Hacker News Reader

As someone who has been using 1Password from almost the very beginning, I think the issue with the forum stuff is trust. If you're trusting a company to store your passwords and credentials in the cloud, then there's a certain level of transparency and openness that's required. I also have not had any issues with the subscription model, despite using standalone vaults for as long as possible, and the performance is fine for me on v8 (but I also have the newest Macbook with max RAM so that might not be the case for people on older/less-capable machines).

I, personally, am not happy about the way that this or the subscription update have been handled because, to me, it makes me question how they would communicate something far more serious. If they're delisting forum posts because of a decision to not update their app in the Mac App Store yet, how can I be sure that they won't delist forum posts when they have a data breach? How can I be sure that they're not obfuscating other things that are more important than forum posts to try and sweep bigger issues under the rug? It's like the old adage goes - "If you're willing to lie about something that doesn't matter, what are you willing to do about something that does?"

These moves are forcing me to, at the very least, start looking at a new password manager. 1Password is still the best, in my opinion, in terms of features and usability but that won't always be the case and transparency and respect for your users are far more important to me than niche features. If I can't trust your company over something small, there's no way I'm going to continue trusting them with some of the most important info in my life. I currently use both LastPass (not a fan) and 1Password. I'll be re-evaluating KeePass and Bitwarden because of this.

I went through the process evaluating Bitwarden recently. It's a shame but it's many years behind 1Password and their roadmap doesn't really appear... hopeful towards catching up.

I'm waiting for someone to actually build a better 1Password, learning from the mistakes, rather then migrating to something else right now.

What features are missing specifically?

As a happy paying (both corporate and personal) Bitwarden user, the only gripe I had was the lack of multiple-profiles on the same device (which was recently added and works great). We came from KeePass though, so we're likely a more "spartan" user of password managers than some.

Not GP. Custom items (like WiFi passwords, software licenses and many more). It’s been requested and promised with a “we’re working on it” for many years. If there’s one thing Bitwarden is, it’s very slow on developing features that users have asked for. Its focus on enterprise integration makes it seem like the actual product is not actively developed to improve it.

We have templates for both software licenses and wireless routers. :) Custom templates have indeed been on the wish list for a long time. It has proven to be a much more difficult to deliver feature than anticipated. We actually built it, and it is in beta (available to 1Password Business memberships), but we couldn't get buy-in on the implementation. It is something I continue to advocate that we re-evaluate, but I couldn't say if or when it'll happen. -Ben, 1Password

Happy paying customer here as well. I would looooove to have email protection/relay service included to 1password. The synergy is real between those 2 services, and I would love to see it happening.

EDIT: was unaware of it of 1password integration with Fastmail. This is actually possible.

I feel the same way, and I'm firmly in the camp of "roll up my sleeves" if there is work to be done, but I have heartburn about doing that for Bitwarden for a few reasons:

* their problem doesn't seem to be "we don't have developer bandwidth to add this nice feature," but rather (from my perspective) they're so lacking in discipline and execution. In other words, the PR to fix any such bugs would be so massive as it might as well be a fork

* and that's just on the bugfix side -- anyone who thinks manually created folders are superior to tags ... well, there's no PR to fix that

* them being open core(?) makes contributing feel like free labor for a commercial company. I have less heartburn contributing fixes to GitLab because they do have a for-real open source offering (the CE edition) that one can run without drama

You can self host bitwarden very easily

I'm a 1Password user, and the main thing that stopped me from using Bitwarden was them not having Account Switching.

They've managed to implement it in their clients in March this year [1], and I've been moving some of my shared credentials over to a self-hosted Vaultwarden server.

What other features do you think are missing from Bitwarden?

[1] https://bitwarden.com/blog/account-switching-phased-rollout-...

What does 1Password have that Bitwarden is missing? I mentioned elsewhere in the thread that I just switched from 1Password to Bitwarden about a month ago, and apart from the lack of touch ID support on the desktop and the Large Type feature, which are only minor annoyances, Bitwarden has been just fine for me.

There's a lot that's missing. Someone else provided a list but there's a big chunk of things (like SSH keys) that aren't available in Bitwarden. Take this with a grain of salt, though, as my assessment is based on what I looked at last year.

