Hacker News new | ask | show | jobs
by kennu 2475 days ago
1Password has always offered the best usability for me. Many other password managers (eg LastPass) have failed, for instance, to work with the AWS sign in page and some other tricky websites. 1Password UX is also well polished in other ways and is nice to use. I consider this kind of good usability to significantly increase my quality of life, since I login to various online services all the time and I want to eliminate as much hassle as possible.

I realize all this requires a great deal of trust in the maker of 1Password having done things right and currently I have that trust. This may change in the future of course.

6 comments

I also use 1Pasword. A while back there was a bit of a hullabaloo regarding the ability to extract passwords stored in 1P (and other password managers) from a memory dump[1].

I sent an email to the support team at the time asking some technical questions that the security report raised for me, and wondering how the team was planning to evolve the product going forward. They sent back a very in depth, detailed answer that included info about some of the experiments they were doing to decrease the amount of time passwords were decrypted in memory, along with looking into Rust for better direct memory management than they could get with C# or Swift. All in all, the care and quality of the response gave me a great impression of the team and of their approach to user interactions.

[1]: https://www.securityevaluators.com/casestudies/password-mana...

I read up on their blogs and as much technical explanation as I could find, and by far 1Password seems to be the best with a cloud offering.

Also Apple buying into using 1Password company wide helps gain some trust (I am sure there was some serious auditing): https://medium.com/enrique-dans/apple-and-1passwords-deal-sh...

> Also Apple buying into using 1Password company wide

Huh! One would assume, they use Keychain with iCloud?

The biggest problem with keychain for me is that it's only _your_ passwords. If you need to share things, then it's useless. 1Password is great for keeping logins for services that are in either mine or my wife's name. (Health care, 401k etc).
I've been pretty happy with 1Password for the last 3 years or so. The only point where I had a trust problem was when they introduced subscriptions (which is fine, I happily pay software subscription fees for good software, because that way the software is sustainable), but migration involved creating an online account and entering my secret password in my browser. That is something I always find scary: yes, they do assure me that it's just locally-run JavaScript, and the password never leaves my computer, but still.

In other words, I am somewhat scared, but the usability is so fantastic that I find the compromise reasonable, especially with 2FA (TOTP or U2F using YubiKey).

Now, if only Apple finally learned that prompting me for my Apple ID password in a modal popup whenever they feel like it, without the ability to auto-fill is a no-no...

The main issue of 1Password is the subpart Linux support (there only are browser extensions).
It becomes hard to discuss "1Password for Linux" without knowing if you mean 1Password.com or the old 1Password, with .opvault locally and/or synced to Dropbox-esque

However, if it's the latter, KeePassXC now knows how to read the .opvault format: https://github.com/keepassxreboot/keepassxc/issues/1462 I could imagine teaching it to write their opvault file format, too, but at the time it wasn't a use-case that I needed

I would actually suspect teaching KeePassXC to read the 1Password.com cached vault would be even easier, since they now use sqlite3 for storage, but it would still -- afaik -- be confined to your local machine since their web API is undocumented

There is also a command line application: https://support.1password.com/command-line-getting-started/
I'm a cloud 1pass customer, but the UX leaves something to be desired, especially for a cloud app.

When adding an account to 1pass, it's important to click [save] before closing the tab, otherwise it's lost. (Having to pull passwords out of the PW generator history is a hack.) (It does support my belief/their claim that the pw decryption is done locally though.) To be fair, it used to be that you could accidentally click on the left pane and lose the unsaved account - they've fixed that in the latest of the 1PasswordX extension.

I haven't moved my entire life to 1password, so I don't have, eg, my passport or SSN or any outdoor license's in the system, and the inclusion of such things degrades my user experience - imo the new button should make a new login, with a button on that panel/page to change type, rather than making me pick which type of secret I'd like to create when I hit the [+].

I have, however, added my credit cards, but as far as UX, in the main UI, I click on the credit card category, then click on the search and try to search for a website login, only to have 0 results. Not surprising, I don't have an ycombinator credit card, but search results pane could surface hits in other categories if there are zero hits in the selected category - most (all?) of the data in 1 password is text, so I'm doubtful that full-text search is that expensive.

1PasswordX (the obvious chrome extension to install) doesn't work with TouchID without some extra configuring. (I set that for less technical people in my life, and that only came up after asking them why they stopped using 1pass.)

I'll give them a bit of pass on the difficulty of adding accounts on ios, but where many/most websites use email as username these days, maybe that could be autofilled when adding/creating logins manually?

And for my gripe about cloudification - I'm reasonably happy to pay a subscription (I currently pay for one, and am hopeful they're working on ^ UX issues), but every time I add something to 1pass, I question if adding secrets to a cloud/SaaS app, is going to royally fuck me over if AgileBits ever shuts down. Being able to save file-based backups to various places was reassuring. (Yes, this is a UX issue - it's not great if a customer questions if they want your product, each time they make the product more useful for themselves.) (See also: Trying to choose a Netflix title to watch, and giving up in disgust.)

TBC, I'm a (reasonably) happy customer, but I wouldn't hold up their UX as "well polished". I don't use it as a selling point when trying to convert people, certainly. At least I don't have to interact with it for the most part - I click into a password field, authenticate, and click autofill.

I love 1Password but haven't upgraded specifically because of the cloud service. All my stuff is already in Dropbox, and 1Password essentially came to it's old users touting a subscription fee to a functionally identical service. Why am I paying them every month to store my passwords when I'm already storing them myself?

I'm sure I'll have to cave at some point what with the ongoing march of progress, but it leaves a bad taste in my mouth whenever a previously purchased product (i.e. 1Password) suddenly is asking for more money with no perceived benefit to me, other than getting to continue using a product I already bought.

They make it very non-obvious, but you can buy a standalone license for 1p v7 after downloading here: https://1password.com/downloads/
I’m actually on the same boat, and I haven’t been able to upgrade to any of the newer releases of 1Password due to this. I feel exactly the same way. I refuse to cave though!
The only feature I’m missing with my old old 1Password is Have I Been Pwned integration, and that seems iffy now that it’s shutting down.

Software has switched to a subscriptions, but They don’t offer any benefit over the original purchase price structure to users. It feels like the ultimate admission that the product has reached maturity, and so it’s time to rent seek.

I’ve considered switching to Bitwarden or Firefox Lockwise, but honestly, 1Password still works, and so there isn’t much impetus to migrate.

I upgraded to 7 with the license payment ($49 seemed fair to me). Biggest value add with the upgrade is the google authenticator integration which is useful for sites that support it.

I would stop upgrading if agilebits ever drop local vault support though.

> and I haven’t been able to upgrade to any of the newer releases

Why not, i use iCloud to store my 1Password data, and i still use the latest macOS 1Password version (7 i believe). It's a standalone app without a subscription (i would never pay for a subscription just because they tacked on a cloud service I don't need, to justify the subscription model...)

Maybe it’s different for iCloud users, because 1Password doesn’t let me upgrade to version 7 without paying for a cloud subscription (by the way, I use Dropbox for my data).
If i remember correct, 1PW7 from the App Store is subscription only, and if you want a single licence you have to get 1PW direct from AgileBits.

https://1password.com/downloads/