1Password moving from local storage to cloud subscription(motherboard.vice.com)
motherboard.vice.com
1Password moving from local storage to cloud subscription
https://motherboard.vice.com/en_us/article/evdbdz/why-security-experts-are-pissed-that-1password-is-pushing-users-to-the-cloud
12 comments
Why is it bad? The only difference with the current, "local" approach and the 1Password cloud approach is that the password vault will be stored on their servers rather than something like Dropbox or iCloud.
AgileBits can't (easily) steal my password vault on iCloud/Dropbox/WebDAV/local, even if they put a backdoor into a binary which they ship me (I can whitelist what the app talks to). Dropbox can't easily put a backdoor into the 1Password code from AgileBits. No single party can do it alone.
Apple could still single-party screw me, but they're huge, and if they did this in even one documented case they would probably lose $100B in market cap, and Tim Cook has shown he will push back when ordered to do stuff like this.
Apple could still single-party screw me, but they're huge, and if they did this in even one documented case they would probably lose $100B in market cap, and Tim Cook has shown he will push back when ordered to do stuff like this.
Not sure if it's wise to use the product of a company you don't trust for something as sensitive as passwords. I think you were better off using some other software to start with.
1) There is nothing better in terms of overall security+UX out there. It would take hundreds of man hours to build a personal solution, and thousands for a distributable solution.
2) Until recently, the direction they were moving in was good, even if their current position wasn't ideal.
3) It isn't so much that I think they could be malicious as that I don't trust them to have enough internal controls against external compulsion or an employee with prod access getting hacked.
There are some passwords I don't put into 1Password (PGP, etc), and I try to avoid having passwords-only as auth credentials for anything important. So it is more I would have hundreds or thousands of low to medium security site passwords at risk, which in aggregate would be a huge inconvenience. That is more because I don't have huge faith in the local OS security on machines than 1P as a particular risk vector.
2) Until recently, the direction they were moving in was good, even if their current position wasn't ideal.
3) It isn't so much that I think they could be malicious as that I don't trust them to have enough internal controls against external compulsion or an employee with prod access getting hacked.
There are some passwords I don't put into 1Password (PGP, etc), and I try to avoid having passwords-only as auth credentials for anything important. So it is more I would have hundreds or thousands of low to medium security site passwords at risk, which in aggregate would be a huge inconvenience. That is more because I don't have huge faith in the local OS security on machines than 1P as a particular risk vector.
It's all about the threat matrix. My parents use 1password because they otherwise would always use the same one (my mum) or keep them on an elaborate spreadsheet hidden someplace and sometimes hard to find (my dad).
For them, the risk of their un-backed-up computers crashing and them losing all their passwords is higher than the risk of the cloud storage being cracked. They already trust Agile Bit's security since that company writes 1password and hardens it against local attack.
Now, ymMv, but I suspect for 99% of users this is the right thing.
For them, the risk of their un-backed-up computers crashing and them losing all their passwords is higher than the risk of the cloud storage being cracked. They already trust Agile Bit's security since that company writes 1password and hardens it against local attack.
Now, ymMv, but I suspect for 99% of users this is the right thing.
This is frustrating. I originally moved from LastPass to 1Password several years ago because of how they handled syncing.
I was one of many to complain about their new Windows app when they started only supporting local vaults read-only. They assured me they wouldn't be forcing users off to the hosted version, but that's essentially what they're doing for anyone using the Windows version.
For what it's worth, the hosted version is nice - particularly for non-technical users - but not sure it's worth the monthly fee when I can use open source alternatives like KeePass with few trade-offs and also not sure it's worth supporting a company who is forcing the move to a recurring subscription despite the negative feedback from some of it's oldest supporters.
I was one of many to complain about their new Windows app when they started only supporting local vaults read-only. They assured me they wouldn't be forcing users off to the hosted version, but that's essentially what they're doing for anyone using the Windows version.
For what it's worth, the hosted version is nice - particularly for non-technical users - but not sure it's worth the monthly fee when I can use open source alternatives like KeePass with few trade-offs and also not sure it's worth supporting a company who is forcing the move to a recurring subscription despite the negative feedback from some of it's oldest supporters.
Although I prefer the local storage option, I do agree with the premise that most people don't back up their stuff properly and a cloud based storage should be, in theory, better for the average person. And having worked directly with the 1Password vaults on Mac OS and creating a library to read the data, as well as knowing that security experts have reviewed the white paper and trust it, I trust that it's secure. I also trust that 1Password, unlike something like LastPass, doesn't seem to have many exploits, and unlike other kinds of password managers, does sync to my phone and have a direct integration with Safari and a few other apps, which is really useful.
So, trusting the team behind 1Password's security, is there anything wrong with this beyond now there is a subscription rather than a one time fee, or is this just Vice's normal MO of being edgy, and taking a relatively insignificant controversy and making it something more than it is?
