`But we don’t just want to keep up; our goal is to push the envelope and explore beyond the boundaries of traditional password management.`
Hmmm, sounds like the time to migrate may be sooner than I'd hoped.
Hmmm, sounds like the time to migrate may be sooner than I'd hoped.
Whatever the case may be, I'm sure it's going to turn out to be something completely worthless to me.
Fortunately, there's always Keepass, which keeps plugging away doing exactly what it says on the tin.
You're probably right. Here's their vision of the future: https://www.future.1password.com/
It screams CORPORATE. Not a single mention of family or single user. It's all about business security, safely sharing data, protecting your company, etc.
Sure, they could mess it up, but any company or open source project can mess everything up.
One of the things I like about Apple is they don't really pander to the enterprise. They won't turn the business away but you can see it isn't a priority.
Almost everything Apple makes, "Pro" name aside, is either an enterprise offering where they're ok if random consumers buy it, or a consumer item where they don't mind if enterprises buy it. I have no interest in buying a reference monitor that costs more than my last 4 computers put together, but I could just go buy one, I guess.
Optimally, 1Password does the same thing. If companies want to buy their current offering (and my current employer does) that thusfar hasn't really messed with my personal use. If they come out with some Okta competitor in the future, I won't need to care about that either unless my company uses it. Optimistically, both products can be targeted to different markets.
Look at the lengths Microsoft goes to in order to maintain backwards compatibility for their enterprise customers, Apple in comparison just doesn't care.
Obviously I don't have access to the sales figures but my guess is most Mac Pros are going into audio/visual studios or else high net worth individuals. It's not the sort of thing enterprises will buy if they can avoid it.
The problem comes in when you try to cripple the home version so that small businesses, etc don't just use that.
Luckiky when they do, github just bans their account
Except they have already started to diminish what used to make 1P great. We now get no native apps, no local vault storage, no upfront payments. The VC rot has already set in.
So they go where there's real money to be made. They are well-positioned to become the default choice to handle corporate day-to-day cyber-security needs of most non-tech businesses, and if they can pull it off even moderately successfully it will make them the biggest Canadian IT company. Family accounts never ever will.
That doesn't mean their product won't remain the best* choice for individuals and families. Microsoft also doesn't give a damn about family or single users of Office, yet we all* use it because it's still the best* product on the market.
* words like 'all' and 'best' are approximations of what's going on in the real world, not in HN where significant numbers of people may very well be using LibreOffice and the Nth fork of Keepass.
It's more than that, most families that do care about security don't need features beyond what is built into iOS/Android. When I encouraged my wife to start using randomized passwords, I didn't even have to help her get set up. She already knew how to use Apple's password manager, so she just started using it. No setup, no additional monthly fee, just a quick decision to start using it.
When we need to share a password, we just read it off to each other and put it in our respective password managers. There aren't really any features in a paid password manager that we miss.
With 100k individual users and its background as a consumer application, 1Password wouldn't neglect the non-corporate customers—at least until David Teare retires or otherwise leaves.
But incidentally the same features which makes it great for work also makes it great for me to share access to vaults with my son for example.
How do you have a universal login that doesn't require corporate onboarding? You're just not the person this landing page is positioned for. They need corporate buy-in so you the user can login with one login across all of those sites. If you the single user want to easily login to Netflix and Amazon with a click of the button, then how do you expect 1P or any org for that matter to offer that if they don't have a direct relationship with Netflix or Amazon?
This is like using Google.com to search for things to find and screaming "Google is too corporate" when you landed on the Google AdWords landing page (ads.google.com).
Imagine a world where a standardized protocol let a company put out verifiable "we've been hacked notice" and my password manager would just take care of it next time I opened it (or throw a prompt or something).
Doubt this is going to happen though.
A lot less incendiary than your hypotheticals.
https://blog.1password.com/save-in-1password-button-with-ram...
