I realize all this requires a great deal of trust in the maker of 1Password having done things right and currently I have that trust. This may change in the future of course.
I realize all this requires a great deal of trust in the maker of 1Password having done things right and currently I have that trust. This may change in the future of course.
I sent an email to the support team at the time asking some technical questions that the security report raised for me, and wondering how the team was planning to evolve the product going forward. They sent back a very in depth, detailed answer that included info about some of the experiments they were doing to decrease the amount of time passwords were decrypted in memory, along with looking into Rust for better direct memory management than they could get with C# or Swift. All in all, the care and quality of the response gave me a great impression of the team and of their approach to user interactions.
[1]: https://www.securityevaluators.com/casestudies/password-mana...
Also Apple buying into using 1Password company wide helps gain some trust (I am sure there was some serious auditing): https://medium.com/enrique-dans/apple-and-1passwords-deal-sh...
Huh! One would assume, they use Keychain with iCloud?
In other words, I am somewhat scared, but the usability is so fantastic that I find the compromise reasonable, especially with 2FA (TOTP or U2F using YubiKey).
Now, if only Apple finally learned that prompting me for my Apple ID password in a modal popup whenever they feel like it, without the ability to auto-fill is a no-no...
However, if it's the latter, KeePassXC now knows how to read the .opvault format: https://github.com/keepassxreboot/keepassxc/issues/1462 I could imagine teaching it to write their opvault file format, too, but at the time it wasn't a use-case that I needed
I would actually suspect teaching KeePassXC to read the 1Password.com cached vault would be even easier, since they now use sqlite3 for storage, but it would still -- afaik -- be confined to your local machine since their web API is undocumented
When adding an account to 1pass, it's important to click [save] before closing the tab, otherwise it's lost. (Having to pull passwords out of the PW generator history is a hack.) (It does support my belief/their claim that the pw decryption is done locally though.) To be fair, it used to be that you could accidentally click on the left pane and lose the unsaved account - they've fixed that in the latest of the 1PasswordX extension.
I haven't moved my entire life to 1password, so I don't have, eg, my passport or SSN or any outdoor license's in the system, and the inclusion of such things degrades my user experience - imo the new button should make a new login, with a button on that panel/page to change type, rather than making me pick which type of secret I'd like to create when I hit the [+].
I have, however, added my credit cards, but as far as UX, in the main UI, I click on the credit card category, then click on the search and try to search for a website login, only to have 0 results. Not surprising, I don't have an ycombinator credit card, but search results pane could surface hits in other categories if there are zero hits in the selected category - most (all?) of the data in 1 password is text, so I'm doubtful that full-text search is that expensive.
1PasswordX (the obvious chrome extension to install) doesn't work with TouchID without some extra configuring. (I set that for less technical people in my life, and that only came up after asking them why they stopped using 1pass.)
I'll give them a bit of pass on the difficulty of adding accounts on ios, but where many/most websites use email as username these days, maybe that could be autofilled when adding/creating logins manually?
And for my gripe about cloudification - I'm reasonably happy to pay a subscription (I currently pay for one, and am hopeful they're working on ^ UX issues), but every time I add something to 1pass, I question if adding secrets to a cloud/SaaS app, is going to royally fuck me over if AgileBits ever shuts down. Being able to save file-based backups to various places was reassuring. (Yes, this is a UX issue - it's not great if a customer questions if they want your product, each time they make the product more useful for themselves.) (See also: Trying to choose a Netflix title to watch, and giving up in disgust.)
TBC, I'm a (reasonably) happy customer, but I wouldn't hold up their UX as "well polished". I don't use it as a selling point when trying to convert people, certainly. At least I don't have to interact with it for the most part - I click into a password field, authenticate, and click autofill.
I'm sure I'll have to cave at some point what with the ongoing march of progress, but it leaves a bad taste in my mouth whenever a previously purchased product (i.e. 1Password) suddenly is asking for more money with no perceived benefit to me, other than getting to continue using a product I already bought.
Software has switched to a subscriptions, but They don’t offer any benefit over the original purchase price structure to users. It feels like the ultimate admission that the product has reached maturity, and so it’s time to rent seek.
I’ve considered switching to Bitwarden or Firefox Lockwise, but honestly, 1Password still works, and so there isn’t much impetus to migrate.
I would stop upgrading if agilebits ever drop local vault support though.
Why not, i use iCloud to store my 1Password data, and i still use the latest macOS 1Password version (7 i believe). It's a standalone app without a subscription (i would never pay for a subscription just because they tacked on a cloud service I don't need, to justify the subscription model...)