1Password Secrets Automation
blog.1password.com
blog.1password.com
I still think 1Password is the best option for most people. I specifically want my non-technical family and friends to use password managers too as long as its necessary, and having some multiperson capability is also key to that. I can't say though that I feel like the move to subs has been a huge win in terms of development.
Granted, I'm a little down on the whole field which colors things a bit. Ultimately underlying my feelings is a touch of bitterness that their entire industry even exists. Passwords and password managers are mostly recreating public key auth really, really badly and it stinks. Passwords and other symmetric tokens by definition should never be shared. A website being hacked should never affect me in the slightest, in the same way that me getting hacked doesn't somehow suddenly mean attackers now own Debian/Apple/FreeBSD/Microsoft. Everywhere should just have public keys. We've had the tech for decades and sufficient crypto speed on client systems since at least AES-NI. What's been missing has been glue and effort. It's frustrating every time a hack happens. We shouldn't have to care! Sigh.
My pet peeve at the moment is this[1], where they removed a feature I very much like (TouchID in the standalone browser extension) and still have yet to replace that functionality despite many promises that it is just around the corner. It was removed in August 2020.
Definitely feel like they've lost sight of why people chose them in the first place, and stuff like this is certainly not helping assuage my concerns.
[1] https://1password.community/discussion/115228/temporarily-re...
With a recent release[2] of 1Password for Linux and the 1Password extension, the two can now communicate. Allowing you to use biometrics to unlock the extension and keep it unlocked throughout your browsing sessions.
While this news doesn't unlock this ability right away for yourself (because referencing TouchID I assume means you're a Mac friend). We will be continuing to rollout over the coming months to Windows and Mac.
[1] https://1password.community/discussion/comment/591579/#Comme...
[2] https://1password.community/discussion/119609/1password-for-...
But with subscriptions it gets inverted. Now for the customer failure to keep paying means losing existing functionality and/or having to expend additional resources (money and time) actively moving to something else. So rather then needing to be convinced to give the company more money, it's more that they need to be convinced not to.
There's a real difference between "a customer base that is very happy" and "a customer base that is merely not irritated enough yet to overcome the inherent energy hump and go looking for a new local minima" and I worry the subscription business model makes that easier to ignore. Not that companies can't in principle find out in other ways! They can do detailed customer polling and so on. But that requires active effort and expense by the company so the temptation will always be to ignore it and follow inertia. This doesn't require the slightest bit of active malice, just a break in feedback loops resulting in drift as a company starts pursuing things from its own tunnel vision. They then look and see the money keep pouring in, so what's the problem? The threat eventually becomes that if the energy barrier is overcome and the stampede begins it's too late. It's a shame to see happen to companies I really really like and have great visions that could be even better.
Granted in 1Pssword case, their classic app would not have stopped working without upgrades. And to my knowledge it should also still work? I have since switched to the subscription model but I have used the old paid app years after they have switched models.
honestly i think these things are more about lock-in or perceived lock-in, or simply not wanting to waste precious time. even though it's actually fairly easy to jump between password managers, it's still a "migration" or another task where when one's time becomes scarce the thrill of a sundry task like redoing one's passwords is overshadowed by the laundry list of things one could do with their time instead. sure, it's nice to tend the garden, but how many other things would you rather spend an afternoon on that either develop skills, enhance life or recreate in one way or another.
[1] https://1password.community/discussion/comment/591579/#Comme...
A it more than a year ago we had
- 1Password for Mac and iOS written in Objective-C and Swift - 1Password for Android, written in Java - 1Password for Windows, written in C# - 1Password CLI, written in Go - 1Password web-app, in Typescript - Browser extension in Typescript
Introducing new features was an ever more difficult task. Even getting the behavior of things like password strength meters or generators behaving the same across these platforms was increasingly difficult. (Hint, they didn’t behave the same.)
So we have been taking the time to develop a common core of code that can be used everywhere. And this does take time. Writing the common modules is often relatively easy, but we have to get them to work with the platform specific code
Late 2019 was our first successful deployment of any such function, and that was the TOTP calculator. It was largely transparent to users, except for settling on which sorts of TOTP “quirks” we were going to follow. (TOTP standards are a mess, and different Authenticator apps deal with special cases differently. At least 1Password is now fully consistent with itself)
Over the past year, we’ve been plugging more such things into the apps. And it allows us to fix bugs more quickly as well ashen they are in the common code.
