They sponsored Gophercon in 2018(?). I didn't even know they use Go.

Good luck to them and hopefully they will keep us from password disasters of the future. Now, if only I could convince everyone to use a password manager...

These also have another distinct change beyond simply pricing, they're actually hosted in those regions. So .ca is hosted in Canada and .eu is hosted in the European Union.

Kyle

[1]: https://support.1password.com/regions/#change-your-region

Why was it not as good as lastpass?

Ah, GitHub. The company which was bootstrapped and profitable like 1Password, but then took venture capital, became unprofitable, and had to sell to Microsoft. Let's hope they aren't the GitHub of password management.

Not only that, but the GitHub product is getting much better under Microsoft.

So overall I think it was a win for consumers too.

There were also rumors of an acquisition at the same time, which were denied.

This is good for users as it likely mean not huge changes to appease corporate overlords, but continues the sad story of limited young, profitable, small-cap Canadian tech companies available for outsider, passive investment. There are quite a few in the category of 10-15 years old, solid revenues/profit and founders that are ready to step back; most choose private equity or sovereign wealth funds investments in the 100M - 1B range over going public because of the hassle and reporting requirements. The average individual investor doesn't have access to these deals which is a shame because they tend to be established, profitable return generators. I don't blame the founders; I'd likely do the same route.

I really did laugh out loud as you make it sound so easy. Having said that the money isn't in the consumer side, but the Enterprise. 1Password is only just entering this market and there are huge potential.

I am grabbing AWS keys from MacOS keychain and can access creds I save in iCloud from any device. Uh oh 1pwd

If you have cross platform to support, and want the best experience ( or I should say equal experience ) than a decent third party Password Manager is the only way to go.

I would have thought Google would be interested in this market, but ever since the birth of Android, all the wanted is Chrome or Android Integration.

I wasn’t implying that at all. I said “OS vendors” and used my anecdote as one example of what I mean.

It allows you to use smart unique passwords, syncs between devices, and uses the OS master key to hide the passwords.

It's not great, but it's probably good enough for many people.

> should be relatively straightforward.

I run a self-hosted bitwarden server, which I love.

But the client is, in my opinion, not nearly as good as 1password. Its login detection is often disruptively wrong. The need to unlock the keychain each time you start a client is aggravating. The fact that the keychain doesn't lock itself when I lock the worstation is more aggravating. It's sensitive to server downtime when it should be able to work offline. The desktop app is either electron or something very similar and chews battery for me if I accidentally leave it running. 1password's secure notes are far richer. 1password's storage for software licenses is useful and bitwarden offers nothing similar that I've been able to find.

I'm not saying any of this to shit on bitwarden. I like it, and pay for it both in dollars to bitwarden and in time spent keeping the server running/patched. (Which I know is optional, but I really like having it self-hosted).

If 1password could offer me a decent linux desktop experience and a self hosted server, I'd switch back. I liked it that much better.

Have I Been Pwned partnered directly with 1Password, which is probably why they're able to send out notifications directly; Bitwarden has to worry about being rate-limited.

I'm not too sure what's meant by MFA availability, but Bitwarden also lets you use it as a TOTP generator + use 2FA for logging into your vault, though those are premium features.

If 1Password's claim to fame is functionality beyond password management, so be it, but that doesn't define it as better but rather broader scoped.

edit: I'm wrong, it didn't support touchID in OSX https://community.bitwarden.com/t/touch-id-support-for-macos...

I think when they switched to subscription model they left people who didn’t switch on an old version

It only beats 1Password on price.

If you don't want to pay for a fucking awesome app, good riddance to you.

https://news.ycombinator.com/item?id=21172569 is a good discussion on it.

When my current native install of 1pw stops working I'll be migrating elsewhere.

I haven't verified this myself, but standalone licences seem to be available for purchase in the app itself: https://discussions.agilebits.com/discussion/92275/how-do-i-...

Hence it's there, but intentionally dark patterned to near invisibility. They would prefer everyone on the pointlessly expensive sub.

> 1. Information We Collect and Receive

> Service Data (including Session and Usage data):

> When you use our Services, we receive information generated through the use of the Service, either entered by you or others who use the Services with you (for example, schedules, attendee info, etc.), or from the Service infrastructure itself, (for example, duration of session, use of webcams, connection information, etc.) We may also collect usage and log data about how the services are accessed and used, including information about the device you are using the Services on, IP addresses, location information, language settings, what operating system you are using, unique device identifiers and other diagnostic data ...

