1Password CLI Vulnerability

Re:1Password CLI Vulnerability by woadwarrior01 on Sunday October 05, 2025 @06:12AM (#45480404)

1Password used to be good 10 years ago, but not anymore. A couple of days ago, there was a post about Electron based apps that slow down macOS Tahoe (due to older versions of Electron using an undocumented API). When I ran the script on my laptop, 1Password was on the top of the list.

> 1Password.app: Electron 37.3.1 (Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework)

[1]: https://news.ycombinator.com/item?id=45437112

Edit: Judging by the downvotes, it looks like there are a lot of electron lovers here. Why the hate for more efficient native apps? Are bloated binaries, janky UI and lower battery life, features? :)

[ Parent | on HN ]

Re:1Password CLI Vulnerability by daveoc64 on Sunday October 05, 2025 @06:19AM (#45480432)

It's only on top of the list because it's likely to be first when you sort by app name.

[ Parent | on HN ]

Re:1Password CLI Vulnerability by Hawxy on Sunday October 05, 2025 @07:02AM (#45480604)

That's a 47 day old release and the fix for the macOS issue only came out 7 days ago. Not critically out of date by any means.

[ Parent | on HN ]

Re:1Password CLI Vulnerability by cedws on Sunday October 05, 2025 @07:15AM (#45480643)

How did you come to the conclusion that this very recent issue is 1Password’s fault and not Electron’s?

[ Parent | on HN ]

Re:1Password CLI Vulnerability by oarsinsync on Sunday October 05, 2025 @07:29AM (#45480726)

1Password used to ship native (aka "Mac-assed") apps. They (relatively, in the software's history) recently switched to Electron instead of continuing native app development.

[ Parent | on HN ]

Re:1Password CLI Vulnerability by crazygringo on Sunday October 05, 2025 @07:58AM (#45480877)

So again, how does an Electron bug become 1Password's fault?

It's cross-platform and integrates with browsers so it makes sense they would want to use a cross-platform JavaScript solution as much as possible. Not just to make their developers more efficient, but to reduce the surface area for bugs and vulnerabilities.

[ Parent | on HN ]

Re:1Password CLI Vulnerability by macintux on Sunday October 05, 2025 @08:12AM (#45480944)

1Password used to be an excellent native app. It's not surprising that many users (myself included) resent the enshittification.

[ Parent | on HN ]

Re:1Password CLI Vulnerability by crazygringo on Sunday October 05, 2025 @08:18AM (#45480962)

I've used it for years and am only finding out today that it's Electron. And I couldn't care less.

99.9% of my usage is within the browser plugin anyways. And whenever I have to edit an entry, it works fine.

[ Parent | on HN ]

Re:1Password CLI Vulnerability by aniviacat on Sunday October 05, 2025 @09:14AM (#45481252)

> 99.9% of my usage is within the browser plugin anyways.

If you don't (or barely) use the app, the app is not an issue to you; that seems pretty self-evident.

The experience for regular users may differ.

[ Parent | on HN ]

Re:1Password CLI Vulnerability by crazygringo on Sunday October 05, 2025 @09:34AM (#45481365)

What is the problem with it? And isn't everyone using the browser plugin anyways mostly? Isn't that where the vast majority of passwords get entered?

[ Parent | on HN ]

Re:1Password CLI Vulnerability by macintux on Sunday October 05, 2025 @09:53AM (#45481496)

Personally, I use it as much for other secrets as for browser passwords. Social security numbers, software licenses (not so much anymore), password reset questions, passwords I can't paste (for work), etc.

I don't use a plugin. Never tried it, simply never mattered enough (and I generally store frequently-used browser passwords in the browser's keychain as well).

[ Parent | on HN ]

Re:1Password CLI Vulnerability by crazygringo on Sunday October 05, 2025 @11:56AM (#45482525)

Serious question: why would you pay for 1Password but then use your browser's password manager? Now you have to keep track of updating passwords in two places? Or remembering which sites are stored in which password manager? That's breaking my brain.

[ Parent | on HN ]

Re:1Password CLI Vulnerability by zen928 on Sunday October 05, 2025 @04:14PM (#45484821)

You personally disliking something isnt enshittification.

[ Parent | on HN ]

Re:1Password CLI Vulnerability by macintux on Sunday October 05, 2025 @04:30PM (#45484964)

It was done at roughly the same time that the company switched to a subscription model and their focus switched from consumer to business.

[ Parent | on HN ]

Re:1Password CLI Vulnerability by jen729w on Sunday October 05, 2025 @10:47PM (#45487196)

...shortly thereafter, Apple released their own Passwords app, largely Sherlocking 1Password from a consumer perspective.

If this had been your business, what would you have done? I would have done exactly what they did.

[ Parent | on HN ]

Re:1Password CLI Vulnerability by macintux on Monday October 06, 2025 @07:11AM (#45490095)

You raise an excellent point, and the truth is that I don't know.

That doesn't change the consumer perspective: I'm paying more for a worse product.

[ Parent | on HN ]

Re:1Password CLI Vulnerability by zatertip on Sunday October 05, 2025 @06:28AM (#45480467)

The nightly version(on Linux) is on 38.2.0

[ Parent | on HN ]

Re:1Password CLI Vulnerability by tredre3 on Sunday October 05, 2025 @07:51PM (#45486302)

I guess you're being downvoted because you've just now realized that 1password is electron-based and you're using that discovery it to retro-actively confirm your pre-existing bias that electron = bad.

If electron was actually always bad, you wouldn't need a script to scan your machine and tell you which apps to hate, you'd just know "yep that's slop" upon first opening the app. Yet that is not the case. Because electron is a tool, and it's sometimes used so well that you don't even notice it until you run a script.

[ Parent | on HN ]

Re:1Password CLI Vulnerability by woadwarrior01 on Monday October 06, 2025 @04:59AM (#45489270)

It used to be a native app.

[ Parent | on HN ]