
1Password moving from local storage to cloud subscription - wepple
https://motherboard.vice.com/en_us/article/evdbdz/why-security-experts-are-pissed-that-1password-is-pushing-users-to-the-cloud
======
rdl
Ugh. This is forcing me to find a new password manager (not just the current
position of 1Password, but their product direction).

I can't put all of my secrets in a file, encrypt it with software a site
provides, let that site push updates to me for that software, and then give
that site the resultant encrypted file to sync. It's not quite as bad as a
pure web based password manager with JS crypto, and better still than a web
based SSL transport-sec-only password manager, but still unacceptable.

~~~
yladiz
Why is it bad? The only difference with the current, "local" approach and the
1Password cloud approach is that the password vault will be stored on their
servers rather than something like Dropbox or iCloud.

~~~
rdl
AgileBits can't (easily) steal my password vault on
iCloud/Dropbox/WebDAV/local, even if they put a backdoor into a binary which
they ship me (I can whitelist what the app talks to). Dropbox can't easily put
a backdoor into the 1Password code from AgileBits. No single party can do it
alone.

Apple could still single-party screw me, but they're huge, and if they did
this in even one documented case they would probably lose $100B in market cap,
and Tim Cook has shown he will push back when ordered to do stuff like this.

~~~
the_common_man
Not sure if it's wise to use the product of a company you don't trust for
something as sensitive as passwords. I think you were better off using some
other software to start with.

~~~
rdl
1) There is nothing better in terms of overall security+UX out there. It would
take hundreds of man hours to build a personal solution, and thousands for a
distributable solution.

2) Until recently, the direction they were moving in was good, even if their
current position wasn't ideal.

3) It isn't so much that I think they could be malicious as that I don't trust
them to have enough internal controls against external compulsion or an
employee with prod access getting hacked.

There are some passwords I don't put into 1Password (PGP, etc), and I try to
avoid having passwords-only as auth credentials for anything important. So it
is more I would have hundreds or thousands of low to medium security site
passwords at risk, which in aggregate would be a huge inconvenience. That is
more because I don't have huge faith in the local OS security on machines than
1P as a particular risk vector.

------
gumby
It's all about the threat matrix. My parents use 1password because they
otherwise would always use the same one (my mum) or keep them on an elaborate
spreadsheet hidden someplace and sometimes hard to find (my dad).

For them, the risk of their un-backed-up computers crashing and them losing
all their passwords is higher than the risk of the cloud storage being
cracked. They already trust Agile Bit's security since that company writes
1password and hardens it against local attack.

Now, ym _M_ v, but I suspect for 99% of users this is the right thing.

------
darrmit
This is frustrating. I originally moved from LastPass to 1Password several
years ago because of how they handled syncing.

I was one of many to complain about their new Windows app when they started
only supporting local vaults read-only. They assured me they wouldn't be
forcing users off to the hosted version, but that's essentially what they're
doing for anyone using the Windows version.

For what it's worth, the hosted version is nice - particularly for non-
technical users - but not sure it's worth the monthly fee when I can use open
source alternatives like KeePass with few trade-offs and also not sure it's
worth supporting a company who is forcing the move to a recurring subscription
despite the negative feedback from some of it's oldest supporters.

------
yladiz
Although I prefer the local storage option, I do agree with the premise that
most people don't back up their stuff properly and a cloud based storage
should be, in theory, better for the average person. And having worked
directly with the 1Password vaults on Mac OS and creating a library to read
the data, as well as knowing that security experts have reviewed the white
paper and trust it, I trust that it's secure. I also trust that 1Password,
unlike something like LastPass, doesn't seem to have many exploits, and unlike
other kinds of password managers, does sync to my phone and have a direct
integration with Safari and a few other apps, which is really useful.

So, trusting the team behind 1Password's security, is there anything wrong
with this beyond now there is a subscription rather than a one time fee, or is
this just Vice's normal MO of being edgy, and taking a relatively
insignificant controversy and making it something more than it is?

Also, am I wrong in assuming that the "local vault" isn't going away, and the
only difference is now the subscription model and that they are syncing with
their own servers rather than Dropbox or iCloud?

------
mockindignant
I discovered this a few months back by participating in their beta. I will not
give them any more money. I wish them luck, they had a great product that met
my requirements. Now they are moving i na direction where they will not
support my requirements.

Unfortunately for them I purchase and maintain this stuff for everyone in my
family, so they are actually losing several customers.

------
dkonofalski
I still can't decide if this is a deal-breaker for me or not. We use 1Password
as a team solution by syncing to the same Dropbox account and it's worked
beautifully so far. The main issue is that I'm not sure our team has a budget
to pay every month for this where we were paying a flat fee for the current
version of the app. I realize that I would gain some features by moving to
their cloud solution but none of them seem compelling. I'm glad that they're
not removing local support but it does make me worry for the inevitable day
when they do.

------
mayoff
I’m pretty sure this article is making unverified claims. Here’s my
understanding from reading some threads on Agilebits’ forum.

All native 1Password apps (mobile and desktop) support creating, reading, and
writing local vaults, _except_ 1Password 6 for Windows, which only supports
reading local vaults.

The reason 1Password 6 for Windows doesn’t support writing local vaults is
that it is a ground-up rewrite of the Windows app, and they have focused their
efforts on cloud support since they see that as their main storage offering.

There’s been no indication (afaik) that they intend to remove local vault
support from the other clients. Rather, they have indicated that they would
like to add local vault support back to the Windows app but it’s not a high
priority. See this forum post from April
([https://discussions.agilebits.com/discussion/comment/365276/...](https://discussions.agilebits.com/discussion/comment/365276/#Comment_365276)):

> Windows is the rare exception where we have to build a brand new program and
> we're starting out with 1Password.com memberships first and hopefully add
> local vaults.

~~~
newman314
They had a blog post that claimed that they were going to add local support
when the Win10 version was first announced but quietly never provided said
functionality.

That said, I'm quite disappointed in the direction that they are taking and it
certainly feels like a money grab to me.

1Password could expand to add things like ssh key support etc. and I would be
happy to pay for an upgrade just not an ongoing tax.

------
coldtea
Really? If so, this is where they are losing me...

------
tkrupicka
Unrelated but when I opened this article the react developer tools popped up:
seems Motherboard isn't using the minified version of react in production.
Someone over there might want to look in to that.

------
fencepost
The question I'd have is whether their cloud-only solution is significantly
(or at all) better than other cloud-only solutions such as LastPass?

For local storage, KeePass seems like an obvious choice, but I'm not sure that
I'm as thrilled about its wide variety of plugin, etc. options - suddenly
there's not just one set of developers with auditable code, there's the core,
the browser plugin, maybe a few other things as well.

------
Inconel
Does anyone have experience using the Secrets[1] password manager on MacOS and
iOS or opinions on how it compares to 1Password security wise? It seems to
allow local vaults with iCloud Sync and the pricing is a one time payment as
opposed to a recurring subscription model.

[1][https://outercorner.com/](https://outercorner.com/)

------
lern_too_spel
The app auto-updates, so you already have to trust 1Password's operational
security.