> Third Party Data: We may receive information about you from other sources, including publicly available databases or third parties from whom we have purchased data, and combine this data with information we already have about you. We may also receive information from other affiliated companies that are a part of our corporate group. This helps us to update, expand and analyze our records, identify new prospects for marketing, and provide products and services that may be of interest to you.

> Location Information: We collect your location-based information for the purpose of providing and supporting the service and for fraud prevention and security monitoring. If you wish to opt-out of the collection and use of your collection information, you may do so by turning it off on your device settings.

> Device Information: When you use our Services, we automatically collect information on the type of device you use, operating system version, and the device identifier (or "UDID").

That's pretty much everything given they put an extension in your browser and can collect all of that info for every page you visit

> 4. Information Sharing

> ... We may share your personal information with (a) third party service providers; (b) business partners; (c) affiliated companies within our corporate structure

> Examples of how we may share information with service providers include:

The above basically says they share your info with anyone they feel like

So I don't know how you think my comment has no basis in fact. They spell out what they can do in their privacy policy. Why would they spell it out if they weren't doing it?

Compare to 1password (note I use neither service and am in no way affiliated with 1password but for comparison it's telling

> Your data is yours, and we don't want to know anything about it. We don't use it, we don't share it, and we don't sell it.

> We only collect the information necessary to provide our services and help you with troubleshooting. Personally identifiable information is never shared with third parties.

People on HN complain about Google collecting and yet we seem to have LastPass with access to all webpages you visit and also able to track every service you use them with an their policy basically says they collect and share your data (something even Google doesn't do. AFAIK google doesn't share data)

This is not helpful. Why did you hate it?

The YC darling DropBox still isn’t profitable and probably never will be as they are becoming “just a feature”.

1Password will doubtfully never be profitable enough to be worth $3.2 billion. Whether they can pawn themselves off to the public markets first is another question.

And Google and Microsoft do exactly that already.

But if you define success as a company that can actually turn a profit consistently, Dropbox is not a success.

It doesn’t take too many deals with huge companies who need cross-platform to get to $200-300 million, and “worth” $3.2bn. Multiples from revenue have been a little interesting lately.

People made the same argument with Slack. How is that working out?

I don’t know about Android, but iOS supports third party password managers through the extension system.

I think competition in this space is good but I use and like Slack over Teams.

I know at least two companies who pay Slack over $20MM a year, and have over 100k users provisioned onto Enterprise Grid, and who are also happy consumers of Microsoft Office 365.

Being able to sell $1 for 95 cents is not a successful business strategy.

1Password fixed that and numerous UI glitches around the actual password filling in that I was just living with. It is night and day a better experience ... and no invested interest in them (unfortunately!)

https://1password.com/teams/pricing/

"Free family accounts for all team members - $60 value per person"

What happens if Apple implementes their own native password manager into macOS and iOS? I know I would switch to Apple's native assuming it worked as well as 1Password.

Then there's the risk of me putting everything in there and them jacking up the price. I'd either have to eat it or manually migrate everything.

There are other concerns as well. And I'm not saying I think they are dishonest. But when there are open source methods that are free and battle-tested for security, I see no reason to go with a paid option.

From the link:

> Your data is yours. Even if you cancel your subscription and your account is frozen, you can still sign in to 1Password.com or in the apps to view and export your data.

In the end was more happy with KeePass as 1Password was too user-friendly for me and I wanted something more stupid for passwords.

I paid for it once and then used it for years and years without updating. After a few years the browser extension stopped working (was no longer compatible with current browsers) so I decided to buy again. By this time they'd moved to a subscription system and I have no idea how it works.

It used to be simple... there was an app, and if you stored the password file in Dropbox, you got cross platform support. But now the UX is terrible. I don't know where my passwords are stored, I don't know if the entire thing will stop working if I stop paying, etc. What a shame. I used to recommend it all the time but since the update there's no way I could recommend it to anyone I know who isn't a techie.

Still, if you're willing to handle the availability and security concerns yourself, going self-hosted could work.

With its generated passwords there is no way to lose your passwords in a hilarious backup failure.

yes that's Keepass, cause it's open source and you keep control of your password database instead of on somebody else's server.

I now use Keypss, which is free and doesn't require the cloud.

The only reason they went to the cloud is because most people were buying one copy and sharing it with multiple people. It's a way for them to make more money, which is fine, but I really don't think a cloud-based password solution is necessary.

Edit: The 1password employees must be down voting me. It's ridiculous that I get down voted for a specific opinion about the topic.

