1Password for Linux beta
blog.1password.com
blog.1password.com
Use bitwarden-rs if you're planning on self-hosting.
bitwarden_rs on the other hand, works just fine, never had an issue with it or incompatibility with the browser extensions or mobile apps.
The official one uses MS SQL server and takes quite a bit of memory (which I call it a hidden monthly cost as I need to be using a bigger cloud instance) but this one only takes so little, you can host it on any cheap VPS and it has been working just fine against official clients for years.
I see some of the newer premium features, particularly around SSO are under a noncommercial visible source license of their own devising though
While the Bitwarden apps are not as "pretty" as 1Password's I find them a little simpler to use. Obviously UI design is highly subjective though so your thoughts may be very different :)
Anyway yes I highly recommend Bitwarden. Kyle and the team have built and continue to run a top class product that costs 1/3 the price of 1Password.
Edit: To clarify I use Bitwarden solely for personal use. I cannot fairly compare Bitwarden and 1Password for multiuser/shared vault use.
I am on macOS Catalina although that shouldn't matter. I suggest you contact support https://bitwarden.com/contact/
Could it be a device issue? I highly recommend you report it to Bitwarden as Android can be a real pain in the ass to test with so many different devices out there with all kinds of strange OEM "optimisations" to the OS.
Maybe its a syncing related issue, try contacting support.
1password used to have a peer to peer sync mode that I loved. No need for a server anywhere. You would open it on your Mac and then open it on your phone and if they were on the same network they would self discover. Too inconvenient, perhaps, for most users, but for the paranoid like me, it was ideal -- no servers involved at all.
(Technically, wifi sync I believe still exists IF you use 1password on Mac with a old style local vault, but it's basically unsupported. Mine just stopped working and I switched to 1password.com.)
Personally, I'd trust one of my servers far more than a client shouting "yo someone send me a file to overwrite my db with" over multicast on the local starbucks wifi...
It also doesn't have to be exposed to the internet. You can have it accessible behind wireguard for instance.
I have it, a DNS server, cloud storage, etc on my home lan, and use wireguard to access it on the go.
In principle, you could store your Bitwarden database on a public torrent at no risk to your security :)
So, if you do trust the Bitwarden software in the first place, self-hosting it shouldn't be any more dangerous than using the managed service, because the server security isn't really a critical part of the defence model. And self-hosting allows you to build from source, if you're inclined to paranoia (Even though the worst a malicious server could do is delete your database).
That said, I have still bothered to set up strict fail2ban rules on my BW instance, because why not.
Unless you use the web client, and a lot of Bitwarden's functionality is only available via its web client (including critical functionality like changing your master password).
Reading between the lines it sounds like being able to build from source or see and install the source gives some assurance you can’t get via third party and the strong files give some assurance over me being a bad sysadmin. That’s either a sweet spot or uncanny valley depending on your perspective. :)
Not that much, given that basic accounts are free. I guess that in addition to the building from source option, self-hosted Bitwarden (or at least Bitwarden-rs) includes all enterprise features for free.
The two most useful ones are probably sharing selected passwords with other users / groups, and attaching encrypted files to logins.
I wouldn't bother setting up a server and domain solely for it, but if you already have a personal webserver with a reliable backup strategy, since Bitwarden_rs barely uses any resources and is super easy to install, you might as well throw it in.
That's my case - I was already running a personal Nextcloud and Fediverse instance, so adding Bitwarden was like five lines of docker-compose and four of Caddyfile.
If you mean they may have a vulnerability, they've gone through a few security audits.
If you mean you can't adequately keep your own server secure, then pass it.
I have the exact opposite feeling. I would not selfhost email but I would selfhost a password manager and my files behind WireGuard, like many have said.
I have almost moved from cloud hosting to home server. This perfectly reasonable for non critical services that don’t require more than 90% availability. The simplicity of such a setup nowadays is a breeze of fresh air. Debian stable, WireGuard, syncthing, ssh, git, ... all are low maintenance and works fine with Linux and iOS clients.
