Just updated. The new UI and functionality are splendid. Though, I really don't like that my password vault was moved to the web and is managed by AgileBits. I can login to their web-app @1password.com and browse my vault in Safari. So many things can go wrong with this scenario. I have enabled 2FA, but still. Plugins and Extensions (ad blocker) in my browser can easily read my vault if I open it in Safari. Seems that there is no throttling when trying to login with a wrong password to 1password.com. Putting all my secure data in the cloud leaves a really bad taste in my mouth. What happens if 1password.com is compromised? Every black-hat hacker will surely try to break in. And of course, like everyone else I hate the subscription license. Subscribing to a newspaper or web-app is one thing, but having to subscribe to my own secure data sucks. I know that you can buy a single non-subscription license, but then all the cool new things in 1password 7 is not available and upgrade from version 6 is hardly worth it.
You didn't have to choose the option to use 1Password.com, that was an explicit option you choose. The other option was to purchase a standalone license.
Other extensions cannot read what is in your vault. 1Password's data is stored in the app, the extension lives in the browser but only contains the data for the current page you're on when you choose an item. It works like this:
* You visit a page
* You click the 1Password icon, this has the extension send the URL for the current page to 1Password which opens the mini app (it's part of the app, not the browser) and gives it the URL.
* The mini app searches for items that match the URL provided by the extension
* The extension doesn't have access to any data, until you choose an item in the mini
* You choose an item, that data is then sent to the extension which fills it into the page
Once the username and password is in the page, your ad blocker could read it, just like 1Password can when it asks to save an item. We can technically only protect your data within 1Password itself, if you install other browser extensions, or a malicious browser, anything in the browser could easily access the contents of the page, including what's in the username and password fields.
As for your data, it's stored encrypted only on our servers. To decrypt it requires your Master Password and your Secret Key. Your Secret Key looks something like this:
A3-VFCPJF-ABNDJ2-B4C47-9XYC8-AEQNJ-5F8MY
An attacker is going to have to guess both your Master Password and your Secret Key, because neither of those come from us. We never have them, we don't ask for them, they're never transferred to us.
Your logins are throttled, but because a vast bulk of the work to derive the necessary keys to try to login happen locally you will have a harder time to hit the rate limiter. But it does exist and it will prevent someone from making hundreds of guesses (or more) per second. The way your keys are derived locally per login attempt will also limit how quickly someone can guess your Master Password and Secret Key.
We have a Bug Bounty as part of our Bugcrowd program for $100,000 if they can access data they shouldn't have access to. It's been set to that for about a year. No one has come even remotely close to providing anything at all of substance for this. Our service has been available since late 2015 and we've had no situations where data was ever accessed by someone who shouldn't. The only issues we've seen are users who installed malicious tools on their computer that gathered their data. A compromised computer is not something we can protect against, regardless of where your data is.
If you want to learn more about how we protect your data on our servers, I highly recommend checking out our white paper:
https://1pw.ca/whitepaper
We went to great lengths to protect user data, more so than any other password manager out there. We are setting the standard here and it's well above anything else out there, including previous versions of 1Password. No one else even comes close.
[doublepost=1527015344][/doublepost]
Rest assured, I think 1Password is amazing, and I will continue to use it at least 10 times an hour. I just probably won't upgrade on Day 1 as I have in the past, though, and for now I've returned to my Happy Place in v6.
I'm echoing things I've already said elsewhere on the web and in the AgileBits forums (In fact, apologies if I'm barraging you personally on two fronts at the moment), but in all honesty, Version 4 had everything I've ever needed or wanted in a password manager, and I consider 1P (even at 6) to be one of the few "perfect" applications on my system.
I've happily upgraded to support the cause over the years, and the incremental changes in UI have been welcomed. Unfortunately for AgileBits, though, I honestly don't want it to DO anything other than what it already does. In fact, I'm perfectly happy paying for a no-features-added maintenance release when Apple unveils a new version of MacOS or changes the way its security policies work... but at the risk of sounding like a grumpy old man (I'm getting there quick), I don't WANT anything new from it:
It's perfect. I just want it to stay that way.
For better or worse, all password managers are effectively moving forward. If we stay behind... as you can imagine that wouldn't bode well for us. You're probably in the minority of people who want what you say you want, which wouldn't allow the company to stay alive. We'd have to shutter the company if that's what we provided.
I realize you're probably, at least to some extent, saying this sort of out of desire and realize that reality can't really accommodate what you want. But I wanted to make it a bit more clear.
I understand what you're asking for though... just... I don't see it happening that way.