Comment by karlshea | Hacker News Reader

Comment by karlshea | Hacker News Reader

Parent Full thread

It's made with proper craftsmanship and care on the Mac (which is primarily where I've been using it for years).

The Windows client is much better after the last major release, but it's never been as slick as the Mac version (the biggest wart now is the system tray/browser extension popup).

1Password X looks nice until you try and use it, and all the company reps on the forums are very argumentative about any feature request (look for the pushback they give about resizing their super-cramped browser extension popup—and the issues with hires screens stemming from how they built it, which assumes a fixed size).

I've also got a chip on my shoulder about the "feature" they added that showed the most recently used websites in the iOS app with no way to disable it (they finally allowed setting the number to zero months later). The reps on their forums all come off with this attitude of "this is the best way, and you're wrong if you don't like it" for just about every issue that comes up.

I like the app and will continue to use it, but if my main platform wasn't macOS/iOS I would have bailed long ago.

> all the company reps on the forums are very argumentative about any feature request

I've observed this as well and it's frustrating. Usability took a dive when the list view for entries was removed (in favor of the rich icon, column-based layout), having to manually check identically named entries to find one with the right username, but their support staff was seriously adamant about the feature not being worth the development effort because of how few people had used it. It got me looking for alternatives but I haven't switched away yet.

I apologize that we've come across that way. I'm one of the primary contributors on our forum and so I do appreciate the perspective here. The position I try to take, not being a developer or project manager myself, is that I have no power to make feature requests happen other than suggesting them to the team. As such I try to help people best use what is currently available while also passing suggestions along.

As a company we tend to keep future plans pretty close to the chest. There are sometimes things that we know we aren't going to do, and whenever possible I try to be up front about that rather than beating around the bush or giving false hope. List view is one example of this. The intention isn't to be argumentative, but rather to set expectations based on current plans.

- Ben, 1Password

They were also pretty dismissive of Linux for a long time, so it's kind of funny to hear it as one of their biggest requests. 1Password X narrowly prevented me from switching for a while, but I've come to see alternatives as generally better options. Yeah, they're not as flashy, but I think Bitwarden and Keepass XC do a great job.

Keepass XC may even be doing a better job at security. At least in some dimensions.

https://keepassxc.org/blog/2019-02-21-memory-security/

FWIW cache side channel attacks are primarily a threat on (shared) cloud platforms, but not as much [1] on personal devices. Considering that 1password runs in its own process and that most personal devices should have Meltdown mitigations in place, it would be prohibitively difficult to successfully launch a cache side channel attack to extract the password from outside of your device, especially at scale. Attackers would attempt to find other software vulnerabilities instead.

I think it would indeed be nice if 1password scrubbed sensitive data from memory, but not a complete deal breaker if it didn't. I do wonder if this could be more of a problem on 1passwordX, though.

[1]: not zero, but still

Oops, I somehow managed to respond to the wrong comment. I meant to respond to https://news.ycombinator.com/item?id=24057416

That’s where Agilebits has me; the UI on Mac and iOS is so much better than the alternatives. I do keep looking, Keepass XC looks really good since the last time I checked around.

KeepassXC is quite good if you mainly use it on your computer. I've been using Keepass(XC) for about 10 years, it's secure and reliable. But I'm looking to switch to 1password or Bitwarden as I'm increasingly using portable devices (phone, tablet…).

Keepass2Android works pretty well for me. You can sync your password database via google drive or other file sharing services.

Seconded, Keepass2Android is great and has very good integration on Android. You can use the autofill feature to, well, autofill the credentials fields in any app.

Has merge functionality if you've edited the password file both on mobile and computer.

It even has an offline variant that keeps everything local. I'm using that with NextCloud.

If you do end up leaving Keepass, Bitwarden has been a good experience for me. I can’t attest much about security but it seems OK from my perspective.

Reply on news.ycombinator.com