Note that I use syncthing for the casual read only "important documents", such as ID copies, tax documents, ebooks, etc. I don’t sync photos, movies and such. Most editable documents are in git repos.
I sometimes work on my iPad, and then I use a ssh client or the ish app (a shell, with vim, etc).
I have used this setup for years, and it’s just low friction, low maintenance for me. I have thought about using an own cloud/nextcloud setup, but it’s just too much work for little value. Like running gitlab instead of ssh and git.
For the longest time bitwarden has been broken in the firefox's private browsing after mozilla deprecated some apis due to security concerns. They've given alternatives but they are just refusing to fix it, to the point of basically saying mozilla needs to fix the issue. What's sad is a similar mechanism is used in their chrome extension. Someone even raised a working PR that the CTO wasn't fully happy with, and asked for changes (which is fair), but the PR hasn't moved since, so I'd have expected the Bitwarden employees to take it and fix it up.
It's absolutely ridiculous to still not have this fixed years later.
By contrast, I was a 1Password customer at the time this change got introduced, and they'd pushed out a fix not long after.
I will be trying to Linux client, and if it's good enough, I'm certainly switch away.
I switched to 1Password from KeePass after 5 or so years because I just got tired of maintaining the data locally and keeping it in sync on my devices that I need the passwords on. I just backup the 1Password database locally now to calm some paranoia.
1) Their insistence on 1PasswordX- I want a desktop app, I want tight integration, the browser extensions work just fine if I need something quickly. 2) Poor/no support for key management- storing ssh keys as an encrypted notes is a bad work around.
Right Click on the field > Bitwarden > Autofill
Otherwise it pops up bitwarden in their top right and says it isn't available in private mode for this browser
```
The Bitwarden browser extension does not completely function in Firefox’s private browsing mode. This is a known issue specific only to Firefox. You will see a message indicating so when you try to open the Bitwarden popup window in a private window. We have discussed the problem with Mozilla, however, they seem unable to fix it so that extensions like Bitwarden can function entirely in private mode. ```
https://bitwarden.com/help/article/extension-wont-load-in-pr...
An individual raised a working PR to fix this that got reviewed and some changes were requested. The individual must have abandoned the PR or something because it hasn't moved since. I would have expected Bitwarden devs to pick this up and get it merged, and address the PR changes themselves since OP isn't addressing the issues.
I mention this because my work uses 1PW and I don't like it at all. Not the browser extension. Not the desktop app.
Bitwarden is well worth checking out.
is a very worthwhile password manager. I like the UI.
Also a 1password user. Can't deny it's a wonderful product.
It means the gp considers the problem space sensitive enough that the source should be available for inspection and modification.
The more central to your everyday life something is, the more important that is. We take this for granted elsewhere in our lives.
You buy a refrigerator, the fridge company doesn't get to tell you that too bad you're only allowed to keep soda in their $80 dedicated "Soda rack" and that little shelf is only for vegetables - you can just put your soda there anyway, and if you want you can even make or buy a gizmo that dispenses cans just the way you want, screw their $80 plastic garbage, you made one from stainless steel scrap at community college.
You can take Free Software like pass to pieces to understand how it works too.
The thing I keep coming back to is how it uses 'tr' to get random passwords, because it's so simple and yet when you step back it's obviously the correct design. The method goes like this:
Unix 'tr' has a mode where it just ignores all input except the character classes you selected which pass through. So e.g. you can say you want passwords with just A-Z0-9. Hook it up to /dev/urandom and the device spews random bytes into it. All the ones that aren't acceptable are just thrown away. Then you catch the desired length of output from 'tr' and you're done.
I've seen software attempt to try to bodge a budget of random bits into a fixed character set, which is very difficult to do safely and correctly - but 'pass' just doesn't try to do that at all, why bother when you can make as many random bytes as you want anyway?
