It’s one of those apps which has been made with proper craftsmanship and care, so while I’m not a Linux user, I’d have no problem recommending based solely on Agilebit’s reputation.
The Windows client is much better after the last major release, but it's never been as slick as the Mac version (the biggest wart now is the system tray/browser extension popup).
1Password X looks nice until you try and use it, and all the company reps on the forums are very argumentative about any feature request (look for the pushback they give about resizing their super-cramped browser extension popup—and the issues with hires screens stemming from how they built it, which assumes a fixed size).
I've also got a chip on my shoulder about the "feature" they added that showed the most recently used websites in the iOS app with no way to disable it (they finally allowed setting the number to zero months later). The reps on their forums all come off with this attitude of "this is the best way, and you're wrong if you don't like it" for just about every issue that comes up.
I like the app and will continue to use it, but if my main platform wasn't macOS/iOS I would have bailed long ago.
I've observed this as well and it's frustrating. Usability took a dive when the list view for entries was removed (in favor of the rich icon, column-based layout), having to manually check identically named entries to find one with the right username, but their support staff was seriously adamant about the feature not being worth the development effort because of how few people had used it. It got me looking for alternatives but I haven't switched away yet.
As a company we tend to keep future plans pretty close to the chest. There are sometimes things that we know we aren't going to do, and whenever possible I try to be up front about that rather than beating around the bush or giving false hope. List view is one example of this. The intention isn't to be argumentative, but rather to set expectations based on current plans.
- Ben, 1Password
Keepass XC may even be doing a better job at security. At least in some dimensions.
I think it would indeed be nice if 1password scrubbed sensitive data from memory, but not a complete deal breaker if it didn't. I do wonder if this could be more of a problem on 1passwordX, though.
[1]: not zero, but still
Has merge functionality if you've edited the password file both on mobile and computer.
It even has an offline variant that keeps everything local. I'm using that with NextCloud.
Is it? I've been using it for sometime as well but it seems like there is a lot of room for improvement. E.g:
- Support for unlocking via Watch ID on the Mac.
- Currently on iOS when searching for a password within an app, if a site prefix is included that doesn't match what's in 1Password the list will just show no results, with no way to navigate manually to the login. Instead, you have to close the app, open 1Password, and copy/paste the credentials back in. Typically the master password will have to be re-entered as well, despite touch ID being adequate a moment prior. Since it's rare to sign up via the web now for mobile apps, this is the most common scenario for me when using 1Password for apps on my phone (and occasionally websites as well).
- Improved UI/UX on mobile. Dashlane is way better in this regard. 1Password overemphasizes features I don't need like tags and favorites and has a pretty cluttered look in general.
I like the native Mac app and open/local vault format. (Dashlane by contrast has a very buggy desktop app and requires storing everything on their servers.) But I would jump at the chance to use an alternative with a simpler UI and better experience on mobile.
This won’t solve all your problems. It won’t even solve the problem you describe the first time you encounter it. Nor will it solve it for apps that fail to provide an INTENT URL. But hopefully it will make things a little easier.
Unless I'm mistaken, 1Password no longer ephemerally decrypts passwords as needed and only while used and then scrubs the memory. [1, old but still] The excuse, if I remember it, was that garbage collected languages made this challenging. Even so, there is some irony in them moving away from the temporary, one-at-a-time, scrubbed approach just before all of the side channel attacks that allowed leaking memory across processes became widespread.
[1] https://nakedsecurity.sophos.com/2019/02/21/password-manager...
This is one of the main reasons why the core of 1password was rewritten in Rust: https://support.1password.com/kb/201902a/
It’s robust software that does was it says on the box. I was initially reluctant to move out of my local vault but the online service has been impeccable.
Electron isn't necessarily bad, its primarly a matter of how good your implementation is.
I only use VSCode for workflows I am obliged to.
Microsoft's React Native team has benchmarks where Electron causes 300x performance drop versus React Native.