That was the case in the past when I evaluated it as well but, as I mentioned in my post, trust is more important to me than features and flash. I can usually find workarounds for features and flash. I can't find workarounds for trust in a security-focused company.

I never tried 1password, but I am using Bitwarden right now. What features are important to you that Bitwarden is missing? Just wondering if I should give 1password a try as well.

This perfectly summarizes how I feel about Agilebits. I no longer really trust them. For me the big loss of trust started when they stopped encrypting stuff in memory in the 1password4 release. They've gone back to it, but it was a real violation of trust.

The subscription/cloud pushing added to that.

I don't know. Forums like this, at companies like this, are maintained by one of marketing, sales, success, or some blend of the three (revops? engagement? pick your poison).

In the best case, a low level employee made bad choices. More likely than that, a higher level leader in one of those orgs is enforcing a policy decision of theirs. I seriously doubt a C level is involved in any way with this decision.

I just don't see how this decision has any bearing on my trust in what they're building.

I would agree with you except for two reasons:

1. Senior staff, including Dave (the owner of AgileBits), participate in the forums and are participating in the exact discussions in question while completely ignoring the questions people are asking. It would be hard for them to claim ignorance of what's going on.

2. This also happened during the subscription phase and it happened during the sunsetting phase of standalone vaults so this isn't a first-time incident or atypical of how they respond to stuff from a PR standpoint. It seems like, as a company, their position is to ignore the things that they don't have canned responses for and only answer the things they do have canned responses for and it's obvious that this is what happens to everyone participating.

Again... product-wise, 1Password is superior in almost every way to others. As a company, though, it's hard to continue to support them when it would be far more effective to just be honest and say "We've decided not to do x at this time because of y" or "We're going this route because of y and we understand that that's not for everyone but it's much harder for us to do x when only z% of people use the feature."

> Why does 1Password always bring so much controversy in discussion forums?

It's because 1Password was targeted at tech enthusiasts at the beginning and has migrated to a mass-market product over time. The desires of the tech enthusiast group differ (on average) from the goals of a mass-market consumer product. Every time they switch away from something enthusiasts value (perpetual licenses for a specific version, optimized native apps) the early adopters get upset. The average user doesn't care all that much.

> If you’re making six figures writing software and think $3/month for a cornerstone of your security suite is offensive, you need to grow the fuck up, frankly.

For me, it's not about the cost. It's about managing one more subscription. My credit card bill is full of little monthly subscriptions, and at this point I'm tired of adding new subscriptions at every turn. Subscriptions aren't a big deal for the first 5-10 services, but once you're juggling 20+ recurring charges for things that don't really need to be recurring charges, it's tiresome.

I would gladly pay a premium to have a one-and-done license (for a specific version, just like they did in the past) that didn't add yet another monthly payment for me to manage and another system I need to update when I get a new credit card.

Also, my password manager is a critical part of my digital life. It's not ok for it to go down. What happens when payments fail for whatever reason? Shit happens. Should I regress to making up passwords on the spot and writing them down?

I'm very happy to pay $50+ every year or two for a password manager with great UX and cross device support. It is not ok if any functionality is contingent on a subscription though. I really like the Jetbrains model, where if your subscription lapses your software just keeps on working — no updates though.

It's not like 1password is gonna delete your data or block you from accessing your data if payment fails and your account is frozen. It just gets into read-only mode.

They have a fairly generous policy is case you'd account is frozen: https://support.1password.com/frozen-account/

> Also, my password manager is a critical part of my digital life. What happens when my payments fail for whatever reason? Shit happens.

This is why I only use password managers that save as KeePass databases, like Strongbox or KeePassXC.

You can still read and export your data if your payments lapse to the point that your account freezes. They just don’t let you modify the data.

> Subscriptions aren't a big deal for the first 5-10 services, but once you're juggling 20+ recurring charges for things that don't really need to be recurring charges, it's tiresome.

The world is going in this direction, however: everything is turning into Cloud+SaaS to charge for use instead of bill once and forget. The next big thing will very likely be a service that makes extremely easy to aggregate and manage the 465 or maybe 3044 micropayments per year one will need to use his compu... er... stupid terminal a few years from now.