Yeah, that's not really relevant to me... Along with ~99.5% of people out there, I will not be fucking around making customizations to my password manager. There are things you tinker with, and then there are things that hold passwords to your financial and professional life. I have not yet and will not anytime soon be rolling out my own crypto or my own password manager and trusting it with real-life credentials.
Free software can still be paid software.
You can pay a corporation to buy a product with more features or better service. But you can't pay a corporation to hold or maintain a principle. There will always be someone who can offer them more money to hold the opposing principle. Principled people who work for a corporation eventually leave and are replaced with apethetic or differently principled people.
In this case, the principle is the privacy and security of the credentials in your keyring. How much money do you think a bad actor would be willing to pay for these? How much money do you think a bad actor would be able to pay to a corporation that secures credentials for a huge number of users, and who can push arbitrary updates without pesky source code validation getting in the way? You and I don't have enough money to win this game.
Look at another high value target for comparison -- browser extensions that have a large installed userbase. Browser extensions are frequently bought for tens to hundreds of thousands of dollars by ad/tracking/malware vendors in order to quietly replace the extension with one that does their bidding, without the users' knowledge.
What's the solution to this problem? Open-source, inspectable, verifyable software that is maintained by a person or a community that shares your principles. I trust the work of Jason Donenfeld (pass, wireguard) and Raymond Hill (uBlock Origin) more than the work of any corporation selling a similar product at any price.
The incentive structure of corporations in general precludes them from being given the level of trust required for certain products.
People can certainly lose their principles, but from observing past behavior (e.g. the number of times Raymond has told moneyed interests to fuck off), I believe that certain people are capable of holding certain principles for longer than a corporation would be able to.
Secondly, these individuals and communities recognize the inherent problem with needing to trust them, so they jump through hoops to make sure that publicly available binary builds are reproducible and verifiable. They publish their open-source software in a way that doesn't require you to trust them as much as you would need to trust a corporation with a closed-source product.
Not only do many corporations not bother doing this, many corporations that maintain open source products deliver binaries that obviously have more stuff baked in than their source code would suggest. For some categories of product, like a password manager, open source with reproducible builds is table stakes, not an optional feature.
Consider the number of companies now who are promoting sustainability as a core value, because it gives them an edge up on competition in big government tenders.
More common than you'd think, especially in physical product supply!
> because it gives them an edge up on competition
That's... literally the opposite of holding a principle. They're doing a thing that they don't otherwise care about because it results in an advantage today. What happens when the money runs out? When the fad shifts? When someone offers them more money to do something that conflicts with this principle?
You hold a principle because you believe (logically, axiomatically, morally, etc.) that it is correct, regardless of all other incentives that might pull you towards or away from it.
If the only reason that someone claims to hold a principle is because you're paying them, they're not actually holding that principle.
"Free Software" has a specific (and different meaning) than Open source.
https://www.gnu.org/philosophy/free-sw.en.html
I think this is what OP meant not wanting their software to be available at no cost.
I even have a Bitwarden account and have some passwords stored on it.
I also considered "offline" managers like KeepassXC, but synchronization gets way worse, and there's also the issue about trusting someone else with your mobile apps.
I will probably end up convincing myself and keep using Bitwarden more at some point, but I will also probably do some kind of password peppering/salting along with it.
Am I really the only one here?
My secrets are stored in plain text files which are encrypted with GnuPG. Emacs (and vi too) can handle encrypted files easily, even on an Android device using the Termux (i.e. Debian) app. Syncing with rsync (even version control software is an option) works and with a bit discipline is not a major problem.
I use KeePassXC with a password and key file. I sync the database, but not the file, using Syncthing. On the whole a satisfied customer, although the browser integration isn't perfect.
Not having your password stored in a password manager doesn't make it bulletproof.
if i sound like an idiot, id love to hear why btw! heh
If they were to suddenly disappear, or I can't pay for it, I still have the local copies on my devices that I could export and move to some other system.
My biggest issue has been that I only saved passwords when I started with keepass instead of username+passwords, which lastpass all imported as secure notes instead of logins.