Speaking of it,
"Xbox app for PC gets speed boost, ditching Electron for React Native UWP"
https://www.windowscentral.com/xbox-app-pc-gets-speed-boost-...
I dream of the day that VSCode gets rebooted into React Native.
Because it's terrible. It's slow and ponderous. I have yet to use something built on it that wasn't awful, and that INCLUDES VSCode.
I'm also actively looking to move away from 1P period because I don't want or need a subscription for every little app.
2. It encourages developers to ignore platform-specific design idioms and features.
As soon as this stops working and i'm forced to get a subscription i'm moving to another password manager though. So hopefully one time purchases will remain possible.
If Apple offered a more fully featured keychain I might just stay in their ecosystem.
Given Apple's track record, if you care about your passwords being portable, it's unlikely that you'll be able to use their keychain on Windows/Linux/Android even if they develop it further.
I also considered using KeepassXC and Strongbox on iOS, which is completely free (sync the database via iCloud.) KeepassXC's browser extensions are pretty bad though, hopefully that will change sometime soon.
If you want to keep costs low, Bitwarden is currently your best option i think.
They’ve got a family-oriented subscription which is cheaper. Used it since it launched and it’s been transformative for both sharing credentials with my family and getting them into the habit of unique credentials on every site, and TOTP where possible as well.
I can’t recommend 1Password enough and I’ve been a customer for a very long time, predating the move to subscription pricing and cloud services.
It’s worlds improved over synchronizing with Dropbox. There’s definitely security tradeoffs but if it isn’t easy you’d lose a substantial number of people back to duplicating the same password across 370 sites.
There's always 1 person (family organizer) who is in charge of everything, and can reset the other accounts...
I do think it should cost less, but I also sort of am hoping a solid solution built directly into iOS/macOS will appear in the next few years.
It is a much harder sell to a family member that has never bothered with a secrets manager before.
Linux doesn't have a standard desktop environment or widget toolkit. Electron doesn't seem like a worse choice than the other options, and it's easy to find engineers who know how to work with it.
1Password doesn't just store passwords. It has a bunch of other features. It's a fairly complex app at this point. It also has fairly similar user experiences in Windows, macOS, Linux, iOS, and Android, and that's pretty hard to pull off. If Electron helps them accomplish that, that's fine.
Those are pretty good reasons not to use electron.
Because every Electron app is inconsistent with the rest of the desktop. I use a dark theme system-wide but Electron won't care [edit: 1Password has custom integration for GTK theme]. Honestly, this isn't something the developer of the app have to put years of research in (Slack for example). The toolkit is supposed to do the integration (GTK, Qt, [Cocoa?]) and clearly Electron doesn't care.
> Why not QT?
You tell me (assuming you're talking about Qt, not QuickTime)
> Electron doesn't seem like a worse choice than the other options
Not really. Its just that its lazier/cheaper to just get your web development team pretend to write a desktop app. I get it, business decisions need to factor cost into account and hence the choice. I understand when a business says "we just don't have the funds to use a proper app framework, please do with what we have for now". But instead everyone goes to pretend like Electron apps are perfect even though the reason it was chosen was almost completely based on cost.
In essence, the old "only X% of our users use platform Y, it's not worth it to make this feature/fix this bug for them" does not exist anymore with something like Electron, and while this is ultimately also a cost consideration, it does come with benefits for me as a user, especially if I'm on a minority platform.
That (and everything else you said) is true for any cross-platform framework, not just Electron.
PWAs and Web Widgets I can stand behind, Electron is just laziness at the expense of the user.
There are plenty of Gtk and Qt based applications for Linux.
Yes, it is very obvious from the screenshot that it’s built on top of Electron [1].
GTK nor Qt have that type of UI elements, they are obviously HTML elements stylized with CSS.