I’m already grateful to Apple for consolidating so many of my subscriptions into one interface. So much easier to manage.

I and many others will never stop critiquing software, especially commercial software, sorry. I really don't understand your reasoning. Just sounds like "shut up and go somewhere else". How about you ignore the comments you don't like and happily continue to use the software.

The funny thing is that’s what is happening, the company is choosing to remove, ignore, and move on from these comments, and yet here we are.

And here come the downvotes for stating a fact, yay!

> I and many others will never stop critiquing software, especially commercial software, sorry.

It's a real stretch to call any of this "critiquing software".

What exactly is it then?

Trendy complaining at best. You've got people here and there talking about how electron is a full browser and that all electron apps use gigs of memory. These are no more software critiques than my fear when turbulence hits a critique of the pilot's skills.

The interesting part is the relative absence of long and contentious threads about other commercial software, as I read the comment.

IDK, have you seen threads about Go generics, or Uber, or JavaScript/Electron, or Windows 11, or Tesla Autopilot, or China, or the US, or systemd, or...

This seems pretty ordinary for HN xD

Hah, maybe so. :)

I think one major complaint from former users like myself — I started using it over a decade ago as well — is that we bought their software by paying upfront when it had bring-your-own syncing and no (or at one point optional) subscription. Then they intentionally broke bring-your-own syncing, and eventually killed it entirely, switching everyone into a "free" client with a forced subscription without refunding people who paid upfront for the client. That's a dick move — and sure, it's not a ton of money, but that doesn't excuse being dicks. Given that there are OSS options out there e.g. KeePass... Why stay? And for large teams, LastPass has owned the market for a while now (1Password literally cloned their business model), and didn't pull a bait-and-switch; you knew what you were getting into, and why.

They also used to be pretty bad about cross-platform support; no idea if that's still true.

> Given that there are OSS options out there e.g. KeePass... Why stay?

Speaking for myself: because 1Password works everywhere I need it and it means I don't have to think about it. OSS is great at a lot of things. KeePass's user experience is indicative of a place where OSS frequently is not. If I have to think about my password manager, it isn't doing the job I need it to do; when I trialed KeePass, it made me think about it, therefore it doesn't work. For me, of course. Your mileage may vary.

I was a 1Password user before they moved to a subscription model, and I was mildly affronted that I would be stuck on an older version if I wanted to keep out-of-band syncing. More than mildly, honestly. Then I tried a bunch of alternatives and they were all, for my purposes, significantly inferior, either in the "I do not trust them to hold onto data" sense or in the features sense or both. So I tried 1Password again, realized that yup, it's still tops, and that $3 a month is way, way too little money to be agitated over. I have realized way more value from 1Password than I have paid either for the original purchase--which I used for quite a long time--or from my subscription.

I use it because it makes my life better. Surely you can understand that.

> And for large teams, LastPass has owned the market for a while now

I don't think that I know a single security professional in my circles who would recommend LastPass unless the alternative is "don't use a password manager".

I believe that subscriptions are a terrible way to sell software and and per product cloud syncing is awful, rent seeking design.

1Password used to let me buy the software and sync how I see fit. That is, it was decent and reasonable software. I was happy to use and recommend it.

That’s no longer the case and I feel like a fool for recommending it, having left those people stuck in a predatory model that I consider at best a bad deal and at worst unethical.

So yeah, I’m going to criticise.

And no, I don’t feel sorry for the staff of a company operating on a business model that should probably be illegal.

The controversy for me isn't that they moved to a subscription model, its that they moved to a cloud only model and completely broke their offline-sync yourself vaults. Its that they maintain an almost hidden version that allows you to keep using your offline vaults, but it incompatible with and separate from their cloud vaults (really counterintuitive if you accidentally stored some stuff in the cloud vaults). The browser extensions for their older offline vault keep breaking as they are only incentivized to move you to the subscription model one.

There are plenty of people and organizations that I prefer the Teams, family and subscription model for.