Also, am I wrong in assuming that the "local vault" isn't going away, and the only difference is now the subscription model and that they are syncing with their own servers rather than Dropbox or iCloud?
So, trusting the team behind 1Password's security, is there anything wrong with this beyond now there is a subscription rather than a one time fee, or is this just Vice's normal MO of being edgy, and taking a relatively insignificant controversy and making it something more than it is?
Also, am I wrong in assuming that the "local vault" isn't going away, and the only difference is now the subscription model and that they are syncing with their own servers rather than Dropbox or iCloud?
I discovered this a few months back by participating in their beta. I will not give them any more money. I wish them luck, they had a great product that met my requirements. Now they are moving i na direction where they will not support my requirements.
Unfortunately for them I purchase and maintain this stuff for everyone in my family, so they are actually losing several customers.
Unfortunately for them I purchase and maintain this stuff for everyone in my family, so they are actually losing several customers.
I still can't decide if this is a deal-breaker for me or not. We use 1Password as a team solution by syncing to the same Dropbox account and it's worked beautifully so far. The main issue is that I'm not sure our team has a budget to pay every month for this where we were paying a flat fee for the current version of the app. I realize that I would gain some features by moving to their cloud solution but none of them seem compelling. I'm glad that they're not removing local support but it does make me worry for the inevitable day when they do.
I’m pretty sure this article is making unverified claims. Here’s my understanding from reading some threads on Agilebits’ forum.
All native 1Password apps (mobile and desktop) support creating, reading, and writing local vaults, except 1Password 6 for Windows, which only supports reading local vaults.
The reason 1Password 6 for Windows doesn’t support writing local vaults is that it is a ground-up rewrite of the Windows app, and they have focused their efforts on cloud support since they see that as their main storage offering.
There’s been no indication (afaik) that they intend to remove local vault support from the other clients. Rather, they have indicated that they would like to add local vault support back to the Windows app but it’s not a high priority. See this forum post from April (https://discussions.agilebits.com/discussion/comment/365276/...):
> Windows is the rare exception where we have to build a brand new program and we're starting out with 1Password.com memberships first and hopefully add local vaults.
All native 1Password apps (mobile and desktop) support creating, reading, and writing local vaults, except 1Password 6 for Windows, which only supports reading local vaults.
The reason 1Password 6 for Windows doesn’t support writing local vaults is that it is a ground-up rewrite of the Windows app, and they have focused their efforts on cloud support since they see that as their main storage offering.
There’s been no indication (afaik) that they intend to remove local vault support from the other clients. Rather, they have indicated that they would like to add local vault support back to the Windows app but it’s not a high priority. See this forum post from April (https://discussions.agilebits.com/discussion/comment/365276/...):
> Windows is the rare exception where we have to build a brand new program and we're starting out with 1Password.com memberships first and hopefully add local vaults.
They had a blog post that claimed that they were going to add local support when the Win10 version was first announced but quietly never provided said functionality.
That said, I'm quite disappointed in the direction that they are taking and it certainly feels like a money grab to me.
1Password could expand to add things like ssh key support etc. and I would be happy to pay for an upgrade just not an ongoing tax.
That said, I'm quite disappointed in the direction that they are taking and it certainly feels like a money grab to me.
1Password could expand to add things like ssh key support etc. and I would be happy to pay for an upgrade just not an ongoing tax.
Really? If so, this is where they are losing me...
Unrelated but when I opened this article the react developer tools popped up: seems Motherboard isn't using the minified version of react in production. Someone over there might want to look in to that.
The question I'd have is whether their cloud-only solution is significantly (or at all) better than other cloud-only solutions such as LastPass?
For local storage, KeePass seems like an obvious choice, but I'm not sure that I'm as thrilled about its wide variety of plugin, etc. options - suddenly there's not just one set of developers with auditable code, there's the core, the browser plugin, maybe a few other things as well.
For local storage, KeePass seems like an obvious choice, but I'm not sure that I'm as thrilled about its wide variety of plugin, etc. options - suddenly there's not just one set of developers with auditable code, there's the core, the browser plugin, maybe a few other things as well.
Does anyone have experience using the Secrets[1] password manager on MacOS and iOS or opinions on how it compares to 1Password security wise? It seems to allow local vaults with iCloud Sync and the pricing is a one time payment as opposed to a recurring subscription model.
[1]https://outercorner.com/
[1]https://outercorner.com/
The app auto-updates, so you already have to trust 1Password's operational security.
I can't put all of my secrets in a file, encrypt it with software a site provides, let that site push updates to me for that software, and then give that site the resultant encrypted file to sync. It's not quite as bad as a pure web based password manager with JS crypto, and better still than a web based SSL transport-sec-only password manager, but still unacceptable.