I remember a few years ago Steve Gibson was working on a certificate based system called SQRL and it sounded pretty cool to me. Maybe 1Password have some ideas of their own?
Your choice eventually will be entering a standard password and specifically engineered to be annoying CAPTCHA, or pay for 1Password. Use Keepass or BitWarden? CAPTCHA. why? "Security".
(Disclaimer: I'm a satisfied 1Password customer. Just noting that their competitive edge is wearing razor-thin these days.)
--- Edited to remove references to Linux. Appears to be Windows only.
That might be because they want to make their own services more attractive (if so, I think they made the wrong choice), but also could be a legal thing.
https://www.apple.com/family-sharing/: “You can add anyone to your Family Sharing group age 13 and older and invite them to share an Apple Card”, so members of An Apple iCloud ‘family’ neither have to be family members nor live at the same address.
That’s broader than, for example, the TOS of Netflix (https://help.netflix.com/legal/termsofuse: “The Netflix service and any content accessed through the service are for your personal and non-commercial use only and may not be shared with individuals beyond your household”)
Apple might fear getting sued if they make it easy to share a Netflix password with members of a family plan.
“Family Sharing Rules: You can only belong to one Family at a time, and may join any Family no more than twice per year. You can change the Apple ID you associate with a Family no more than once every 90 days. All Family members must share the same Home Country”
- Apple Music has a web UI and Android app
- FaceTime recently added 3rd party links allowing non-Apple users to join calls
- Keychain is being made compatible with Windows Chrome
It’s clear from raising this much money that 1P owners are doing a “private IPO” or adding more products and features. If it’s a cash out, wouldn’t you want a privacy focused company to buy it instead of VCs funding it and expecting a return? If they are building new features and products, Apple buying it could bankroll that and temper price spikes.
This is exactly what I'm referring to. I put up with Apple's website for more than a year as my primary casual-use computer became a Windows PC.
I work on iOS apps for a living. App Store Connect has always been terrible. Bugs linger for years. Elements continue to break in unexpected ways. The place where developers receive feedback from Apple is still hard to find even though it's immensely important. The website received a major redesign a few years ago and the bugs were still there!
Now apply that lack of care to a music website. Being forced to login daily. Asked to perform 2FA daily, so I need to keep my iPhone near me if I expect to play music. Songs inexplicably not playing, if play fails repeatedly, maybe a page refresh will work. Songs inexplicably only playing previews, forcing you to log out and log back in. Zero effort to restore your previous searches.
Apple makes attempts at providing services on the web. But for those of us attempting to use those services, the experience varies from subpar to outright hostile.
> Keychain is being made compatible with Windows Chrome
Again, see how people review this in this very thread.
---
Simply providing the service does not mean it's good. That's what I mean by "institutional" and "organizational". They half- or quarter-ass what they ship, and then they leave it to rot.
If you examine the source code of a client (for example bitwarden) and make sure that it's not leaking your master password and then compile the soft yourself and not update - you'll be pretty safe.
This will make it similarly secure as e.g. keepass, because even for keepass you should be sure the source is legit
I have separate instances for work and personal accounts, so one breach wouldn't affect the other. Since my passwords are distinct, the number of accounts that would actually be useful to them is minimal, and fraud response is a pretty important metric in deciding what companies I do important business with. Identity theft is a problem, but all of this is probably more likely to be leaked in some other database, like the Equifax hack, than through an account compromised in a password manager cloud storage breach.
My password manager being compromised would indeed be a huge time suck, but I don't think the long-term consequences would be any more severe than a few key individual accounts that are probably even more vulnerable. I think things like coordinated attacks where they social engineer their way through 2FA— which have been seen in the wild— to present a greater real-world concern.
I'm in agreement with parent, I think putting your passwords in the cloud is a wild single point of failure. Even if you can tell a compelling story about how they carefully encrypt everything right now, you're always a silent update away from it all being dumped on the internet.
