Comment by acatton | Hacker News Reader

Comment by acatton | Hacker News Reader

When I see people running to 1Password, I'm really concerned. I don't know whether 1Password has somewhat of a following cult here or they're doing some astroturfing in this community. But 1Password claims are the same claims as LastPass used to have. (zero trust, secure, …) And now we're discovering that LastPass was totally lying. We have no way of knowing whether 1Password is telling the truth.

For me, my password manager is the one absolute thing I want to be auditable. 1Password with its follower "who know people who designed it" reminds me of "trust me bro", "funds are SAFU" in cryptocurrency projects. Leaving LastPass in order to sign up for 1Password feels like out of the pan into the fire.

I've always use and will always recommend FOSS for password manager. I install Bitwarden on my technology-illeterate friends and family and I use KeepassxXC personally. I've looked briefly how vaults are encrypted in both software. The security is sound. Bitwarden was audited by Cure53[1] which is one of my favourite security auditing firm. (I highly recommend to read their audit of dovecot[2])

Anyway, you know what they say "fool me once…". I'll be eating popcorn when some claim will turn out to be false for 1Password…

[1] https://cure53.de/pentest-report_bitwarden.pdf

[2] https://cure53.de/pentest-report_dovecot.pdf

Not dismissing anything you said regarding 1PW but they also had cure53 audits. See e.g.

- https://cure53.de/pentest-report_1password-b5.pdf

- https://cure53.de/pentest-report_1password-mobile.pdf

Edit: overview of audits https://support.1password.com/security-assessments/

These are pen-tests and black-box security audits. While they're definitely better than nothing, and they would show that their security is better than LastPass', the code was never audited.

Are we reading the same reports? At least the two latest reports by Cure53 mentions "source code audit". In addition, the audits by ISE and AppSec explicitly mentions code review as part of the audit.

I am in no way familiar with these kinds of reports, but does this not mean that (at least parts of) the source code was audited?

On top of that, they’ve made their client software prettier and slower, but not really more usable IMHO. I migrated to BitWarden and don’t think the user experience is any worse.

Indeed I think BitWarden has the better UX

My only complaint with Bitwarden is that the 1Password extension seems to have fewer issues automatically recognizing login fields for web sites. In most cases, that's an easy enough fix via custom fields in Bitwarden but the UX around that could be nicer.

I use 1Password but the slowly worsening/slowening UI and move to a subscription model, along with the fact I can’t even upgrade to the latest version because I still sync my own vault are making me look around for an escape hatch.

I guess it’s the Keepass family of apps, or perhaps Bitwarden, but it’s disappointing to even have to think about switching.

One of the tests we recently added to 1Password is the "Moby Dick Workout" for secure notes with Markdown rendering. Would love you to compare 1Password and Bitwarden:

https://www.hogbaysoftware.com/posts/moby-dick-workout/

> 1Password claims are the same claims as LastPass

And the whole post is about things other than the claims.

The part of the post about 1Password is basically "trust me, bro, a buddy of mine used to work there".

All the things about encryption don't fit that.

All the things about previous breaches and bug reports don't fit that.

You're describing about a tenth of the argument.

Reply on news.ycombinator.com