My pet peeve at the moment is this[1], where they removed a feature I very much like (TouchID in the standalone browser extension) and still have yet to replace that functionality despite many promises that it is just around the corner. It was removed in August 2020.

Definitely feel like they've lost sight of why people chose them in the first place, and stuff like this is certainly not helping assuage my concerns.

[1] https://1password.community/discussion/115228/temporarily-re...

With a recent release[2] of 1Password for Linux and the 1Password extension, the two can now communicate. Allowing you to use biometrics to unlock the extension and keep it unlocked throughout your browsing sessions.

While this news doesn't unlock this ability right away for yourself (because referencing TouchID I assume means you're a Mac friend). We will be continuing to rollout over the coming months to Windows and Mac.

[1] https://1password.community/discussion/comment/591579/#Comme...

[2] https://1password.community/discussion/119609/1password-for-...

But with subscriptions it gets inverted. Now for the customer failure to keep paying means losing existing functionality and/or having to expend additional resources (money and time) actively moving to something else. So rather then needing to be convinced to give the company more money, it's more that they need to be convinced not to.

There's a real difference between "a customer base that is very happy" and "a customer base that is merely not irritated enough yet to overcome the inherent energy hump and go looking for a new local minima" and I worry the subscription business model makes that easier to ignore. Not that companies can't in principle find out in other ways! They can do detailed customer polling and so on. But that requires active effort and expense by the company so the temptation will always be to ignore it and follow inertia. This doesn't require the slightest bit of active malice, just a break in feedback loops resulting in drift as a company starts pursuing things from its own tunnel vision. They then look and see the money keep pouring in, so what's the problem? The threat eventually becomes that if the energy barrier is overcome and the stampede begins it's too late. It's a shame to see happen to companies I really really like and have great visions that could be even better.

Granted in 1Pssword case, their classic app would not have stopped working without upgrades. And to my knowledge it should also still work? I have since switched to the subscription model but I have used the old paid app years after they have switched models.

honestly i think these things are more about lock-in or perceived lock-in, or simply not wanting to waste precious time. even though it's actually fairly easy to jump between password managers, it's still a "migration" or another task where when one's time becomes scarce the thrill of a sundry task like redoing one's passwords is overshadowed by the laundry list of things one could do with their time instead. sure, it's nice to tend the garden, but how many other things would you rather spend an afternoon on that either develop skills, enhance life or recreate in one way or another.

[1] https://1password.community/discussion/comment/591579/#Comme...

A it more than a year ago we had

- 1Password for Mac and iOS written in Objective-C and Swift - 1Password for Android, written in Java - 1Password for Windows, written in C# - 1Password CLI, written in Go - 1Password web-app, in Typescript - Browser extension in Typescript

Introducing new features was an ever more difficult task. Even getting the behavior of things like password strength meters or generators behaving the same across these platforms was increasingly difficult. (Hint, they didn’t behave the same.)

So we have been taking the time to develop a common core of code that can be used everywhere. And this does take time. Writing the common modules is often relatively easy, but we have to get them to work with the platform specific code

Late 2019 was our first successful deployment of any such function, and that was the TOTP calculator. It was largely transparent to users, except for settling on which sorts of TOTP “quirks” we were going to follow. (TOTP standards are a mess, and different Authenticator apps deal with special cases differently. At least 1Password is now fully consistent with itself)

Over the past year, we’ve been plugging more such things into the apps. And it allows us to fix bugs more quickly as well ashen they are in the common code.

1Paaword for Linux is built on all the new/common code. So while it doesn’t have everything that the others do, it is also where you will see the née stuff that is coming.

This has been a huge effort, and the transition has some rough spots, but once we get there we will be able to move much more quickly in developing and refining features and behaviors.

Reading between the lines a bit - biometric authentication was deprecated (from ‘for Mac’) as it was broken or at risk of breaking, and further dev on legacy code was moot due to the transition?

- Ben, 1Password

I prefer the above classic extensions for switching between Chrome, Safari, Firefox and Edge all day and not having to sign in more than once. Plus the better desktop app integration, including the ability to opt-out of cloud storage of passwords.

I consider it a victory if I can get non-techies to use their browser's facilities to store passwords, and then to choose reasonably long passwords and avoid reuse.

(I use `pass`, myself.)

Storing 2FA tokens is one thing iCloud Keychain cannot do (yet ?), and it’s the primary reason I use 1Password over iCloud Keychain.

That being said, with Big Sur, 1Password changed its default behavior from being unintrusive to literally obscuring input fields with big “unlock 1Password” pop up’s.

I’m currently evaluating using either Password-store or Bitwarden with bitwarden_rs as a backend as I really don’t want my logins synchronized anywhere I don’t control.

That's not a Big Sur thing, that's a 1Password thing (I've not upgraded to Big Sur still).

Hope because it would allow me to utilize my mac as a Yubikey. I have no idea how they would synchronize it to all Apple devices, but i'm fairly certain they will find a way.

Fear because it will pretty much guarantee i cannot use my password manager on other platforms.

I already use Secretive (https://github.com/maxgoedjen/secretive) to store SSH keys in the secure enclave with touch id integration, and it works really well. I also keep a couple of Yubikeys as backup :)

The value prop if you're 100% on-Apple, and OK with this fact, is hard to challenge. If you have some non-apple devices that need passwords, that's where having a third-party password service makes sense.

FWIW, I use `pass`, as a mostly-Apple person who also owns a few linux devices and occasionally requires passwords while `ssh`'d into servers.

there are commercial entities today that i don't have to trust, but will help me set up multiparty signatures for sending bitcoin transactions. i could see a similar mechanism being used for creating/revoking/recovering a compromised identity.

hierarchical deterministic wallets seem a decent blueprint for identity. if i can generate arbitrary pubkeys from a single seed, then i maintain my privacy across providers i use my identity with.

i used to think that the blockchain itself could make for a decent revocation list, but i don't think that's even neccessary. maybe it's simply time for governments to grow up and accept that the internet is critical now and as such provide basic digital identity services as they do with travel documents today. it doesn't have to be perfect, just publish revocations on behalf of citizens.