News for hackers. Stuff that matters.
Re:1password is considering a self-hosted option to store va... by donmcronald on Sunday August 08, 2021 @12:05PM (#28107692)
For me it’s the feature tiering and price discrimination that turns me off. I end up paying too much (total cost over 5 years) for too little. If you look at the business pricing it’s even dumber.

The $2 billion valuation of 1password tells the entire story. They’re overcharging for what they’re providing and I think tech people can “feel” that which is why tech communities hate the subscription BS.

Re:1password is considering a self-hosted option to store va... by nixgeek on Sunday August 08, 2021 @12:18PM (#28107795)
I don’t really think $8/user/mo for Business is overcharging compared to Slack which quickly gets into $30+ per user per month in larger shops where Enterprise Grid is required for its features.

By your argument why can’t I buy that and self-host it too, decide if I want to upgrade for more features myself?

I also think $5/mo for 1Password for Families is incredible value. Zero regrets on paying for this because it meaningfully enhances my families personal security posture through elimination of reused credentials and enabling TOTP (sharing of code generation) on many sites we use, that it is cross-platform so no excuses for everyone to not use it, and the UX is so simple you don’t need to be “tech people” to succeed.

How much you charge and how you charge is definitely divisive, but 1Password feels very much on the cheaper end of the spectrum, not “overcharging”, heck Discord Nitro is $5 (Classic) or $10 and gets you very little by comparison IMO.

Re:1password is considering a self-hosted option to store va... by jimmydorry on Monday August 09, 2021 @02:27AM (#28113302)
Can you elaborate on:

>enabling TOTP (sharing of code generation) on many sites we use

Are you generating TOTP codes via 1Password or something? That seems like a degradation of security. I did a cursorary search and didn't find mention of 1Password providing such a "service".

Re:1password is considering a self-hosted option to store va... by nixgeek on Monday August 09, 2021 @04:09PM (#28121746)
Yes. https://blog.1password.com/totp-for-1password-users/

It isn’t a degradation of security, in my opinion, it’s an upgrade, when certain accounts are involved.

For these shared accounts, such as those used by my family, and on services which don’t support account-per-person in an “organization” or “household” sense, this still provides for TOTP in a way my spouse and I can both login. Ensuring just the loss of the password isn’t enough to compromise the account is an upgrade vs. not having TOTP enabled.

Where we can both have our own accounts and use U2F tokens that’s a better story, clearly, but 1Password having this functionality is great!

Re:1password is considering a self-hosted option to store va... by jimmydorry on Wednesday August 11, 2021 @08:37PM (#28150157)
I don't understand how it's not a security degredation. The point of TOTP is to make access of the service dependant on something you must have phsyically (and isolated from the internet) on you. An attacker that manages to exfiltrate 1Password data has everything they need to access the service if TOTP is part of their offering. Where as all users with TOTP on their phone would have an additional layer of protection.

Even by that blog post, they have to go out of their way and clarify that using this feature means you are not longer using two-factor authentication.