1Paaword for Linux is built on all the new/common code. So while it doesn’t have everything that the others do, it is also where you will see the née stuff that is coming.
This has been a huge effort, and the transition has some rough spots, but once we get there we will be able to move much more quickly in developing and refining features and behaviors.
Reading between the lines a bit - biometric authentication was deprecated (from ‘for Mac’) as it was broken or at risk of breaking, and further dev on legacy code was moot due to the transition?
- Ben, 1Password
I prefer the above classic extensions for switching between Chrome, Safari, Firefox and Edge all day and not having to sign in more than once. Plus the better desktop app integration, including the ability to opt-out of cloud storage of passwords.
I consider it a victory if I can get non-techies to use their browser's facilities to store passwords, and then to choose reasonably long passwords and avoid reuse.
(I use `pass`, myself.)
Storing 2FA tokens is one thing iCloud Keychain cannot do (yet ?), and it’s the primary reason I use 1Password over iCloud Keychain.
That being said, with Big Sur, 1Password changed its default behavior from being unintrusive to literally obscuring input fields with big “unlock 1Password” pop up’s.
I’m currently evaluating using either Password-store or Bitwarden with bitwarden_rs as a backend as I really don’t want my logins synchronized anywhere I don’t control.
That's not a Big Sur thing, that's a 1Password thing (I've not upgraded to Big Sur still).
Hope because it would allow me to utilize my mac as a Yubikey. I have no idea how they would synchronize it to all Apple devices, but i'm fairly certain they will find a way.
Fear because it will pretty much guarantee i cannot use my password manager on other platforms.
I already use Secretive (https://github.com/maxgoedjen/secretive) to store SSH keys in the secure enclave with touch id integration, and it works really well. I also keep a couple of Yubikeys as backup :)
The value prop if you're 100% on-Apple, and OK with this fact, is hard to challenge. If you have some non-apple devices that need passwords, that's where having a third-party password service makes sense.
FWIW, I use `pass`, as a mostly-Apple person who also owns a few linux devices and occasionally requires passwords while `ssh`'d into servers.
there are commercial entities today that i don't have to trust, but will help me set up multiparty signatures for sending bitcoin transactions. i could see a similar mechanism being used for creating/revoking/recovering a compromised identity.
hierarchical deterministic wallets seem a decent blueprint for identity. if i can generate arbitrary pubkeys from a single seed, then i maintain my privacy across providers i use my identity with.
i used to think that the blockchain itself could make for a decent revocation list, but i don't think that's even neccessary. maybe it's simply time for governments to grow up and accept that the internet is critical now and as such provide basic digital identity services as they do with travel documents today. it doesn't have to be perfect, just publish revocations on behalf of citizens.
The latest version is a mess on Big Sur, with unlock fields obscuring input fields, conflicting with Apples iCloud Keychain, and just not working like I expect it to.
Furthermore, stand-alone versions are buried deeper and deeper behind a cloud service subscription that brings me absolutely no value over what i already have, and adds the uncertainty of having to synchronize my most secret secrets to a cloud service.
While I can certainly forgive software errors, this has been going on for so long that I’m beginning to suspect it’s either a strangler pattern to get people to switch to the cloud solution, or it’s death by a thousand cuts.
In any case, I’ve begun evaluating alternatives. Bitwarden looks promising (though nowhere as polished), is open source, and allows me to synchronize to a service on my LAN.
Password-store uses gpg and git that also allows me to synchronize locally (though it leaks website names without the vault extension which is not supported on iOS).
Finally I’m evaluating Yubico authenticator for 2FA codes and just using iCloud Keychain for the rest.
The only way to even download the app is if you already knew about it's existence before. It's not a dark pattern, it's just directing people who sign up for 1Password today into their actually supported product instead of the end-of-lifed one. Your app will continue to work for some reasonable amount of time until some version of macOS breaks it, then you can either pick another one from numerous competitors or go with their hosted version. Sounds to me like you'll need look into the alternatives given your requirements. It is what it is, no need to attribute it to malice.
Some of it is not 1Password’s fault (macOS shoves everyone to new versions with new application APIs), but not only do I now pay more for 1Password by having to use the subscription instead of a one-time purchase that could last years, but I’m now nervous about having all my eggs in one cloud basket, so to speak, and more nervous the more the cracks I see in the 1Password UI.
Source: have also been with 1Password since v3.
I’ve never used 1Pass. Just, I’m always amazed by how well Bitwarden works and how there’s not really features I’m lacking.