I was going to just disagree with you without downvoting, because I specifically was looking for cross device sync and mobile support (and specifically looked for a mobile app that supported using FIDO as a second factor to protect the vault.

However, attributing downvotes to employees/shills shows an inability to consider that there may be a good counter argument.

A SaaS model works well for both sides, I think - consumers always have the latest version and their data is highly available and safe against local events (storage failure, fire, flood etc); the business has (relatively) reliay income stream.

Hmm, thinking about it, for simple image editing stuff I still use a version of Paint Shop Pro from something like 10-15 years ago, and it still works great.

I think then that it depends on the kind of software, and the expectations of the user: is it beneficial to store data in the cloud for easy access from multiple devices?; do you want security updates? do you want new features?; do you want support?

I also use Keepass, with passwords stored on a cheap VPS using SFTP. Works great on Android with Keepass2Android too. But of course, this is not something a general comsumer is going to setup.

I agree completely. I never want to pay more than once for Photoshop/Illustrator/etc. -- and the fact that Adobe has turned those into SaaS products really annoys me.

But products like an OS, browser, cloud-synced password manager, mail client, online git hosting, etc. -- for those, I would prefer to pay a subscription fee (to a company I trust to use it well).

When I first posted this, I had multiple down votes in the span of a few seconds with barely enough time for someone to read or even process my comments. It just seemed very suspicious.

> Please don't comment about the voting on comments. It never does any good, and it makes boring reading.

> The only reason they went to the cloud is because most people were buying one copy and sharing it with multiple people.

It’s cloud-based because the majority of password management users want automatic cross-device updates without setting up their own server.

I’d it was simply storage, the. It would be an add on, but it’s not. It seems like it’s more of a strategy to increase cash flow by converting to ongoing subscriptions instead of one time purchases. This is the same motivation that switched MS Office and Photoshop over to subscriptions. There’s no compelling reason to upgrade, so you get people to fork over a credit card and forget about their reoccurring charge. Cash flow becomes more predictable and possibly increases as well. This why service contract / subscription businesses are popular among investors.

I don’t blame them for trying it, but let’s not pretend this is good for users.

The truth is that my grandmother needs a password manager and she barely understands what minimizing a window does. "Just store your vault in dropbox" is friction and that matters much more to the huge majority of users than the fact that the vault is stored on a cloud service.

Yes, completely agree. Dropbox sync has lots of gotchas and edge cases, and was particularly bad if you edited files on multiple systems (my workstation and laptop, for instance -- I use both interchangeably depending on what I'm doing).

I can understand why 1Password built their own sync service instead of playing whack-a-mole with different cloud storage providers' quirks.

Anyways all of that said, the 3rd party sync solutions all suffered from varying degrees of funkiness that just don’t exist with the native solution. Their switching to monthly pricing was, objectively, very successful and didn’t cost majority of users more money. But there are a small number of people who it rubbed the wrong way, clearly, but any business action is bound to piss some small number of people.

So? You can put the database on gdrive, icloud, dropbox, or any cloud service you want. I think most users understand the concept of creating a file, putting stuff in it, and putting it on a file syncing service (or usb drive).

Many do, many don't.

Even for those that do, there is a significant hassle in getting a file sharing service (gdrive, icloud, dropbox) etc onto every possible device they have.

I mean, I'm with you in that I'm personally pretty skeptical of the cloud-based pw solution. But I can absolutely understand the story about a much simpler user-experience that it offers.

What is this "significant hassle"? Surely it's not that much harder to install [sync app] + [password app] than it is to install [password app]?

>Many do, many don't.

I suspect the intersection between "people who don't know how to manipulate files" and "people who care enough about passwords and are willing to fork over $36/yr" isn't big.

It's literally twice as much work. Often more, because I need the password to the sync app's service. Where's that stored?

How many characters is it? Oh, it's a secure, 20-32 character password. What a pain to re-type it. Good thing it uses a ton of symbols which are a pain to type on my mobile keyboard.

> I suspect the intersection between "people who don't know how to manipulate files" and "people who care enough about passwords and are willing to fork over $36/yr" isn't big.

It's not "people who don't know how to manipulate files", it's "people who don't _like_ to manipulate files, and external services, and get them onto all of their devices".

Further, I expect the proportion of the first circle is constant and relatively small (<10%).

I expect the proportion of the second circle _was_ small, but is growing extremely rapidly.

Or no app, just add the browser extension and you're done. Seems a lot easier to me than downloading two other apps, one I have no use for other than syncing the other one.

