Hacker News new | ask | show | jobs
by RubberShoes 1581 days ago
I have used 1pass for years. I think I bought my lifetime license sometime in 2014? I loved it and even advocated for our 2000+ company to adopt it back in 2018.

I would say in the past 2-3 years it has slowly become an absolute nightmare. I do not recommend it to anyone anymore. They have somehow screwed up the very basic functionality of filling in passwords on any browser I try. They continue to shift features around, break existing workflows, and even the basic tasks I rely on dozens of times a day seems to change with any significant release.

1Password got famous for building a great core product. It managed my logins I stored myself and autofilled them wherever I needed. It was clean and simple. Now they are so focused on growth and Product features like this that they have completely lost their way. As of this week I can no longer right click on a webpage and work with 1pass to find something. If the webpage attached to the original 'save login' prompt is not the one you are on - the auto popup underneath the login field has nothing to show and I cannot manually find and enter it. I have to go to the Desktop app, search, find, and copy. My team regularly wastes minutes on this each day.

Our company reevaluates platforms every couple years, in the next 12-24 months I will strongly advocate we find an alternative.

16 comments

This is weird, I legitimately have none of these problems. I use Firefox, and the extension story has gotten a bit more odd in the last couple years*, but I don’t feel it’s any less reliable. The way 1p handles 2FA is really slick in my opinion, auto-filling the code after a login screen and even hitting return for me most of the time. Honestly the only rough edge I hit is when browsers try to force their own password management, and end up fighting with 1p for password generation, saving login details, etc.

* to expand on this, the model used to be a desktop app where the magic happened, plus a thin browser extension that hooked into the app. Now, there seems to be a lot more happening in the browser extension, which seems to talk to the cloud service and not directly to the desktop app. (Totally possible this is completely wrong, just my WAG)

Isn't storing passwords island 2fa in the same place a bad idea?
It's not as strong as storing them in an entirely separate device (although hardware keys are even better).. however I suspect most people would have their 2fa generator in the same place as 1password (eg. Google Authenticator on the same phone).

It still provides improved security in case of things like server-side credential breaches.

They discussed it on their blog here: https://blog.1password.com/totp-and-1password/#totp-isnt-the...

Honestly I find one of the biggest missteps for me is that they started injecting UI into the web page itself.

I'm sure it reqires less work from the locally installed app (and lets them do away with it altogether, even), but it creates issues - it obscures UI elements in the page with a hard to dismiss overlay (no obvious clickable way to do it) that fits below webpage UI elements when it's heuristics identify it as an appropriate field.

edit: plus I regularly find that when I try to fill form fields in Safari and Firefox that selecting the appropriate login and hitting autofill does absolutely nothing.

Yes, I agree. It's a real pain in the ass. That and still not allowing to ignore localhost for password fields...
> They have somehow screwed up the very basic functionality of filling in passwords on any browser I try

UGH YES. When I started using 1P (2015ish?) it was simple and reliable, and I feel like I fight it more than I use it these days.

The biggest issue for me isn't anything that's really 1password's fault but rather web application developers not detecting that a username/password field has been filled because 1password did it.

Developers need to stop disabling the form buttons trying to be clever detecting if fields are dirty.

> 1Password got famous for building a great core product. It managed my logins I stored myself and autofilled them wherever I needed. It was clean and simple. Now they are so focused on growth and Product features like this that they have completely lost their way.

The issue is, the "core product" has been Sherlocked - i.e. is now an included feature on many operating systems and browsers. Apple's iCloud password manager is available on all Apple platforms plus on Windows. Android/Chrome and Windows are improving their in-built password managers as well.

So 1Password, as a business, has to pivot to selling to businesses, which is where they expect most of their revenue to come from. This has resulted in individual customers being sidelined, so perhaps you should switch to one of the free inbuilt alternatives.

> They have somehow screwed up the very basic functionality of filling in passwords on any browser I try

What browser/sites are you having issues with? I've only been using 1Password since the Lastpass changes last year or 2 (I forget) but havent run into a site I can't autofil. I actually found it works in places Lastpass used to let me down such as CapitalOne

Chrome for work, Firefox for personal. Both macOS and Windows 10. I am in contact with 1pass on Twitter, followed their recommendation to turn off the legacy extensions Desktop App Required and it is still broken.
USAA (bank) as of a few seconds ago.
What's changing? It's been filling passwords for me just fine in browsers for years, if anything it's gotten better about it. The problems you cite with it not finding the right login happen with other managers too and they aren't as good about it.
> They continue to shift features around, break existing workflows, and even the basic tasks I rely on dozens of times a day seems to change with any significant release.

That shouldn't be a matter of opinion, yet it doesn't match my experience at all. 1Password 7's UI and workflow did not undergo a dramatic change in the past 2-3 years. Not even once. The UI and controls looks and feels the same as ever as it did back in 2018. I'm sure the periodic updates brought new features here and there, but none of those are even remotely close to being a disruptive change.

> If the webpage attached to the original 'save login' prompt is not the one you are on - the auto popup underneath the login field has nothing to show

That's a legitimate security measure. It's making sure that it's autofilling for the right domain. If you want working autofill, you just need to make sure that your password is associated with the right domain.

> I have to go to the Desktop app, search, find, and copy. My team regularly wastes minutes on this each day.

You only need to make an edit once to associate your password with the right domain. But if you can't be bothered, searching and copying the password is a "Cmd + \" away. It takes less than a second.