1. The ability to customize keybindings.
2. If try to autofill a form field, and BW is locked, then nothing happens. The same task in 1P will actually prompt me to unlock 1P, then I am able to autofill the field.
3. If create an account for a site not saved in BW, and BW is locked, then I am not prompted to save the login. However, 1P will prompt to unlock itself so that I may save the login. Also, the prompt for saving logins rarely works for me using BW, but worked rather well for me using 1P.
4. BW is not as keen as 1P for auto-filling various form fields
5. I like storing software licenses, wi-fi passwords, bank accounts, etc. in 1P vs. secure notes in BW.
6. I am not a fan of BW's folders for organizing logins.
7. BW relies too heavily on mouse usage for my liking. I felt that 1P had much better keyboard navigation.
There are probably other things I am missing, but with all that being said, I still have not left BW to return to 1P nor do I plan to anytime soon. Though, I will admit I miss many features from 1P still.
1. One shortcut for unlocking and auto filling. There is a long open issue[1].
2. Not needing to unlock the extension to add a new login entry. 1Password just detects new logins even when the vault is locked.
Otherwise Bitwarden is really solid.
[1] https://community.bitwarden.com/t/autofill-shortcut-should-o...
That might be iCloud, OneDrive, WebDAV, S3, or simply just a SMB server on my local network. My main negative point about Bitwarden is that it either requires me to store passwords in a cloud on a subscription service, or it requires me to selfhost something.
Selfhosting is (probably) fine if we're talking a Plex server or something that isn't mission critical, but hosting a bitwarden server suddenly requires me to be a sysadm in my spare time, something i'd rather keep to my daytime job (and nights when operations calls, and weekends when things needs upgrading).
The only password manager i've found that ticks most boxes is password-store (https://www.passwordstore.org/), but it lacks in browser integration, and by default leaks web addresses for the stored secrets. Other than that it works well. It's self contained, and uses git for synchronization, meaning i can be "on the go", add a password, and synchronize it to a local git service on my LAN when i get back home, or in case i need it on another platform _now_, i can connect through VPN and synchronize.
Currently we end up using the secret managers available in AWS or GCP, which seems pretty half baked. In GCP, for example, secrets are stored at a project level. It's not unusual to have certain secrets that are needed by more than one project, which means they get duplicated. The granularity also prevents me from controlling which secrets are visible to a given user.
I'd love to have one centralized source of truth for all infrastructure secrets.
It's good to have independent competition in this space.
1Password is not competing with Vault. In fact we have very good relationships and mutual respect with HashiCorp on many levels.
Also Secret automation integrates (acts as a provider) with HC Vault[1]
1. https://github.com/1Password/vault-plugin-secrets-onepasswor...
The name is quite a mouthful, but we have found the service to be awesome. We have a small Python script that loads a script with environment variable definitions from the Parameter Store and we use that as an EnvFile for our systemd services.
What do you mean by this? Each secret has a "Permissions" tab which allows you to grant access to individual IAM users.
BTW: don’t forget to empty trust in 1P. Noticed the API giving back a lot more stuff than expected and that is why.
Their messaging has been inconsistent, saying the browser will integrate with the native client. But then also that the browser only version is the future of the product.
This says nothing of the performance and UI problems the product has faced. Recently it was so bad the company was telling people to use the beta version.
I bought the legacy versions and switched to subscription last year.
In reality, the macOS and iOS clients work fine. I have a dozen friends and family members using the product with no complains on those platforms. I surely haven't seen any performance or UI problems that aren't worse on different services. Sure, there is some current confusion between the use of the 1Password X and classical browser extensions, but it's hardly "a mess."
The MacOS native / extension interaction and choice is a mess.
From a UX perspective, the single most important thing the product can do is interact with the browser effectively. Embedded in this "feature" is that the product is stable, and responsive in behavior.
If you go to the chrome web store, 1password extension page and sort by recently updated, you'll see review after review of 1-3 star, carefully explained problems with this product.
https://chrome.google.com/webstore/detail/1password-%E2%80%9...
Regarding inconsistent messaging, their support is promising they're working on native app integration but there is no timeline for this.
That's why this news is kind of a bummer. The product that I'm subscribed to is competing with this new product for resources.
- Ben, 1Password
It's really hard for me to understand how you can have an otherwise great product but are failing at what I would argue is one out of the two most important features (creating logins and autofilling).
I've cancelled my subscription and won't renew once it runs out.
