Huh. Gotta admit, I'm rather distressed by this, but I'm trying to think through it logically.
* They still don't have access to my raw passwords. Everything's already encrypted before it gets to them, and they don't have the key. They just store the encrypted data.
* They however do control access to the account. This means there's a point where they get all sorts of data on me, and while I personally don't mind, I must admit I felt a bit safer when I thought it was a smaller, purpose-built company managing things.
* Then again, LastPass hasn't had the greatest user experience lately. A mixture of simply not doing the data entry on some sites, and having a poorly designed UI for mobile that feels like little more than an extension of the desktop experience(which doesn't work very smoothly on mobile- it needs to be rethought from the ground up) means that perhaps the new things LastPass could do with this funding would make it more usable.
But at its core, this is a security company to me. Probably the only one I pay for directly. I love change and expansion in so many other industries, but I suppose I'm just not used to it here- perhaps that gut response of "I want my security to be utterly solid because of how bad it could be if it goes wrong".
This isn't quite a reason to jump ship for me yet, but I'll certainly be duplicating work to other services(which so far, I've found to be quite inferior).
This isn't quite a reason to jump ship for me yet, but I'll certainly be duplicating work to other services(which so far, I've found to be quite inferior).
Did you try 1Password (which works with Dropbox, Wifi sync, etc.)? Not affiliated with them, just a happy customer.
For me look & feel and usability are nice, but not if it doesn't correspond to my needs.
I routinely use both a Ubuntu Linux laptop and a MacBook. Unfortunately 1Password does not support Linux.
And while I do use Dropbox, I like having the flexibility of switching to Google Drive. Speaking of look & feel, on Android the 1Password interface is the ugly duckling that doesn't use material design.
And back to price. At home I also have a Windows box that I sometimes use for media. My phone is an Android, but I also have an iPad. So 1Password would set me back $42 for OS X + Windows (includes the discount), about $7 for Android and another $7 for iOS. That would be $56 with the discount, or $84 without the discount. And that is expensive, I mean that's almost the price of an IntelliJ IDEA upgrade.
It's not terrible, I mean it does provide value and the price is sort of justified. But careful on the wanting to pay for things, as that's not how the world works. Do you know what happens to the farmers that invested money in the latest tractors and the seeds with the highest yield? Most are near bankruptcy, choked by loans and surviving on government subsidies. Just saying, wanting to pay for things is a sign that you've got more money than ability to spend, which is cool, but life is surprising and things change.
Keyword: "I". Personally I'd choose Keepass as it is OSS but we all have different priorities. Seems like LastPass has features targeted at enterprise customers and it's (unfortunately) rare that a large businesses makes purchasing decisions with a priority on UX.
Actually, I'd say 1Password is cheap for what it is; I opted to use it in my personal life because it was cheaper than LastPass. :)
The lack of enterprise features is a killer though. We currently use 1Password at work, but we're evaluating LastPass and Meldium as options to switch to purely for the password sharing, access control,etc. We don't want to switch, but it's not clear there's any option if you want to manage passwords reasonably smartly among a small team.
I take it you don't use login manager on mobile devices.
LastPass costs (or used to cost) $12/year while 1Password is $29, so if you intent to use a password manage for more than two years it's cheaper to buy 1Password than keep paying for LastPass.
And just a side note, I bought my 1Password for Windows, currently I'm using it on Windows, Linux, Mac and iOS and they all work fine. My OS X says that it's trial has expired, but it still works just fine, I can create new passwords and encrypt the old ones just fine. Maybe there are some pro features I'm not getting, but it's doing what I need it to do.
I don't know about that. LastPass wants $12/yr for their premium service. 1Password charged me $60 for the Windows + Mac bundle back in 2011. Other than the fact that you have to pay up front, the price seems similar.
My name is Eva Schweber and I work for AgileBits, the company that makes 1Password.
I would just like to clarify that AgileBits never gets access to your data or your Master Password. It is either stored locally on the user's machine or network or in his/her own Dropbox or iCloud account.
I've got it working fine with BT Sync. All you need to do is put the .agilechain file in a sharable folder and load it up with 1password on both ends. It syncs up just fine.
Don't get me wrong. It works for me including a slightly hacky way on iOS.
However, it would be nice to have official iOS 1Password support since I believe 1Password can leverage BTSync via API much like Dropbox for a much more seamless experience.
I prefer KeePassX instead, so keep it in mind as well. While I wish there was an official version for mobile and it integrated into the browser, I almost like the separation as I've gotten used to it.