I think people (in aggregate) just don't care about the risk and will take the path of least resistance. They don't have to draw the line there, but they will.
> My password manager being compromised would indeed be a huge time suck, but I don't think the long-term consequences would be any more severe than a few key individual accounts that are probably even more vulnerable.
Having your main email account compromised seems like an absolute nightmare where you potentially lose control of every single service that you subscribe to (banking, utilities, cell phone (so maybe 2fa is even broken), medical portals, social media, etc).
Having your entire set of passwords compromised is like that on steroids. Rather than your attacker having to use your email to get to each of those services one at a time, they just have them immediately. And who says you'll even know that your stuff was compromised?
I'm a bit of a crank though. I don't do any of the smart home stuff. I see my phone as a necessary evil. If some company shoehorned an app or a WiFi connection into their product, I don't buy it. After being in tech long enough, I just want things that work for me, not for the company I bought them from.
This is true of all password managers that have any ability to connect to the internet. You’re one silent update away from your manager suddenly uploading all your passwords to a random endpoint in Russia.
Its not fool proof, but it feels better than a black box that could be a different black box tomorrow or after the next acquisition or round of investment.
This is also true for your operating system updates, browser, browser extensions, compilers, the infrastructure for your email service provider, any libraries those things use etc. Not to mention your local password manager. Even if you don't accept push updates, do you evaluate the code? What if the vulnerability was timed to pop a few weeks after release? What if it was included in an update that patched a major vulnerability so you went faster than your normal process afforded? Even if you have a local firewall that stops external connections from unrecognized programs— what if it's a whitelisted program or the operating system or the firewall itself?
Why would you a password manager's encryption less than you would trust your email service's encryption? I'd bank on the password managers' being a lot more robust.
What about RATs that could access your local password database? RATs are a lot more common than cloud service breaches.
And as I mentioned previously, Dell shipped a hardware trojan in 2010.
There are tons of single-point attack vectors in this chain. I'm not a security expert, but storing encrypted data in cloud storage seems less likely than others be a viable target.
> Having your main email account compromised seems like an absolute nightmare where you potentially lose control of every single service that you subscribe to (banking, utilities, cell phone (so maybe 2fa is even broken), medical portals, social media, etc). > Having your entire set of passwords compromised is like that on steroids. Rather than your attacker having to use your email to get to each of those services one at a time, they just have them immediately. And who says you'll even know that your stuff was compromised?
Let's say they did compromise your email account. Since only a few of your accounts are genuinely consequential to nefarious criminals, the number of password resets they'd need to execute might set them back, what— 5 minutes if it's not scripted? And all of it is moot if you use a 2FA method aside from email? Beyond that, considering how much more frequently email accounts get compromised, singling out the storage location for password manager databases seems pretty arbitrary.
I just don't see how the opposition stands up to a comparison of attack vectors.
Agreed, those are already risks, and ones that are a lot harder to mitigate (though I do try where I can). Does that mean I should add another one that I can easily avoid?
There are risks in both local and cloud password managers. Maybe those risks seem equivalent to some folks, and the cloud features are useful enough for it to be a no brainer for them. For me, I don't at all mind manually backing up and manually copy/pasting credentials, and I don't miss the convenience of the cloud features.
> Let's say they did compromise your email account ...
This seems focused on the case of a dedicated attacker focused on you specifically. Id think each of us is more likely to be affected by various automated attacks that are backed by large dumps of account credentials.
In any case, I agree risks already exist in other places. For me in my specific set of circumstances this just seems like an easy one to skip.
> Does that mean I should add another one that I can easily avoid?
All other things being equal? Avoid it, of course. I firmly oppose letting perfect be the enemy of good in the sense that more secure is better than less secure even if it's not perfectly secure. But I also oppose it in the sense that rejecting beneficial functionality because it's not perfectly secure, especially when it's not close to the biggest or most attractive attack surface, doesn't make sense. Even when password managers' servers were compromised— LastPass, for example— I don't think anybody ever got ahold of passwords. KeePass OTOH was broken with KeeFarce and RATs are a lot more common than cloud service server breaches.