1) Extension button > Generate Password > Save & Copy 2) After creating account, extension button again > select entry > Edit 3) Click Save in opened modal 4) Click Convert to Login in opened modal 5) Click Edit in opened modal 6) Manually type in the username/email you used on the site 7) Click Save in opened modal 8) Close the modal
And this (generating and storing passwords for new accounts) is the main workflow of the product!
First of all, we have a new "Generator History" section, which contains passwords created by the generator. These are always available if you need them, but don't show up alongside other items, so are less important to clean up.
We've also been working on a brand new saving experience which is currently in beta. If we miss a field from the page, you can add it before you save. You can also add tags, and when updating items, see a side by side diff of the changes. There's a screenshot here if you're curious: https://twitter.com/oliverdunk_/status/1382302050369875969?s...
It sounds like you have a subscription so if you haven't already, I'd encourage you to give the new extension a try. I totally understand that native app integration might be a requirement for you there, and I'm sorry that it felt like you were getting mixed messaging. Really both things are true - we don't have a timeline for this, since it's a big bit of work and we want to get it right. Support are absolutely correct too though - we're actively working on this, and the integration with 1Password for Linux's beta is the first step, with support for other operating systems very much on our mind.
- Oliver, 1Password
Is Hashicorp vault "better"? Probably. However for groups that don't have the time and resources for Vault, this is a great first step. Much better than what most do which is no proper secret storage.
The op cli is alright but having to re-unlock it every 30 minutes (plus I'm shell dumb so my session is nuked every new tab I open) means there's quite a lot of friction compared to the desktop version where I just double tap the side button on my Apple watch
I wonder if this could be a potential alternative in some roundabout way
---
Somewhat unrelated rant
I like 1Password and after having tried a whirlwind of password managers, it's still the most seamless (plus having templates for things like cards, licenses and so on is useful)
I don't even mind paying the relatively small subscription fee.
That said, in the same sense that you generally know you've resigned months before you write the letter, I still remember there was a forum thread where one of the employees was seemingly user hostile.
On second thought, I don't even remember what it was about but I remember the feeling of slight frustration. Not in the entitled sense but the sense that there didn't feel like an attempt to understand the concern from the other side.
Very vague but does anyone perhaps know what this event was again? I want to say, something about supporting local vaults? I dunno, that isn't even something I was concerned about.
Some companies have created 'competitors', but they aren't even remotely mature (google secrets manager, aws secret manager, etc)
Also Secret automation integrates (acts as a provider) with HC Vault[0]
0: https://github.com/1Password/vault-plugin-secrets-onepasswor...
The founder of Envkey claimed they were working hard on V2 and self hosting 1.5 years ago[0] so it’s anyone’s guess as to why that’s been delayed/isn’t happening.
This is particularly interesting to me. Is there a good doc page or blog post that you're aware of that covers these capabilities? I'm curious and would love to learn more.
There were a bunch of other smaller nitpicks, but that was the overwhelming reason last time I looked at it.
E.g. in AWS you can specify the source CIDR range in an IAM policy.
- [0] http://blog.lastpass.com/2014/12/introducing-auto-password-c...
- Why does the integration require two servers with exposed ports? The REST API documentation doesn't say which service I need to connect to for the resources, so I assume the answer is the API server, so what does the other server listen for?
- How do I request a TOTP? In particular, am I correct in my assumption that the implementation is simply providing you with the TOTP seed values, rather than a TOTP?
- Is there any audit logging whatsoever?
> - Why does the integration require two servers with exposed ports? The REST API documentation doesn't say which service I need to connect to for the resources, so I assume the answer is the API server, so what does the other server listen for?
The server you'd interact with is the API server. The other server is responsible for syncing. The fact that there are two was a design decision.
> - How do I request a TOTP? In particular, am I correct in my assumption that the implementation is simply providing you with the TOTP seed values, rather than a TOTP?
I don't believe we can provide the current OTP value as it stands. This is something I'd be happy to suggest to the team that we look at for a future iteration.
> - Is there any audit logging whatsoever?
Yes! You can either audit from the container directly, or through the item usage report in the 1Password.com web app.
If you need further assistance please feel free to reach out to us. We'd be happy to help. https://support.1password.com/contact/
- Ben, 1Password
- Ben, 1Password
Also this component can run on premise
- Ben, 1Password
Why are people mostly commenting moaning about something completely different to what the article is about? Fine, I get it, you don’t like 1Password’s tactics regarding subscription models. But this is about infrastructure secret management. It’s the same with Google Cloud announcements “hOw LoNg UnTiL tHeY dEprEcAtE iT???” ... boooooooring
Note that we've both commented on something different from the article in this case.