It does, and that's how it works. Conflicts in vaults are also not an issue. When you get the 1Pass popup, you can specify the vault with a hot key (Cmd 1 for Primary, Cmd 2 for Corp) etc, and then choose from whichever vault, if there is any overlap.
As a primarily Windows/Android/iOS user, I bought it and find it much better than LastPass, which I also paid for. I do have it on my Macs, but I use those about 10% of the time, I'm mostly Win/Android/iOS. It works great across all the platforms I use.
Hi danieldk,
My name is Eva Schweber and I work for AgileBits, the makers of 1Password. I just wanted to thank you for sharing your love of 1Password with the other folks on this thread!
You guys might want to see if you can do a better job of publicizing the LastPass import. I googled for it and found some of your support forum threads where users had contributed scripts to do it, and I thought that was a bit iffy, so I resolved to deal with it later. I then saw another comment here that clued me in to the fact that LastPass has an 'export' feature that you guys can import from. 60 seconds later, it was done.
I'm sure you're getting a lot of new users today. Good luck! :)
I just bought 1password, switching from LastPass - one feature I really liked in LastPass was the ability to save the master password (I keep important passwords in my head and a password manager for less important things). Is there any chance this functionality will be provided? As it stands if I want to keep using 1Password I'll downgrade my Master Password strength (because it's a real pain to type it every time I reboot, especially on my phone) and that makes me feel more uncomfortable than knowing if someone knows my system login password they could compromise my vault...
LastPass did guard this functionality with a big "your security will be seriously compromised, are you absolutely sure?" prompt which I think is fair enough
You realize that having that option enabled is basically equivalent to having a plain text file on disk which has your passwords, right? If you encrypt your filesystem, this isn't so bad, but still any kind of remote execution exploit could basically gain access to all your passwords.
Well, it'd be encrypted with my login password as part of Keychain password storage under OS X (and with my device key + unlock code under iOS) so at rest it's still going to be fairly secure.
But, as I said, I don't use password managers for passwords that are really important, I use them for the bulk of online services where I'd like to use a different random username/e-mail & password for each.
We have had many requests to integrate GoogleDrive and it is certainly something we are looking into. Our Mac App Store app does allow iCloud syncing through Cloudkit.
Nope - no Linux client. Lot's of customers asking for one, too. There's a javascript client you can use on Linux, but a nice native Linux client would be ideal.
1Password is the only password manager that has been polished, feature complete, and low-impact enough to get me to actually use it. I gladly paid for it. If only all mobile browsers has easy ways for 1Password to integrate...
It's gotten a lot better, have you used the iOS9 app yet? Or I would imagine the Android app, their latest update on iOS is pretty good. While you are still using their app and spinning up a browser inside it, it doesn't feel that way anymore, and this is coming from someone suffering the pains of using this on an iPhone 4S.
It's usable with their javascript-based version, but someone has also written a 1Password-compatible clone that works quite nicely:
http://hg.icculus.org/icculus/1pass/
Can you tell me about any experiences with 1Password and IE ?
I've been a huge fan of the technical capabilities of Lastpass in general - I have many desktops and syncing generated passwords works great.
But it's never been something I could push to my business customers because it's never worked reliably under IE[0][1][2]. When I've bought this up in other forums, I only get the "oh.. using IE is dumb" sort of response, which is completely unhelpful for your average business. But it's an attitude I've often wondered if Lastpass had, based on their regular release cycles being heavily skewed away from IE[3].
0,1 and 2 are easily replicated in my environments:
For the secure storage of hundreds of passwords that sit in front of insane amounts of personal information, with support for auto-filling on desktop and mobile, easy syncing, archive sharing, and more...
It's really not that expensive for what you're trusting it with.
Edit: not affiliated, but it has to be my #1 favorite application on any platform.
> For the secure storage of hundreds of passwords that sit in front of insane amounts of personal information, with support for auto-filling on desktop and mobile, easy syncing, archive sharing, and more...
I have all those features plus a proper web extension for $12/year.
My name is Eva Schweber and I work for AgileBits, the makers of 1Password. I just wanted to thank you for sharing your love of 1Password! We love our customers and with folks like you, is it any wonder why?
Not cheap, but undoubtedly the most common paid app I use. For me, the workflow of jumping in and out feel smoother and saves time compared to other products I've used. It's only a few seconds, but to me at least, I stay much more productive and in flow, which easily makes it a cost savings.
My name is Eva Schweber and I work for AgileBits, the folks who make 1Password.