> This seems focused on the case of a dedicated attacker focused on you specifically. Id think each of us is more likely to be affected by various automated attacks that are backed by large dumps of account credentials.
Nope— If it was automated the distinction is even less significant. A script would only need to search your email for whatever specific types of logins it supported and fire off password resets. Non-email 2FA becomes even more of a hurdle without the option of social engineering it or some other human-touch fix.
Consider this. (very) Roughly, this is the market penetration for these products:
* computer: 90%+
* smart phone: 85%
* tablet: 50%
* computer, smart phone and tablet: 40%
Most people (in this country, at least,) have multiple devices. Most people have internet access. Most people aren't going to be able to manage storing and sharing passwords among their devices at all, let alone more securely than cloud storage would do it. So for most people's use cases, it would be like citing health when refusing to put a teaspoon of sugar into the cup of tea they're having with cake and ice cream.
So like I said, avoid it if it doesn't improve your life— I have no stake in your password management choice— but I will actively butt in to qualify the sentiments expressed in this thread because, a) many users, even on this site, aren't sophisticated enough to engage in the sort of cost/benefit analysis that we are, and b) to them, this conversation is unintentional FUD. Cloud-based password management is vastly superior to regular folks' existing methods. If they're put off by technically savvy people saying they're fundamentally insecure, that is the embodiment of perfect defeating good.
Can we actually know this? We only know about the breaches that we're told about, or that are found and disclosed by researchers. I'm not familiar with KeeFarce, but presumably attackers need local access, in which case you're boned anyway.
> ... many users, even on this site, aren't sophisticated enough to engage in the sort of cost/benefit analysis that we are, and b) to them, this conversation is unintentional FUD
So this is the part that I worry about. I think we're in a bit of an age of innocence with everything moving to the cloud, where everyone still believes that all of these services are going to be well meaning, competent, capable stewards for your bits. I'd love to be proven wrong, but I imagine in 10 or 20 years we're going to have a very different attitude about these things, sorta like people who were using xray machines to size shoes before they learned about the effects.
Once any info gets to the cloud, its out of your control forever, and its in a place where it can be attacked by the current ~8 billion people on the planet, and all the new people coming along after that. Its an impossible task to defend against that. Not to mention as someone like lastpass grows, what could be a juicier target than that? Why try to pwn individual services when you can just get all of the legit credentials at once from one place?
If the options are only use the same 6 character dictionary word for every account, or use a cloud subscription password manager, I'd probably recommend the latter. But for someone not tech savvy, I'd probably recommend a pen and paper with memorable (long) pass phrases before I'd recommend a cloud solution.
In the past I've recommended a local password manager with generated passwords on your one machine that you do anything sensitive with. Back it up on a thumb drive once in a while. For your most used accounts (e.g. email) that you really want to use on multiple devices, use long memorable pass phrases and just enter them in. Some people might think this is primitive, but its not that hard and it should be plenty safe for most people. Its just not as convenient.
Can you ever actually prove a negative?
> I think we're in a bit of an age of innocence with everything moving to the cloud, where everyone still believes that all of these services are going to be well meaning, competent, capable stewards for your bits.
> Once any info gets to the cloud, its out of your control forever.
You're propping up a straw man using a hyperbole.
> But for someone not tech savvy, I'd probably recommend a pen and paper with memorable (long) pass phrases before I'd recommend a cloud solution[...]
And then presenting your original assertion without any more evidence.
But that's all nearly beside the point.
The most difficult factor to wrangle is human psychology. Without intervention, phishing attacks just work. People re-use passwords. People switch from redox1 to 1redsox1 when forced to change them. They do this all to avoid having to think about it.