Its just a bad experience. And yes, their audience has also used Keepass, Bitwarden and others, and see 1Password as the one capable of not fucking it up but simple did any way?

I get it that they don't see an obvious way to do subscriptions that people can't circumvent. It just also brings a lot of skepticism for what other economic pressures are going to guide their decisions, and when.

The subscription model means that the US government can shut my business down by instructing payment processors to stop taking payments from me, or heck even EMV can do that on their own bat like they do for adult services. If you think the complaints about subscription models are because of the price, it’s you that needs to grow the fuck up, personally.

Then there’s the SaaS model where my data is stored on US servers. If at any point the someone in the Internet decides to break BGP, sever an optical fibre, or any number of other shenanigans, I am left with what is effectively read-only access to my vaults. I have no option for self hosting to protect against hostile action between international parties that involves me or Agile Bits as collateral damage. We run our own optical fibre networks to ensure continuity of communications in the face of hostile/negligent behaviour, but with 1Password we do not have the option to host our own security.

Then there’s data sovereignty. Agile Bits is a US company, and the US government has shown its willingness to spy and sabotage in the past. Whether it’s intercepting sensitive data in transit (echelon/airbus) or building weaknesses into encryption standards or installing malware on equipment in-transit or sabotaging chip fabs to produce less random RNG, the US has done that.

There is no trust here.

Agile Bits even put out a “survey” to gauge interest in self-hosting as a means of shutting down discourse on the topic. If there was any intention of supporting self-hosting they would just release a trial product which would be a great demonstration that their business continuity plan would work because self hosting would be the same as Agile Bits hosting. Just run the containers on your own docker instead of Agile Bits cloud.

The most “entitled” comment here is yours, talking down to everyone else as if you are the only adult in the room.

Not trying to be pedantic, but AgileBits is a Canadian company and has servers in Canada, the US, and the EU. I think they also released a gift card solution to address the concern of recurring payments, or maybe for privacy. I never really understood the use case for this (besides using it as an actual gift), but you made me think about it now. Having said all that, I think your points still stand, but for me I haven't found a company that is more trustworthy. FWIW, I use 1Password at work and KeepassXC at home.

What a weird comment. People are being negative because they don't like their actions. It's not that complicated. You aren't even making a counter argument. "Just use something else." is just dismissing criticisms. That is willful ignorance.

I don’t think it’s self entitled to expect the software you paid for to keep its original functionality. They kept using dark patterns to enforce the switch to subscriptions.

Thank you so much for this post. The hate they are getting over moving to Electron is, frankly, ridiculous. I'm a long-time customer and I'm finding 1Password 8 to be an awesome update and I don't notice that it's not purely "native" (whatever that means anymore). The reality is most users don't notice it because the app works great and electron/web views are actually really solid. The 1P team deserves credit for some of the solid UX improvements they've made as well!

Spoken like someone who did not use the "drag this window on top of the QR code on your screen" feature, nor its ability to detect native application's bundle-id and fill in passwords based on the application currently in focus

To include Windows users in this fun, previously one could invoke a hotkey and 1P would offer to auto-type into almost any Windows dialog on the screen. Poof, gone

I bet I could come up with 15 other things if I thought about it. Engineering is filled with tradeoffs, and so they made the "we don't enjoy writing cross platform code" versus "we really made our user's lives better by having native code integration capabilities"

> Spoken like someone who did not use the "drag this window on top of the QR code on your screen" feature

This feature still exists, and it is even easier to use. You no longer have to drag any windows around. The QR code just has to be on screen and you press the button. :) If you're having trouble with it please reach out as we'd like to troubleshoot.

> nor its ability to detect native application's bundle-id and fill in passwords based on the application currently in focus

1Password 7 didn't do this? It didn't fill in any 3rd party apps except browsers that had our browser extension installed. 1Password 8 actually not only detects these apps but also fills in them. https://support.1password.com/mac-universal-autofill/ If that is not working for you, please reach out.

> To include Windows users in this fun, previously one could invoke a hotkey and 1P would offer to auto-type into almost any Windows dialog on the screen. Poof, gone

Agreed. I miss the one too. I'm hopeful we're going to be able to bring it back soon.