While it is true that we think it is important for our potential customers to know that we may charge for a future version of 1Password, we have only done this once in the 9 years that 1Password has been available. And that was after a significant upgrade from 1Password 3 to 1Password 4 when we rewrote the entire app from scratch.
Customers who purchased 1Password 4 for iOS have received free upgrades (including Pro Features) to 1Password 5 and 1Password 6. The same is true for our 1Password 4 for Mac customers, who received 1Password 5 (our current version) for free.
I'm still on v3. I have the family licence. I'd like to move to v4+ but I don't see a cost effective upgrade route, for windows, ios and android in my case.
My name is Eva Schweber and I work for AgileBits, the folks who make 1Password.
For Windows you are eligible for an existing customer discount. Just go to our store at http://agilebits.com/store and click on the Upgrade button under the license you are wanting to purchase. You will be prompted to enter your 1 Password 3 license code and then you will see the discounted prices you are eligible for.
We have also changed our sharing policies to match Apple's Family Sharing plan. Now a family living in a single household can have up to 6 users on a single 1Password for Mac or Windows license.
As far as Android goes, we have put the in-app purchase on sale for 40% off.
Hi Isn0gud,
My name is Eva Schweber and I work for AgileBits, the folks who make 1Password.
1Password is not a subscription service. Instead we charge a one-time fee to purchase the app. That license remains valid for the duration of that version's lifetime.
I tried it for all of a week in the past. It's the top one I'm looking at moving to, but honestly the reviews that have been done by users of both are lacking on information, so I don't know what I'm giving up.
Seconded, a really amazing UI and UX with security at the forefront. Not to mention the apps are updated often to take advantage of the latest iOS and OS X features (they support other platforms but I don't use those apps).
Even on Android 1Password feels like a first class citizen (I think some third party app integration is lacking but i'm used to going back and forth to copy passwords). I am very happy with what it provides.
My name is Eva Schweber and I work for AgileBits, the folks who make 1Password.
I don't know what version of Android you are on, but if you are running Android 4.0 or higher, you can use our snazzy Filling feature so you don't have to copy and paste Logins anymore. You will find more details here:
https://support.1password.com/guides/android/filling.html
I used to be a free user of LastPass and wanted a vault on-the-go. With LastPass the only option was an annual subscription, for an app that I didn't find particularly impressive.
Switching to 1Password was extremely easy. It offered simple instructions on how to import from LastPass and the pricing model (pay once for the piece of software) was a lot more compelling to me. As an added bonus, the app is super well developed and designed. It _just_ works, and works the way you expect it to. 100% satisfied.
My name is Eva Schweber and I work for AgileBits, the folks who make 1Password.
I'm so glad to hear that the transition was and easy one and that you are so satisfied with our product! I will certainly share your kind words with our designers and developers.
Been using it for years on multiple machines and iOS devices. Works great, and I happily pay for it every once in a while. I'd rather support a small company dedicated to this, than get a cheap product from a corporation with unclear goals.
My name is Eva Schweber and I work for AgileBits, the folks who make 1Password.
Thanks so much for appreciating our dedication to our product. Security is incredibly important to us and we take the quality of our work very seriously.
Eva - love your company and product, but you're spamming HN with this stuff. Update your profile to disclose your affiliation, up-vote the comments praising 1Password if you want, and answer questions candidly. Happy to see company reps participating in the conversation!
Just kill the "Hi so-in-so" and the boilerplate "I am Eva...". If all you have to say is thank you, upvote and leave it at that - your posts are taking up like 50% of the article commentary...
Adding to the other response here -- it's great to thank your customers, and you wouldn't want to hide that you're affiliated with AgileBits. But please bear in mind that people reading HN are here to read a discussion.
A good guideline is just "does this add useful/interesting content to the discussion?"; if not, think very hard before adding it.
Plus from the HN guidelines: Please don't sign comments; they're already signed with your username. If other users want to learn more about you, they can click on it to see your profile.
> "They however do control access to the account. This means there's a point where they get all sorts of data on me, and while I personally don't mind, I must admit I felt a bit safer when I thought it was a smaller, purpose-built company managing things."
I've never really understood the appeal of account-based password managers. It was a startup and it needed a business model, sure, so from the company's perspective it makes sense. But from a customer's perspective you're accepting a new type of risk that you don't have to worry about if you use a glorified encrypted list (e.g. KeePass) to manage passwords. The payoff is convenience, but personally no amount of convenience is enough to make me comfortable with storing all of my encrypted passwords on a single server somewhere and hoping that there are no exploitable security vulnerabilities (or malicious insiders who might seek to profit from finding or introducing them). Having an offline password manager that never uploads data to a server provides defense in depth, though it's less convenient.