Password managers make security tradeoffs, providing a nice balance of convenience and defense against many of the most important attack vectors.
So while it of course possible to come up with basically endless possible attack vectors for password managers (and indeed all software), it is most likely not a productive exercise.
Also, a small tangent, but if someone compromises the play store and is able to install malicious software on your phone, there are plenty of ways for tmem to get your password that don't involve password managers.
I'd go so far as saying -- most people who think they have the discipline and skill, don't. Or rather, maybe they have it maybe for a few passwords (email, online banking, work, machine passwords).
But it's almost impossible to do well once you cross ~20 passwords. Remember trying out Goodreads years ago? Well, turns out someone's hacked into your account and is posting reviews critiquing travel books for not buying into Flat Earth Theory. You only notice when searching for your name on Google. Or even nastier scenarios.
How is an encrypted odt/txt better?
I'm using KeePassXC. Originally between three computers (Debian desktop, Debian laptop, and Microsoft laptop) where it was part of my git repo that I'd sync in between the machines as needed (git repo hosted within my own instance of gitolite, btw).
I've migrated more functionality into Syncthing - so now it's very rare that I ever need to do a manual merge within KeePassXC (which was always a robust operation anyway). KeePassXC has a setting to reload from disk if it sees that the password db file has changed, which makes this process seamless.
Part of my Syncthing setup is that I have a receive-only copy of my various repos on a Debian VM that runs a couple of archive tools (dirvish and borg) which provides for point-in-time restorations if needed.
So - I'm wondering what synchronisation problems you've had, and what you've tried. And what alternatives there are to trusting someone else's OS (replete with non-free components) on mobile, along with someone else's bundling of code into mobile packages?
There's a handful of keepass-compatible android apps, some of which are GPL, and Syncthing can keep a copy on Android easily enough, but ultimately there's a lot of trust in mobile land no matter how you slice it.
It also has yubikey support or can support other key files, which is good if you don't trust your cloud sync for example
Also, not all hopes are lost. There is a 3-year-old ticket to add trigger system to KeePassXC: https://github.com/keepassxreboot/keepassxc/issues/1016
Mobile OSes are finally making it easier for arbitrary "file" sharing between such apps. (The iOS Files app is finally "decent" for this compared to just a few years ago.)
A similar file sync option to Syncthing I like to point out is Resilio Sync, a P2P device-to-device "torrent-like" sync tool. Among other things it also supports "encrypted shares" that cannot read inside the share but can still participate as a "seed" in the torrent-like share. Resilio Sync is relatively a lot more closed/commercial than Syncthing, but it's torrent-based underpinnings make it sometimes much faster with large shares. (As with everything, trade-offs to be made based on your personal threat model.)
- Email provider's (it's not Google)
- Domain registrar's
- 3 of my main bank account passwords
- Password of my password manager and KeePass db
- Cryptomator volume's password (I keep that Volume in Dropbox)
- Password of my laptop and phone (both 12-20 char long alphanumeric ones)
- PIN of my 2FA app
(I keep practising entering these passwords on my phone/laptop regularly)
Everything else are randomly generated strings by BitWarden and saved there.
Sometimes I have some hints that only I can make sense of and save it in KeepPass database.
As the joke tells, I don't have to beat the chasing bear behind me, I only need to be faster than the guy running alongside me.
After trying out 1Password, Dashlane, etc. I returned to LastPass - contrary to most of the reviews I found online, LastPass works much more smoothly with most sites and apps. The integration with iOS is much nicer. I found the gap between LastPass and everything else was sufficiently large that it was a no brainer to switch back.
I’m still occasionally frustrated with LastPass, but having seen what the alternatives are I won’t be revisiting them for a good few years.
Electron apps are not true Linux apps, maybe for ChromeOS they can be considered as such.
Disappointing, 1Password!
Want to do a native Linux app with Web stack? Easy, do it like in the old days, start a daemon and use the local browser.
