$65 and even $50 seems pretty steep for an upgrade. Will be sticking with version 6 for as long as possible.
Hate software subscriptions so that's a no go.
If we don't charge for upgrades once in awhile (it's been 5 years...) then our team can't pay their bills.
I love being able to pay my bills... I can't work 40+ hours a week for free. Neither can other members of our team.
Whether you think it's worth the upgrade price, that's certainly something that's within your ability to decide... but please understand that we work for a living, just like you do and we have bills and we need to pay them.
If we could give 1Password away for free and somehow pay all of our bills and live our lives, we'd totally do it. But unfortunately reality is we do have to charge for it.
My understanding was that most new useful functionality were only available with subscription. Such as Watchtower and pwn-check. Glad to hear if I'm wrong. Maybe there is a list describing what functionality standalone licensee's miss out on, if any?
Pretty much every single new feature in 1Password 7 is available for both. There are a few minor things here or there that are subscription only.
Thanks for the explanation, but I was thinking about, if I visit my vault at
https://my.1password.com/vaults/... then all my secret data are fully visible for any extensions that I have in my browser, such as an ad-blocker. I understand the same problem exist when 1P fills in a login form, but that is one credential. It was just a shock to see my whole vault open and all data available in Safari in clear text. I certainly won't dare to use that service anytime.
If you can't trust your ad blocker, I don't suggest using it.
I realize that's a bit blunt, but... if I can't trust something, I sure won't be installing it on a computer I'm accessing any sensitive information on. This is why I use Safari and extensions that use Safari's built in filtering. These extensions do not read anything on the page, they are simply used by Safari's filtering API to say "don't show this" or "okay, allow this."
I don't doubt that 1P the app and vaults are reasonable secure though 256-bit? encryption is not exactly over the top. The new thing now is that you have a cloud service and I'm much more worried that
your servers and network might get compromised and hacked into. In that case, will my vault be unavailable at a critical time for me and for how long? Vaults might get tampered with and distributed to my devices or downloaded onto NSA's super secret quantum computer and your mediocre 256 bit encryption easily cracked (the last bit might be a stretch though
You really should read our
white paper on how this works.
Our cloud service only ever has your encrypted data. When you sign into our web client it downloads the encrypted data and decrypts it all in the browser window. It's basically a Javascript version of 1Password running in your browser window. Your master password and secret key are never sent to our servers, they're used locally as part of the authentication and encryption process. See the key derivation and SRP sections of the white paper for details on how that works.
If someone broke into our servers they'd have useless junk. To read your data they need your Master Password and Secret Key. Guessing those is pretty much impossible, or would cost significant amounts of money (think hundreds of millions). Are you worth that kind of money? If not then you really have nothing to worry about they can only acquire those things by guessing (again, impossible to super duper expensive) or by getting them from you. The only logical target for an attacker in this scenario is if they are targeting a very specific person because targeting random people isn't going to help them.
Your vault can't be tampered with because it can't be read by anyone but you.
If our service goes down your devices all have a local cache of your data. Want to test it? Put your computer in airplane mode and turn off wifi. Open 1Password, unlock it. You'll note that all of your data is present. Even though you can't access our servers your data is present. You can even edit items, add items, delete items. They'll sync next time you're online.
Really though, our system is so good another password manager quite literally copied (shamelessly I might add) all of the security features of our 1Password.com service.
[doublepost=1527037464][/doublepost]
I get it. You think you have your users best interest at heart with all of this. Maybe you really do. But, as someone more than a little cynical about software subscriptions – despite being a developer myself – that's not how it comes across to me, personally. Just being honest. Not that my opinion necessarily matters.
We do indeed have our users best interests at heart.
Ever met a software company that refunded purchases from a year after purchase? We did that with 1Password for Mac when we had to remove iCloud support from our direct website download version. Anyone that wrote in and was upset we offered to try to refund the purchase. If it went through, great. Some of those were a year to a year and a half after purchase.
Ever met a software company that tried to offer free upgrades to a paid iOS app? We did. We bought users iTunes gift cards, reimbursed them via PayPal, gifted and otherwise did all we could to help users who recently purchased 1Password 3 for iOS to get them to 1Password 4 for iOS when it was a paid upgrade. We likely lost thousands of dollars just in people cheating the system and getting multiple reimbursements.
Those are two of the bigger ones I can remember off the top of my very very tired brain. But I'm fairly confident there are very very few software companies that would've gone through the hassle of what we did to try to help our users in any way we possibly could. I believe we even offered to buy one of our customers a new iPad because they were so upset about some newer version of 1Password not being able to be run on their old iPad.
I've never worked for a company that cares more about their users than AgileBits.
Please don't be so skeptical that good people exist in this world. Instead try to embrace it because this world could really use more good people.