-Ben, 1Password

Just because they moved to electron for the core client doesn't mean they can't add native extensions to add those features back. It's still a fully native app they are building and shipping at the end of the day (just happens to do a lot more work in the web view). I suppose losing those features is a trade-off they made in order to get the rewrite done but wouldn't be surprised if they add in those features later.

And the Windows app was in need of a serious update, the experience was not great.

We can't pretend that engineering for different platforms has no overhead. If they can now move faster shipping new features to all platforms on day one, users will win. There is going to be a transition period where things aren't at parity yet and that's understandable.

> Just because they moved to electron for the core client doesn't mean they can't add native extensions to add those features back.

So you admit they are removing features at the same price point, but are somehow still confused as to why some folks are upset?

Yeah I agree, I like 1Password a lot, but also wish they kept the native app.

I don’t care about the subscription - if anything it’s on the cheap side for the value it gives. I too migrated several companies into teams over the years.

But, electron: no. I use a Mac primarily, and I want Mac apps that take the platform seriously, and integrate well with it. Regressing from that means you lose my business.

We have a deeper level of integration with the Mac than we've ever had. For example, 1Password 8 can now fill into many non-browser 3rd party apps, which was never possible before. https://support.1password.com/mac-universal-autofill/ -Ben, 1Password

Another really cool integration we have now is the SSH agent. https://developer.1password.com/docs/ssh -Ben, 1Password

1Password8 for Windows (which I upgraded to blindly) took away a core security feature in my view, which was "unlock on secure desktop". They say it's in-progress[0], but it's been 9 months already.

Btw, "unlock on secure desktop" basically opens a desktop where no other app/windows can spy or modify the window. This is the envirnoment used when you have to do the UAC approvals in Windows.

[0] https://1password.community/discussion/comment/620238

> If you’re making six figures writing software and think $3/month for a cornerstone of your security suite is offensive, you need to grow the fuck up, frankly.

Since when is it desirable to pay for software on a subscription model until the end of your life? Sounds like someone else needs to grow the fuck up here.

Around the time you expected to be able to work as a software developer for most/all of your life? Sure, I'd prefer to pay $20 for something I'll get free updates for for the rest of my life, but I get why that's not a viable business model when the company needs to pay a six figure salary to devs for the upkeep.

It's not desirable as a consumer, but I'd rather just get everything for free and just the way I want it as well. It's a compromise. OP wasn't saying that they prefer it this way, just that if you're literally mad and offended by what they're charging, then you're both blowing things out of proportion and not reacting proportionallyy.

Been using 1pw for some time. I have a few ux gripes that came about in the last about 1-2 years mainly around their latest browser extensions being far too intrusive compared to how it used to work. I really enjoyed the old 1pw.

Other than that, feels good, I like it. I pay for it for home and work.

I still don't get the Electron hate? Seems a bit insane honestly.

Hey — we'd love to chat about your feedback on the browser extensions. There are some settings that may help. Please shoot us an email. <3 -Ben, 1Password

Some people simply don't want to put their passwords onto someone else's computer... I've had little problems with their software, but I don't want to pay a subscription for password hosting because I don't want password hosting

100% this. And I'll add that somehow the new Electron app feels faster and more responsive than the native one. Huge props to the team for that.

+1 1Password is really great, the best among the available options by far imo. Most of the negative commentary about it doesn’t matter (I personally prefer native apps to electron apps).

The complaints about it being a subscription are weak - software doesn’t exist in a closed system. Keeping up with all the platforms and the OS updates etc. takes perpetual maintenance even if they shipped zero new features.

And the features they do ship (family vaults, built in OTP) are really useful.

It’s a refreshing escape from the “free” ad-driven hellscape many of the HN commenters complaining are probably employed by.

We have lost features and utility along the way. 1Password now only supports a narrow “happy path” of entering passwords into web pages.

You don’t need to cast aspersions against other people to make your argument. Why would you do that? Grow up.

Most of the complaints were about the subscription model - the comparison to the ad model is relevant.

What features and utility were lost? It has way more features and utility now that it had previously. The happy path is the 99% use case, but it also stores non web passwords, docs, and notes etc. just fine.