I left LastPass when it was bought and migrated to 1Password. I have not had a breach notification since.

Just sayin'.

1Password does encrypt URLs. It also requires an extra Secret Key [0] in addition to your password. This makes it much, much harder to use the data even if encrypted vaults were stolen.

They also have a development team that's very active. Lastpass had been coasting for years.

[0] https://support.1password.com/secret-key-security/

They've been coasting pretty much since buyout

Look, I hate the "new" 1Password as much or more than most, but to say they're coasting is disingenuous; just last week they published their "op" plugin system allowing running "gh" and "glab" and a bunch of other common commands as subprocess of their "op" binary to inject the api tokens. I think the SSH Agent behavior is also post-money

They've also listen to our bitching about requiring the master password every 2 weeks even with biometrics turned on, and rolled that back to a configurable setting

They’re talking about last pass buyout. Not 1password

In my opinion, 1password is definitely more secure. 1password generates a key when registering which you cannot restore. So not only an attacker need to know your password, they also have to know the generated sequence. This is helpful for people who tend to use easy to break passwords.

1pasaword is not perfect, but it’s far better than lastpass

Today it might be, tomorrow they might be acquired by someone with all your data. Then in a year they may focus on monetization more than security.

Get something that writes data in open format and does not interfere with how you store it. Eg. Keepass with some privacy focused file storage.

Keepass is fantastic but it is unsuitable for many things, such as multi-user/teams. The browser integration is also very much not something I trust, unlike 1Password's.

1Password has a fantastic track record.

Yes, tomorrow, their incentives might change. But the data is copied and available locally; if they start fucking with user data, we will see it coming.

Security is a lot about trust and trade-offs. This includes trusting someone who has shown themselves to be trustworthy, even if they might not be trustworthy tomorrow.

Well - guess I have no trust, when it comes to uploading my passwords to someone's else server.

I remember too many SaaS companies with awesome reputation, that over time became sketchy (including Last Pass).

As for the teams - you shouldn't have shared accounts. Making introducing them convinient is bad idea. Where I work, we're audited for that and honestly it's very small issue if you give it a few minutes of thought.

Lastpass was always sketchy, as long as I have known them. I can back this up with proof, it’s not their first leak and I’ve personally talked about how you shouldn’t use them as early as 2012…

Re teams, just because you shouldn’t have shared accounts doesn’t mean you can’t have shared secrets which end up in a password manager. Or more generally, the ability to have managed employee vaults. And regardless, shared accounts do happen, because some providers just suck. Making them as secure as possible is more important.

Maybe, but we'll never know because you've just traded one cloud solution for another. You cannot audit their code and by handing over all your passwords, you've just made your entire digital life dependant upon their continued financial success.

I cannot fathom why anyone would look at the situation today and decide that the solution is more of the same.

Get an offline password manager and keep your valuables out of the cloud. I like Keepass, but there are plenty of FOSS solutions out there that allow you to actually own your data.

Most likely for the convenience that it offers. Getting non-technical family members to actually use KeePass, etc is next to impossible.