1password has been audited a bazillion times. They're E2EE. They're cheap. Your master passwords aren't stored on their servers. Neither is your key information.

The only thing I pay for is the managed hosting, but in theory it's not much different than anything else properly designed (e.g. bitwarden) aside from the obvious things, such as OSS-ness.

The only relevant CVEs are relatively mild compared to LastPass.

Give them some credit.

> Your master passwords aren't stored on their servers. Neither is your key information.

...and, those are the only things that really matter for an attacker. Encrypted data (assuming reasonably strong encryption) is useless without the key.

Some encrypted data is worthless. Some isn't. Depends on what value it has when down the road the encryption is broken.

If AES being broken is in your personal threat model, you have far more to worry about than passwords.

What if its broken in 10 years? Or in 50 years? Eventually it will be.

I’d wager you could survey 100 cryptographers and at least 90 would say the AES-256 primitive itself will never be practically broken, even by large-scale quantum computers. Related-key attacks aren’t realistic or practical.

Properly encrypted data is worthless unless you intend to get the keys somehow. Breaking industry standard encryption schemes shouldn't be in your threat model.

Happy to give them credit. I just refuse to give them my passwords.

> The only thing I pay for is the managed hosting

Funny, I was happy to pay them until they removed my ability to store it myself.

edit:

> CVEs are relatively mild compared to LastPass

LP is not the relevant comparison. The relevant comparison is an encrypted store on my laptop.

I still use an older version of 1Pass specifically so I can run things locally. Sometimes, I wish I was ignorant to all of this stuff and could just be a plebe out in the wild using all of the convenient software out there. Just take the blue pill and put me back in the matrix. The knowing of all of this stuff just makes life so much more difficult.

Maybe look at BitWarden

Easy thing to suggest. However, in my experience, as soon as I decide to use a program after researching it, take the time to switch over to it, that company will then switch to a cloud based whatever. Here we are again at the same spot different name.

Sometimes the devil you know, you know?

I'm in the same boat. I've used lastpass for years and tried a few alternatives over the time but they fell down when it came to providing access to my "vault" on different systems or architectures. The biggest benefit is lastpass generating and storing random passwords for every site and application without me having to cut and paste a thing, and having it easily accessible.

That said, if their closed-source browser extension is leaking my master password to random websites I'll cut them out of my life tomorrow.

What's your personal threat model? I'm always trying to balance the risk of a party focused on security vs the minimal effort I'm likely to put into it. I don't want to be a story about the guy that lost their password to a wallet or anything else important. I used to be able to reliably remember complex passwords reliably but finding that's no longer the case, now only shorter intermittently used ones based on how often I have to use "reset password".

I’ve decided that besides a password manager, all of my passwords will also have a number at the end, like 8 (simple, easy to append manually in a password field. Now the password manager has to get defeated AND my own small personal salt value will have to be known.

Now we know

Now you know that there is some sort of salt. That isn't helpful to an attacker trying to cryptographically crack a password if they already have the password database.

This is a good idea that's never occurred to me. I guess you could also consider it like having one password for all your accounts, except salted with some random string from your password manager

Will it always be 8? Or will it vary?

Good idea, I would add a yubikey to that, for an additional step.

Agree. Moving from one proprietary online solution to another proprietary online solution isn't the answer.

How do you sync your passwords across all of your machines? Do you self host your passwords on your own server? Do you manually sync?

1Pass has the ability to sync via WiFi, Dropbox, iCloud, etc. I only use the WiFi as the other options are still cloud platforms I don't trust.

These have all been removed in 1password 8. It is cloud-only, subscription-only.

Not OP, but I use the standalone version of 1Password + Resilio Sync.

Your personal infrastructure is likely much more volatile than some Expert company. Unless of course you happen to be an industry expert ...