It's not a security measure because the original comment spoke about how they couldn't even search for the login inside of the autofill icon. I've had that issue too and it's very frustrating. Yes, it makes sense not to show it by default, but to disable any sort of search functionality inside of their new autofill UI is annoying.

Edit: This was not an issue before 1-2 years ago when they pushed massive feature updates. It used to be Ctrl+\ or Cmd+\ to autofill and boom, the login was filled. But NOW they have decided to drop a "1Password X" browser extension that throws itself into every single login item on the web and constantly harasses the user any time they use keyboard shortcuts to navigate. Typing an email address and see your Firefox/Chrome/Safari autofill show up with a dropdown of emails to choose? You can't even use the arrow to go down and choose one; 1Password X will rear its ugly head the minute you hit the arrow down, and it'll either prompt you to autofill something or save what you just typed into 1P.

I can start searching for passwords by either

* invoking the "Cmd + \" shortcut

* clicking on the browser extension button

* clicking on the icon in the system menu bar

None of those introduce meaningful speed bumps.

I have used 1Password since way before the cloud version became the default. I loved the product... and I still do! I moved to the cloud version and the experience has been really slick.

I actually think the product is well thought-out and designed. There are some website where it refuses to work, but these are in the minority, and I blame the websites for breaking 1Password, not 1Password.

Also "a nightmare" -> this feels like an unnecessary hyperbole

I'm just as frustrated, but given how convoluted and complicated web site authentication has become, I've blamed the web sites, not 1Password. They can't possibly be expected to handle every scenario that every major internet site comes up with, and festoons with trackers and ads and javascript malfeasance and second-factor redirects. I guess if you're right, and 1Password is, in fact, to blame for this mess, then you'll find a great alternative. I just hope you post it back here when you do.
That's a great point and something I was very okay with because I could still navigate 1pass to the necessary fields. Google broke the automatic user/pw/login flow years ago but being able to still manually right-click on the necessary account for each stage of the login was easy. This is no longer possible. The blank suggestions they shove underneath every available field breaks my ability to click something that the browser itself might have stored and never has what I need. I am back to copying and pasting from the app itself.
> the webpage attached to the original 'save login' prompt is not the one you are on - the auto popup underneath the login field has nothing to show and I cannot manually find and enter it

Is it the same URL as what was saved in the login? If not, then this is intended behaviour to stop phishing attacks and has saved my butt several times. If the autofill doesn't work, either the website has changed the base URL, I've misconfigured it, or it is a phishing site

> I have to go to the Desktop app, search, find, and copy

Use the browser extension?

I'm not sure what issues you're having. Personally not only has the product improved every year, trying other password managers makes me realise what a hard problem autofilling is and how little I have to think about it with 1P. The new desktop app has some issues though and some missing features though it's pretty snappy

To both your points - a great example is right here on HN. If I right click and go to 1pass, I no longer can open any mini window. I instead am given the option of Lock, Save Login, Help, or Hide on this page. Completely breaks my 5+ years of muscle memory to right click on a field and find what I need.

Now if I open the browser extension in the top right, my Favorites are not my favorites...they're the favorites of my team and one of my shared vaults. My Suggestions tab is empty. And even better, when I search "ycombinator" or "hacker" or "hn" nothing comes up. "No results found in All Vaults" and if I click search everywhere I get "No results found"

Now when I go over to the Desktop app, I search any one of the above and I immediately find my credentials for HN. It's stupid simple just like it used to be in the browser.

That is interesting. When I read your initial comment, I was completely bewildered because the software keeps getting better and more reliable and the new browser extension saves me lots of time. It wouldn't have occurred to me to use that right-click menu for anything, though, and I can see how it might have done something useful in the past for you. Different experiences that happen to share a product name!
Hmm yeah I'm really not sure what the issue is here. Maybe try contacting support on their forums if you've not already. I never really used the right click menu and never needed to so far since the suggestions have always worked so maybe there's some other problem you're facing
> If the webpage attached to the original 'save login' prompt is not the one you are on - the auto popup underneath the login field has nothing to show and I cannot manually find and enter it. I have to go to the Desktop app, search, find, and copy. My team regularly wastes minutes on this each day.

This saves users from choosing their “Google” login to use with “G00gle” - why not take the minute or two to update the password entry once with the correct or additional hostnames/websites and be done with it rather than wasting time every time one logs in (as well as encouraging bad security hygene)?

> I have to go to the Desktop app, search, find, and copy

Agreed, the Chrome browser extension and the Safari inline menu are garbage. Fortunately the classic extension is still available and still works great for me, as well as Safari with the inline menu option disabled. Same for the iOS extension, garbage. But luckily the classic password autofill on iOS still does work great.

I use the Firefox extension on desktop and have no issues. But the iOS one, I have to agree with you, is pretty garbage. It only works half the time for me. It doesn't prompt when I'm in a username field consistently, and sometimes doesn't fill the password on the first time, forcing me to hit it again or copy paste. I find myself more often having to physically navigate to the app, type in my username, and copy paste my password.

If you are using the classic autofill don't you have to maintain your password in keychain as well as 1Password?

Your reliability issues differ greatly from my experience using 1Password over…what…10 years? If anything, I’d say that the new generation of browser extension improved reliability. The UI injection only irks me for puritan reasons, but i reality seldom have issues with it.

Not to say that you’re “wrong”, but since we are sharing experiences…

My experience has been completely the opposite, works like a charm.
Curious which OS you're using?

I have found the user experience is much worse in windows than it is in macOS. Same browsers on both.