. That doesn’t inherently mean 1PW meant to trick the users but damn it sure looks that way to me.
I chose KeePass a while ago and I'm satisfied with it. There are many compatible implementations out there, and some web-based like KeeWeb.
You can self-host the entire server, or you can use their own and use an online storage provider to store the KeePass database.
but then, well, otoh after reviewing, regardless of that truth it still is despicable. removing a critical feature, without notice, in a point release, on a platform where it’s incredibly hard to rollback. 1pw needs to step up and release another point version with the feature restored.
worse that that even, is the official PR spin couched as a personal reply. it leads with “oops thought no one used this feature. sorry!”. followed much later with:
> We receive enough customer support from people who set up 1Password in this way
that’s enough for me. i was a longtime customer, using it since the start. time to move on.
it seems they've done just that, 5 days after (4 days ago now).
https://www.macrumors.com/2019/07/19/1password-restores-loca...
https://chriszarate.github.io/supergenpass/
Works every time and is portable as hell.
How are people still using password lockers?
[1] https://help.bitwarden.com/article/import-from-1password/
Is this even possible without manual steps?
> Comma Delimited Text (.csv) to move data to a different app.
Can you get in touch with us via our contact form (email method) https://support.1password.com/contact-us/ and we'll see what we can do to help you out with that. We were all students at one point in time as well so if we can help you then we'll help.
Just mention my name and this thread in the form. It'll get sent my way.
Kyle
1Password
thanks for the free advertisement for Bitwarden.
I thought AgileBits was fine with their responses. The last thing you can do is give people like this any hope. Be clear that you’re not going back to the way things were and stick to that.
Or Bitwarden https://bitwarden.com/
Also, pass is a Linux application and Bitwarden cloud-based. So, no, those aren't relevant alternatives.
And yes, I know who Bruce Schneier is. Not sure what your point is though.
Any password manager that doesn't offer this is a non-starter for me. I don't want to be caught unawares when the vendor who makes my cloud-based password manager suddenly goes out of business (or if it's suffering a network outage when I really need to log in somewhere).
I've seen them used to implement 3rd party clients, so there are a few implementations out there.
None of those questions were answered without repeated requests for the information. That’s shady. What exactly are you seeing that I didn’t?
Yes, I appreciate the fact that they're continuing to support things, and I am glad that they're finding a revenue model that supports their team, but I very much like my current setup and still haven't upgraded 1password on my Mac past version 3 because I like the old model. Skipping updates on iOS is much much harder.
I would probably pay a flat $40 again for an upgraded version with a standalone license if such a thing were still available.
The v7 standalone license is still available.
https://1password.onfastspring.com/in-app/1password-7-for-ma...
I must confess the interaction in TFA makes me much more reticent to do something outside the beaten path...
It's not even a matter of responsibility. Doing a change like this and not telling users is asking for conflict. Given that mentioning a change in Release Notes is an insignificant amount of effort compared to implementing that change in the product, I fail to see a legitimate reason to not mention the change.
When you're Facebook and have strong network effects, you can afford boiling your changelog down to "we've fixed bugs and improved performance", and giving zero information about actual changes.