Some people don't want to roll their own. You may, or may not agree with the concept of a fully managed solution, but for any non technical user, they want it to (borrow a phrase) "just work".

It's the majority of the addressable market.

The cloud synced updating features you're talking about work fine for me already with 1Password's iCloud-backed syncing, which is how most Mac and iOS apps sync data, it's just in that model Apple has control of my data, not 1Password (and I don't pay a subscription fee), so they make it incredibly difficult to configure that way.

Yes.

Note also I'm replying to this comment "It’s cloud-based because the majority of password management users want automatic cross-device updates without setting up their own server." Seems relevant that "cross-device updates" don't require a server (at least among Apple devices)?

[1]: https://support.1password.com/sync-with-icloud/

The whole point of using a password manager is that the passwords I create and use on my {desktop, laptop, work machine, phone} are immediately and seamlessly available to me on all of the other platforms.

As far as I know it is Cloud integration which enables this absolutely necessary and table-stakes functionality. Is that not true? Does e.g. Keepass provide this essential functionality without a Cloud integration of some kind?

IMO this was the more secure implementation (assuming 1password was only storing fully encrypted files on your 3rd party cloud preference) - even if someone broke in your Dropbox, they can’t decrypt your passwords without your master pass.

An end-to-end cloud solution provided natively by 1pass is much more user friendly and easier, but requires putting an order of magnitude more trust in 1password’s security architecture (which of course is closed source).

As an end user, it’s abundantly clear that all encryption/decryption is done locally when using the Dropbox integration since you can see the files directly in your Dropbox. I guess I didn’t make the same assumption about the 1pass cloud service for some reason.

1. 1Password Cloud

2. iCloud

3. Dropbox

And at least 2 and 3 can be used simultaneously, which is what I do, with my main vault in iCloud, and temporary vaults, e.g., passwords for a particular job, in Dropbox.

It's not as seamless as having the functionality built-in. You have to deal with logins, authorizations, etc. I wish it could be as easy as "Do you allow 1Password to use Dropbox? (Y/N)".

That isn’t the whole point of 1PW though, or at least it wasn’t at the beginning, as I saw it. It was a way to avoid having to remember a unique, secure (read: probably hard to remember) password for every service that requires one. A place to store them all so you don’t have to remember, or worse, reuse the ones you can remember, and/or use easy-to-remember ones (read: less secure). It’s in the name: one password gets you access to all your passwords. Automatic form filling and cloud sync are definitely selling points and certainly convenient, but they are also risk vectors. I’d not call cloud sync essential; I get by fine without it. I just use the WiFi sync option.

Password managers without transparent sync and autofill UX are a half-product at best.

Also like I mentioned elsewhere, I do sync my vaults, but only using the local WiFi option.

There is only one way to exfiltrate information from a notebook, it requires physical proximity, and it's very likely that you would notice.

Every rational threat model for almost every human on the planet (excepting perhaps major political, cultural, or economic figures) would conclude in the paper journal being the better (safer) choice.

For what it's worth, I use it with an ssh plugin, so I only store the database on one machine, and connect using ssh on desktop/Android.

It's also pretty straightforward to set up something like syncthing, making it easier for average person.

Something like 80% of the value prop of my password manager use is one-tap login (with FaceID) on mobile.

Handwaving this away is failing to understand the product and market at a fundamental level.

edit: literally a paper notebook with my passwords written in it is a better solution in essentially every dimension than a non-syncing password manager.

Just store it in your regular sync solution. Syncthing works great, and I don't remember any issues with Dropbox back when I used that. I'd imagine that iCloud or SkyDrive would work fine too, for the masochistically inclined.

This seamlessness is also critical for my less-technical family members on my plan. They want the better security, and recognize that a password manager is necessary. But if it was a pain to use they wouldn't put up with it.

I had to Google a workaround (creating a dummy secure note was one workaround) for the times the sync wouldn't work.

I asked why there was no Force Sync button on their support forums, and was told that they took it out because they want their paying customers to report sync issues with an error report instead of giving them an instant fix via the button.

Needless to say, as someone who has been using and paying for 1PW (upgrades and subs) since around 2008, I was not impressed with that response.

To me, the Windows and Android clients seem to be second-class citizens compared to their Apple counterparts.

They don't have a proper Linux client

You can use the pay-one-price license if you already have the motivation to use DropBox.

But on the other hand, for users who have DropBox already—possibly because they aren't using Linux—this does allow them to sync passwords without paying another $40 a year.