Naturally this makes it harder, because now they would need to worry about Web standards instead of ChromeOS APIs.
Either way, Electron's APIs for using native parts of the app from the web part are purely Electron's and DO NOT exist in other Chromium based products.
A better alternative in my opinion would be Bitwarden.
I suspect a typo, but could you describe the problem in more detail? I'm using KeepassXC, and while there are a few challenges around workflow, there's nothing insurmountable.
Simple as in you type a password and it is synced, instead of having to manually copy the file to each location.
Definitely not insurmountable and I used that system for a while as well, but something like Bitwarden, which I now use, is just easier.
I guess for most of us on HN the big delineation is -- can you sync your password store easily (and exclusively) to your own systems, vs can you sync easily with a remote managed service.
I'm very much in the camp that eschews the latter.
As per my comment elsewhere in this thread, I've got a reasonably robust arrangement using a combination of Syncthing and KeePassXC, which so far has worked well for me.
https://apps.apple.com/us/app/strongbox-password-safe/id8972...
I'd be curious is someone could explain why it would be worth the effort to transition from LastPass to some other provider.
It was that plus experiencing a lot of bugginess in their apps that got me to switch to 1Password. It's been a huge improvement.
EDIT: I was wrong about 1Password 7 for Windows and macOS, see further replies.
This topic inevitably comes up on every HN 1Password thread.
I don't care how many arguments they bring to the table that the subscription model is superior, the things that matter are still "broken" in the subscription model: Control over my data and "cost control".
With a standalone license i can control where i store my sensitive information, and don't have to rely on 1Password doing the "right thing" and protect their servers.
I can also choose if i want to upgrade, or if the current version is good enough for my needs. I will never pay a subscription for any software.
https://support.1password.com/cs/migrate-standalone/
(note the text near the end regarding licensing)
The 1Password macOS and Windows clients can be bought stand-alone, but their newer clients (such as the command-line client, for some reason) are subscription-only. It's confusing, and it looks like this Linux client is also subscription-only.
The GPG keys are externally held.
Yes you can. Some YubiKeys support NFC (not sure if that works on iOS though), but also you can use USB-A <-> USB-C converter, USB-A <-> microUSB converter, or just a USB-C or lightning YubiKey, or convert to lightning I guess.
Maybe 1password offers UI to organizations. But for individuals and small groups, it seems to offer fees and less provable security.
Bitwarden_rs can achieve the same.
However, this has been _years_, 8 or 9 by my quick check on the App Store.
First there was the "agilekeychain" and the python libraries (blimey) to read from it, so I could kinda do my thing on linux, but then it was deprecated and they spent 18months trying to create a CLI variant that on arrival basically never worked.
Then they pushed a subscription model which was rather expensive for the functionality too, and after paying for new versions a few times I felt a bit annoyed, and I still could not access my passwords from Linux anyway..
Then they pushed really hard for their own hosted sync (for new vaults at the very least); And without dropbox I couldn't even sync to linux. I'm not sure if they went back on that.
Eitherway, the problem is not that it isn't open source per-say.
The problem is that it's an incredibly closed ecosystem as it exists today, and an expensive one- maybe you're better off looking at equivalently featured, free, and more open options... of which there are many.
With 1Password all my credentials are on all my devices, always up to date. It integrates with the password management APIs on iOS so I can create an account on a computer and log in using this same service's app on my phone seconds later and the password will already be there, I just have to stare at the device for a second and I'm logged in.
It's all incredibly seamless and I can't imagine having to go back to managing passwords manually.
Hearing about people using 1password, etc, I get an uncomfortable smug feeling, similar to when i hear that someone is coding on notepad.exe :(
None of these saas companies ever price single user licenses below $5, even though $1 or $2 would be much more reasonable.
1pw can count the average users bandwidth in kilobytes per month. And while the software is refined, it’s about 1/1000th the complexity and infrastructure of Netflix or Spotify.
If it was something unimportant, like a game, ok. But a password manager? The key to all your digital life and secrets...