Another hint is in the files contained inside the Debian package used during the Linux installation [2]:
root@3cb1637b3070:/# apt-get download 1password
root@3cb1637b3070:/# dpkg --extract 1password_0.8.0-22506_amd64.deb temp
root@3cb1637b3070:/# ls -lia ./temp/opt/1Password/
total 177900
661008 drwxr-xr-x 5 root root 4096 Aug 3 18:23 .
661007 drwxr-xr-x 3 root root 4096 Aug 3 18:23 ..
661011 -rwxr-xr-x 1 root root 129796744 Aug 3 18:21 1password
661010 -rw-r--r-- 1 root root 1060 Aug 3 18:21 LICENSE.electron.txt
661023 -rw-r--r-- 1 root root 4710103 Aug 3 18:21 LICENSES.chromium.html
661021 -rwxr-xr-x 1 root root 6322128 Aug 3 18:21 chrome-sandbox
661017 -rw-r--r-- 1 root root 179981 Aug 3 18:21 chrome_100_percent.pak
661013 -rw-r--r-- 1 root root 321151 Aug 3 18:21 chrome_200_percent.pak
661022 -rw-r--r-- 1 root root 10505952 Aug 3 18:21 icudtl.dat
661012 -rwxr-xr-x 1 root root 243992 Aug 3 18:21 libEGL.so
661014 -rwxr-xr-x 1 root root 8948960 Aug 3 18:21 libGLESv2.so
661024 -rwxr-xr-x 1 root root 3103488 Aug 3 18:21 libffmpeg.so
661020 -rwxr-xr-x 1 root root 4488304 Aug 3 18:21 libvk_swiftshader.so
661018 -rwxr-xr-x 1 root root 8483376 Aug 3 18:21 libvulkan.so
792826 drwxr-xr-x 2 root root 4096 Aug 3 18:23 locales
792824 drwxr-xr-x 2 root root 4096 Aug 3 18:23 resources/app.asar
661015 -rw-r--r-- 1 root root 4791423 Aug 3 18:21 resources.pak
661009 -rw-r--r-- 1 root root 50592 Aug 3 18:21 snapshot_blob.bin
792821 drwxr-xr-x 2 root root 4096 Aug 3 18:23 swiftshader
661019 -rw-r--r-- 1 root root 170903 Aug 3 18:21 v8_context_snapshot.bin
661016 -rw-r--r-- 1 root root 107 Aug 3 18:21 vk_swiftshader_icd.json
[1] https://i.imgur.com/pGJ4Wvd.png
I love this. It was my first reaction when I used MS Teams ... shit, it's electron and the I got the horrible user experience as usual. And in MS Teams even the font and its rendering is hardcoded and the devs are refusing to do anything about this! So when I use MS Teams I need to look at blurry text.
EDIT: And they bundle libffmpeg.so too .... let's have a look at what version, though I guess 1password is not a good attack vendor as it'd be hard for the attacker to control input data, right.
I want my security critical apps to be as small as possible, not a huge pile of everything and the kitchen sink.
Edit: Thanks for adding the package info.
How did we ever managed without Electron?!?
Man we were 1337!
Apparently a forgotten art.
As for VMs, I am all for stuff like React Native, not for packing Chrome with each application.
Not only it shows laziness where Web == ChromeOS, bloats the applications and is yet another way for turning everyone into Chrome developers, bye bye Web.
I have rarely enjoyed using a Gtk or Qt app on macOS because they feel alien.
On windows for example there seems to be no rhyme or reason for widgets, mainly due to historical reasons.
Games don’t need to be consistent because they take up the whole screen and are immersive. Some very specific programs such as the Godot editor are a good example of a similar usage.
Which is basically the first line of my comment and how we used to do back in the day, with common logic and those in-house "engines".
Once you’ve decided that you want to make a GUI for something you’ve already made the choice to increase the weight considerably. Electron is still the best cross platform toolkit when you need browser support too.
Agree, just though it was too much for something simple as displaying logins/pass but looks like it has lots of features?