[jshelly]

This is strictly a business decision with no regards for serious security.

A subscription model is in their belief the only way to maintain a sustainable business model that includes growth by providing SaaS with recurring revenue. Old school static licenses with local storage will not provide recurring revenue.

Edit: removed a word

[wlll]

> This is strictly a business decision

This is my interpretation of the situation having read the (IMO) train-wreck of a blog post excusing this change: https://blog.agilebits.com/2017/07/13/why-we-love-1password-...

> A subscription model is in their belief the only way to maintain a sustainable business model that includes growth by providing SaaS with recurring revenue. Old school static licenses with local storage will not provide recurring revenue.

However I don't really agree with this. I've been buying 1Password since at least version 3 and don't see any reason why I would stop, I've recommended the app to family and friends, and I've bought licenses for my family. 1Password had a sustainable business model, they sold quality, recommendable software with upgrades every couple of years.

edit:

I realise now that "This is strictly a business decision" and "1Password had a sustainable business model" might be seen to be contradictory, but I do see differences. With 1Password subscriptions they will make more money than I estimate I spend on the standalone product. It also means the work put into new features is de-coupled from a release cycle, and therefore the money coming in.

[jshelly]

I am also a long time customer of 1Password.

Unfortunately or fortunately (if you are a shareholder of a SaaS public company) we have seen a mass exodus by corporations (see Adobe, MS/o365, Quickbooks, Basecamp, etc.. etc..) that have moved from the traditional purchase a license model to the cloud based subscription model.

While I do understand the benefits of storing certain information in the cloud (GitHub!) when it comes to the storage of critical information such as passwords I'd rather be in control of that information myself and on my own hardware.

While 1Password is correct in suggesting that the cloud model may be the best solution for average users, it runs face first into the best practices of security conscious professionals.

I would personally be willing to pay a premium for a "Pro" version of 1Password with local storage and keep the cloud based subscriptions for people that are either unwilling to or do not have the skill set to manage a local security store.

One more additional note, a move like this should have been more transparent from AgileBits. It looks a bit like they tried to slip one past the goalie, which isn't going to give anyone the warm fuzzies especially when it comes to security products.

[wlll]

FWIW Basecamp (disclaimer: used to work there) never had anything other than a pay monthly SaaS model, and IMO it makes sense given the amount of time people actually spend pulling dynamically updated web pages from the server and is more akin to Github in the usage pattern than something like MS Project or Quickbooks (It's secretly a communications tool).

[peteretep]

    > I've been buying 1Password since at
    > least version 3 and don't see any reason
    > why I would stop

They're going to struggle to add much in the way of new features I'm willing to pay for, I suspect, which is a problem for them.

[kemonocode]

Wow, what an overly saccharine blog post. Way to reek about insecurity over your own product when your prose comes off as nigh-Orwellian and you get everyone in your team to grin as hard as (in)humanly possible and kiss their own asses in the comments.

[jshelly]

I was about to say this was a marketing department dumpster fire, but then I made it to the comments section. FFS AgileBits what happened?

[eeeeeeeeeeeee]

I have no issue with them moving to a subscription model and encouraging it. I want to see the company sustain itself, which is a lot harder to do with one-time license purchases.

I think the main issue here is that it doesn't sound like using 1Password via the web browser is a good idea. It also doesn't seem like the onboarding process makes it as clear as it should that your passwords are going up into the cloud instead of only being stored locally (even if the crypto is fine).

[avaer]

Moving from local storage to remote storage has "no regards for serious security"? Am I missing something?

EDIT: My misunderstanding! I thought it was an implication that it does not change the security parameters.

And I completely agree: it's a business move that capitalizes user trust.

[dsr_]

Yes. "no regards for serious security" means that the software has not taken security as a high priority.

You seem to be interpreting it as the software changes not making a difference to the security stance.

[devopsproject]

There will likely be significant savings on the support side too. I can't imagine how many times they have to help people find their vaults