Agreed. Logically, something like KeepassX (https://www.keepassx.org/) is the most logical, secure choice. I think a lot of people pick Lastpass and such for the convenience of browser integration, but I don't think that's necessarily impossible with keepassx - just so happens that nobody is really working on it (which is a shame).
This one in particular -- I use KeePass for my personal stuff, still; but at work, there seem to be a ton of logins we need to share.
Never mind sensitive stuff -- we get lots of use out of LastPass for managing the list of test and demo users on our site. We setup sandbox accounts (with various types of users) for potential customers. Each time the main logins to into LastPass, so if they run into problems, anyone on the dev team can help them out (with no other coordination required).
I've not been terribly impressed by LP's usability, honestly; but for quite a while they've seemed to be the only mature product in this space.
I've noticed Dashlane seems to be catching up here; I'm keeping an eye on them.
Beware, KeePass uses a weird custom key derivation function. LastPass uses PBKDF2 with a configurable number of iterations, a pretty widely accepted standard.
Maybe this has changed since I last checked but this and many other things seemed highly questionable on KeePass.
Back when I first signed up for LastPass, the killer feature for me was that it worked on my BlackBerry Curve. The fact that they made versions of LP for damn near every platform is what sold it for me.
I don't have a BlackBerry anymore, though. Now might be the time to jump ship.
I wouldn't consider Keepass the most secure choice. One of the most common attacks in practice is phishing, and browser integration discourages carelessly pasting your password into something that looks like your bank's site. The Chrome password manager and LastPass can help there, but Keepass does not.
It's true for any level of password management. KeePass is less secure but more convenient than simply memorizing each of your long, secure passwords. Choosing less secure passwords or repeating passwords is more convenient than memorizing long, unique passwords.
Finding the right balance of convenience & security is critical for securing the myriad accounts of the "masses." We know that the average person isn't going to bother memorizing long unique passwords - even the most security conscious person won't do that (except for maybe a handful of super-critical passwords).
> They still don't have access to my raw passwords.
> They however do control access to the account.
From point 2, point 1 is trivial to change. All they would need to do is update the extension or add some javascript (for the web login) to grab your master password in the clear.
Sure, a local password manager like Keepass could provide a new version that posted my p/w, key file, and DB up to a server somewhere, but I would have to manually install it, and it would have to get around a local program executable-firewall. No such challenges with auto-updating extensions and/or JS served from their server (or MITM.)
I don't know if the acquisition makes them more secure or less, but having worked at large companies, I tend to agree with:
> I must admit I felt a bit safer when I thought it was a smaller, purpose-built company managing things.
I have problems with the mobile also but there is nothing else that compares. Android has the standalone app and the integrated keyboard. Autofill with the keyboard doesn't work like the web browser, but you can still copy and past the individual fields. Is there anything else that has a good standalone mobile app, and has good keyboard integration?
LastPass has a web interface, is also available as a browser plugin and when I tried it the only password they asked for was my account password.
So how come they don't have your raw passwords? Because of their web centric approach, I doubt that they are encrypting it locally. And regardless, LastPass is a proprietary thing, so you can consider your passwords to be compromised anyway.
They are encrypting it locally. It isn't anything to doubt- it's been shown time and time again.
Nowhere in the payload that gets sent to them is your key. The only way you could consider your passwords compromised is if you think there's already a rainbow table out there to decrypt everything, which is ludicrous.
* They still don't have access to my raw passwords. Everything's already encrypted before it gets to them, and they don't have the key. They just store the encrypted data.
* They however do control access to the account. This means there's a point where they get all sorts of data on me, and while I personally don't mind, I must admit I felt a bit safer when I thought it was a smaller, purpose-built company managing things.
* Then again, LastPass hasn't had the greatest user experience lately. A mixture of simply not doing the data entry on some sites, and having a poorly designed UI for mobile that feels like little more than an extension of the desktop experience(which doesn't work very smoothly on mobile- it needs to be rethought from the ground up) means that perhaps the new things LastPass could do with this funding would make it more usable.
But at its core, this is a security company to me. Probably the only one I pay for directly. I love change and expansion in so many other industries, but I suppose I'm just not used to it here- perhaps that gut response of "I want my security to be utterly solid because of how bad it could be if it goes wrong".
This isn't quite a reason to jump ship for me yet, but I'll certainly be duplicating work to other services(which so far, I've found to be quite inferior).