The entire point of password managers is to mitigate this. You need to compete with the psychological ease of re-using the same password repeatedly because that's the only way regular users will use it. Then, you can warn them when they're entering credentials into a site where they don't belong. You can warn users if a service they use was breached. You can warn users that their password is weak or reused or old and give them a quick solution rather than leaving them to figure it out. You're making it easy for them because that's the only way it works. If you draw two barely kissing circles on a sheet of paper, that's the Venn diagram of users who care enough about electronic security to deal with the extra irritation of using strong unique passwords but won't use an automated system to do it.
So maybe the second-weakest link is the credentials themselves, and the third weakest link is the collection of websites users submit their credentials to that don't store the passwords in AES-256 encrypted vaults with no local master password storage, like password managers do, and the fourth is probably the browser, etc.
Everything we know about the actual empirical risk of these components points to password managers, in general, being close to the bottom of that list. Prioritizing anything but the most blatant password manager security flaws over even minor user convenience will have a negative net effect. When it's a risk so obscure that we have no documented instance of it occurring among thousands of documented instances of breaches occurring in other services, I'd argue it's less safe.
If you're going to base your security strategy on intuition about our relationship with cloud services, go for it. Personally, I'll leave the faith to the priests and stick to attack vector analysis and balancing limiting attack surfaces with solutions that work most easily for most people, because that's the only way they'll use them.
> Can you ever actually prove a negative?
Does that mean that you agree that we can't know the extent to which things have been exposed? Cause that's part of my point. Of course you can flip that around and say well you can't prove that nobody compromised your local machine, but one of those things is open to attack from many orders of magnitude more attackers by virtue of being on the open internet and in a physical space that you don't control.
> You're propping up a straw man using a hyperbole.
You're cooking up a tasty word salad there, chef. Can you give me a little more meat here? I don't quite follow. Have you never heard people say that you shouldn't write an email or send a picture that you wouldn't want to see in the newspaper? Its a similar concept. Once you send something out over the wire, your power to make decisions over what's done with it is gone. You have to hope that whatever was listening on the wire is (and will continue to be) benevolent. How do straw men and hyperbole apply here?
> The most difficult factor to wrangle is human psychology. Without intervention, phishing attacks just work. People re-use passwords. People switch from redox1 to 1redsox1 when forced to change them. They do this all to avoid having to think about it.
> The entire point of password managers is to mitigate this.
I agree. That's part of why I use a password manager, and recommend that others do so too. We just disagree on whether or not its advisable to cede control over that kind of tool to a third party.
It feels a lot like the argument that your money is safer in a bank than in your mattress, which is an argument I agree with. Except replace all the banking regulations and security with a ToS that can change anytime and emails about how very deeply we care about your security. I'll keep my cash in my safe at home in that scenario. Maybe there are some people who'd still be better off using that bank. I wouldn't feel good giving that recommendation though.
https://en.wikipedia.org/wiki/Russell%27s_teapot
https://en.wikipedia.org/wiki/Straw_man
I have better things to do.
Russell's teapot is a new one to me. It seems you're position (correct me if I've misunderstood, or don't since you don't seem interested in the conversation anymore) that since we don't have definitive proof that we can't trust these third parties, it's wrong to distrust them. I'm too paranoid to buy that. If I can't verify, then I don't trust. Good luck with your better things.
1. native app (no bullshit JS based) for speed 2. the same keybindings CMD+\ or Option+CMD+\ to fill in or pop up the menu 3. sync with icloud 4. not look like total shit (ie. lastpass)
Do these basic things and I think you can easily steal 1pass users.
Strongbox is the most polished but doesn't offer browser integration.
KeePassXC has a terrible UI, and MacPass doesn't remember your key file between sessions. Both require staying in your Dock and need the janky KeePassHTTP-Connector to work with a browser.
Just add crypto wallet functionality (similar encryption skills) and then facilitate both web2 and web3 login.