And in addition from an American company that will upload your (encrypted) passwords to a cloud in US?
And in addition, I find it deceptive that they try to confuse the potential users by pretending to be somehow involved or concerned by open source.
See this exchange for example:
https://www.reddit.com/r/privacy/comments/7l75d5/comment/drm...
<<We're not open-source, but we do act like it!>> Wtf?
Please don't overstate the intelligence required to use linux. It's not that high.
> ...and still use a proprietary closed source "password manager" on it.
People run plenty of proprietary closed source software on linux. This can include password managers, because perhaps they prefer it. Also a password manager of all things is something most people will need to use cross platform, not solely on linux.
> If it was something unimportant, like a game, ok. But a password manager? The key to all your digital life and secrets...
Games being another proprietary closed source application people run on linux. Games still present meaningful risks to your computing and privacy.
> And in addition from an American company that will upload your (encrypted) passwords to a cloud in US?
AgileBits is a Canadian company.
> And in addition, I find it deceptive that they try to confuse the potential users by pretending to be somehow involved or concerned by open source.
A company can be involved and concerned with regards to open source without releasing a product that is open source. Microsoft releases and contributes to a lot of open source software but Windows and Office are both closed source.
This can be something like password store, or keepass, where the attacker needs both your password database unlock key / gpg passphrase, but also needs access to the database / gpg keys, which means either physical access, or at least access to your local files.
I think there is some merit to pointing this out. If 1password allows anyone to make login attempts against their service, that means some bored teenager with a botnet can make attempts at your password.
I use password-store, and I could tell you my gpg passphrase right now, but you still couldn't access any of my passwords. You'd need to get access to my yubikey and my psasword repository before you could do anything with that passphrase at all.
I think it's true that a setup like mine, which requires a physical hardware token to decrypt my passwords, is more secure than a password service, however I also think the parent comment is totally wrong. 1password without a hw token isn't the most secure option, but it's way better than password reuse on random sites.
They would need to guess both your master password and your 128 bit secret key.
They compared passwords as a service to reusing a single password and said it was the same, which IMO is foolish.
Let's look at one possible attack: the attacker knows all my passwords, and they manage to steal my laptop from my car. What can they do in each scenario?
In the case of lastpass, bitwarden, or keepass, the attacker now has all my passwords. The 2fa token was used once in the past, so all the passwords are stored on the device, protected only by a password at most.
In the case of password-store with my gpg-private-key on the yubikey, the attacker still can't decrypt anything unless they also stole my yubikey, which I never leave unattended.
The fact that my private key on my yubikey isn't just required to sync or login (like it is for the 2fa case), but is rather where the actual decryption is done every single time I access a password, does have a difference.
I don't think the difference is very large though, no.
The secret key can be kept save, because it is only required once for each device, when you log in the first time.
If you re-use the same password for all sites, it takes just one sketchy site being compromised for all of your other sites to become compromised. In the case of a password manager, the manager itself is the one that needs to be compromised, and you have more reason to trust them to avoid being compromised than some other random site. Some random sketchy website being hacked doesn't need to effect the rest of your network of logins if you use a manager.
Most password managers (such as 1password) won't let anyone from any machine access your stored passwords over the web by just supplying your single password. They require multiple extra steps that are quite limiting, so for the most part they first need access to a computer that you've already installed your password manager on.
Furthermore, if your password manager is compromised, you have a very clear path to your password on that manager, and then a list of all the websites, usernames and passwords that you need to change in order to regain secruity. By contrast, I'm still rediscovering old websites I used 10 years ago that used my old omni-password which was compromised.
With the information you've provided (i.e. none), it really just looks like an uninformed opinion.
Why do you think the points I listed above don't make password managers more secure than password reuse?
Using a password manager as a service is my point of contention.
Even if stand alone app vendor goes away, the app still works. There are things that I see are okay as a monthly service like Netflix or other content provider where the content is literally changing month to month.