I do like using 1Password, it does make life a bit easier, and I’m grateful for its existence.
I think this is an interesting offering and will take it for a spin soon!
Secrets management for network systems has been an issue since before kerberos. Having different models, isolating secrets from the repo and deployment codebase into a 3rd party module is one of the rational choices.
I would want to understand a secure secret import and export model, much as for an HSM you want to know how to move shrouded keys (if its not in FIPS mode i guess)
I’m happy to just have another offering in the world of secrets management
It works great to have both enabled on iPhone/iPad however. No idea why they can't fix the overlapping fields in Safari.
https://1password.community/discussion/116898/in-big-sur-saf...
This is why I prefer to give my password to a company like Bitwarden and 1Password. At least, they have less incentive to be malicious than random dude on the store.
Perhaps time is more important for reputation than being incorporated?
But with 1Password, I'm paying $55 per annum for 5 licenses for a product that works exceptionally well. Convenience and security here is absolutely important.
And if it means I can throw a license at my girlfriend who previously had a similar password between banking and her wifi and everything in between. And I can set her up, eat $1 a month on her behalf and EASILY onboard her vs. a stand alone license which is not convenient. You can count me as a happy subscriber. 1Password's pricing is great, and I get an awesome product in return.
I don't get the blind "all SaaS products suck and are dark patterns" vitriol that we see on HN so often.
1Password originally operated on a licensing model, but has since switched to a membership model.
It is still possible to purchase a single license, but they make it very difficult to do so. The option of a standalone license is not mentioned anywhere on their pricing page: https://1password.com/sign-up/
As I understand it, only once you have downloaded the app and are logging in do they mention that standalone licenses are available. (But, at least on Mac, this option is only available on the version of the app downloaded directly from their site, and not the version downloaded from the Mac App Store.) This support thread shows some users' frustration with this, and their support team's insistence on pushing users to the subscription model: https://1password.community/discussion/102412/where-do-i-buy...
I'm not entirely certain of the differences between the subscription model and the standalone version, but I believe the primary difference is that the subscription model will automatically sync your passwords between multiple devices.
You can achieve similar functionality with the standalone license version by storing your vault (1Password's password file) in iCloud or Dropbox, and relying on that for syncing. I use the Dropbox version and it works incredibly well, even on iOS! I think they also support Google Drive for syncing on desktop, but not on mobile. Certainly the syncing offered through their subscription model is valuable, but for users who have other options, it's just doesn't make sense.
I gladly paid for a standalone license, and have purchased licenses for my parents as gifts; the product is incredible. The Chrome extension works great, and the app can be your 2FA device, so it will automatically fill in password forms and copy the 2FA code to your clipboard. It works just as well on iOS too.
We always built 1Password for ourselves. It is so much easier to develop a product that you use yourself every day.
I haven't used the standalone version of 1Password for over 5 years now. The same is true for pretty much everyone working at 1Password.
Why? Because the service is much much better and more than just simple syncing of data:
- Account recovery for family and business team members
- Easy sharing of passwords and documents
- Vault permissions
- Item history/automatic backups
- Free family accounts for businesses
- Travel mode
None of these features are possible without a server doing its part.
Roustem Founder of 1Password
I'm not overjoyed at "having to" pay a subscription for a password manager, but your points are good ones.
Paying you annually saves me and my family (four people) a lot of time and energy in managing passwords, sharing passwords, etc.
Just wanted to throw out one "+1" for the 1Password subscription offering being a worthwhile expense from my perspective.
I do wish you'd figure out the Chrome extensions on macOS, though. I don't understand why I have to choose between excellent browser integration OR more seamless integration with the native app and fingerprint support in the browser extension.
We're efforting on that! Thanks for the feedback. We currently have better integration with our 1Password for Linux beta, and that will be rolling out to other platforms as well.
- Ben, 1Password
I use 1Password for family and LastPass for work, and vastly prefer 1Password's UI and feature set.
I pay yearly for a subscription and sync via 1Password.com
I don’t pay a subscription because I think that it’s important or necessary to sync via 1Password.com, though. I’d happily sync via Dropbox (though it sounds like that has been broken for years and isn’t getting fixed) or iCloud.
I pay because I know it costs money to keep software working nicely with its surrounding environment and to keep it secure.