Stand alone software that rarely changes, like 1Pass, does not warrant a monthly service fee from me. I am self-hosting the content, so I don't need their cloud services.
I'd gladly move to self-hosting if it was only me. But after a few months, I was able to convince my wife to use it for convenience and security. So if there's an issue with the self-hosted version, it wouldn't just be me impacted, but my wife. And that's an SLA you don't wanna break. :D
Also, while I know I could probably do a decent job securing the hosting server, I would rather not have that on my mind. That's not my day-job, so I'll leave it to a team of people who are paid to do that.
Lastly, the service fee is $60/yr, but for sake of argument, lets call it $100. That's 2hrs of my time at my hourly pay. If setting up a self-hosted version takes me more than 2hrs to get it running, it's not worth my time.
I'm 1000% behind them existing and am planning to toss them a donation cause I like that these FOSS alternatives exist, but I'd rather not have to manage my own in the end.
I've gotten past the stage of wanting to do it all on my own and hit the point where I'd rather pay a company to do it so I can go about the things I want to do in my free time (hobbies and spending time with my kids). I know it means I'm potentially trading privacy for this convenience, but it's something I've accepted in this case.
My new campaign is convince the spouse that we should move away from free email into paid.
Hacking aside... these are many ways in which it can go wrong:
- There can be an outage and you get locked out of your keys. You can have a connectivity issue to the service.
- The service can be discontinued or they could randomly terminate your account based on some automated system decision by mistake, sometimes with no right to appeal...
- They can change leadership and start mismanaging the service, or start selling your data like the services you use and such.
- They can start cutting corners and rushing unsafe things live.
- They can offshore all their development and reboot the team somewhere cheaper, at the expense of introducing defects during the transition.
- They can be ordered by a government to have a backdoor.
- There can be disgruntled employees, infiltrators, bad hires, malicious employees, etc...
And finally, they're a famous service that is known to have the keys to many other systems. This makes it very lucrative for a black hat to attempt to hack them. Even smart, dedicated people are not safe from 0day vulnerabilities that nobody know they exist.
Many things can go wrong. And what happens when they do? you can get locked out of essential services you need, or someone can ruin your life, force you to pay a ransom or even make you homeless if they wanted to.
Then, there are other aspects I don't like much. You can set a secure password, but then your browser will ask you to remember it. Some services allow you to skip MFA in a trusted computer... so then all your stuff is simply behind physical access to one of the trusted devices.
I don't know, it just doesn't feel right to me.
And by the way: I started by saying it's an opinion. It's an unpopular, provocative opinion, but I was honest enough to communicate it was indeed an opinion. I did not say it was a fact. Opinions are subjective, facts are not.
As far as the other concerns, I'd say these concerns are all present in the 'single password re-use' strategy as well, except instead of choosing one single company to trust over your stuff, you now have to trust every single website you log into to safeguard your passwords, lest a malicious actor gets access to everything.
I agree there are downsides to services, but I disagree very strongly that the situation with services are no better than just re-using a password.
Even if that layer is composed of a password and MFA, it is still one layer.
And by using a SaaS password manager you would have also done another part of the job on behalf of the adversary: enumerate what they have access to.
If you are VIP, persistent adversaries will find a way somehow.
Also: What is, in that case, the proper solution ordinary people should follow?
And speaking as someone that operates a website accepting passwords, this happens more than you'd think. There are hackers that actively try leaked lists of username / passwords against websites using botnets. If your password is leaked by one website, people will attempt to reuse it on other websites.
Your phone company will believe any random person to be you.
Not all factors are secure.
MFA does not imply bulletproof security.
[1]: https://support.1password.com/two-factor-authentication/
...oh wait, that's literally a password manager. Sometimes opinions are unpopular for good reasons.
Master password alone won't unlock the rest of passwords.
Edit: I checked: neither the macOS nor Windows version uses it. So it's not even that they think Electron is acceptable for high-quality desktop apps. They just don't consider Linux important enough to make a high-quality app for it.