Apart from the item history - which I disagree needs a server - the other feature you list aren’t of interest to me. So while I’m a big fan of the product, and I might be an outlier, I hope you’re keeping a keen eye on your users’ motivations for starting or continuing to pay for subscriptions.
I've been using 1Password for my personal accounts for probably close to 10 years and have been happy with it. There are some things I feel are clunky, but I've never felt like I was being tricked or deceived by the company.
If you really want to complain... complain about how they keep pushing for their subscription, making it harder and harder to find a one time purchase.
Or their massive issues with multiple browser extensions that are a complete mess for the average person.
Or how their usability has decreased substantially.
Or how they're less a consumer product and more a business product these days.
As far as I remember, I've paid for several versions and upgrades until they forced their crappy subscription service on us.
Not sure about OP but I can see a clearly dark pattern by hiding the non subscription option to the point where I had to google how to acquire one. At this point I simply gave up and choose other option.
If I have to pay yearly at least bitwarden gives me fair price and comparable service. Maybe 1pass is better than bitwarden but it's certainly not 4x better.
You can still get stand-alone licenses, but they do suppress that. Part of that I believe is not running afoul of App Store rules, and also because most people are finding it via the iOS and Mac app stores.
I'm still using standalone licenses quite happily, and have no issue with buying new licenses when major versions get bumped.
I'd never heard of 1Password before they were fully SaaS, but as I understand it, some of the original users were pretty upset with this move. Either way, I used to be a 1Password customer, and their product, at least on the Mac, was the most polished password manager.
They finally fixed many of the objections with the "family" SaaS subscription and it just works and the price may be "low enough" that I don't bother figuring out a way out of it - but it is still pretty much the perfect example of "locked in".
I switched to Bitwarden because it's open source, and because they have a good enough Linux client. Their browser extension and desktop client doesn't come close to what 1Password provided on Mac, but it does the job.
Bitwarden isn't without its issues, but at $10 a year, and its open source nature, it's worth every penny and then some.
https://blog.1password.com/1password-for-linux-beta-is-now-o...
I hope you can give us another chance.
—Dave 1Password Founder
My kids have started accumulating more passwords than they can memorize (and their memorized passwords were terrible), so I wanted a family password manager. I considered using "1password for familes" which I have access to for free from my day job, but if/when I leave the company then I'll have to go back to paying for it. So far I greatly prefer the experience of bitwarden over 1password. I use the web vault, the native mac app, and the linux command line app (through a janky homegrown dmenu/xclip shell script), and I have no complaints at all.
Even moving from one-time to subscription isn't a 'dark pattern', its a business model move to shift to recurring revenue, which we know is something that businesses need to keep the lights on. You can debate the merits of it, but it's not a dark pattern in and of itself. HOW they execute that might be, but the change itself isn't. You just have a personal preference to not want to pay for it in a particular way.
Family plans are in my eyes. They log users more into the platform and makes it very difficult to switch. If you want to move away from Spotify, you now have to convince enough of the others to make it feasible.
> Even moving from one-time to subscription isn't a 'dark pattern'
I did not claim that it was one. I also was not even mad about recurring payments, to me the problematic change was that the data was now hosted on some other machine owned by the company who is producing the software (e.g. in theory single point of entry).
As far as where data is stored, which sounds a bit like a different argument, I guess what you're advocating for is some kind of peer-to-peer sync solution across family member devices that would work anywhere. That's cool but I think it may a lot of technical complexity vs a cloud solution, and it still doesn't change the fact that you still have the issue above about switching as a group.
It might be worth reviewing what dark pattern actually means - UI tricks to get people to do things they don't want to do. If people like a product enough that they convince others to use it as well, that's ... a good product? I get the data storage concern though.
A slight gentle correction. I criticize them elsewhere in this thread, but in fairness I have to point out that this isn't quite correct yet. It's still possible (though they've buried it) to buy a standalone perpetual license for the latest 1Password, run purely local vaults, or keep syncing via Dropbox, iCloud, or manually over WLAN. There isn't any hard tie to the 1Password.com service yet.
Perhaps they'll put the kibosh on that in the future. And they can be and I will criticize them for not having better local sync options, which they clearly stopped bothering with in favor of their own cloud offering. But for the time being I've still got a fully local 1Password 7 license that works the same as every previous version.
Now you're forced to buy the new version just for the integration that has always worked fine.
In my opinion, it's not a dark pattern, it's just softly winding down the old app. That's not an unreasonable thing to do. If you want a traditional app, there are other choices.