1Password 8 for iOS and Android Released With New Design and Features

[japanime]

Not only this, your passwords are not stored in plain text on 1Password's (or other password manager vendors') servers. A rogue employee could post anyone of those databases to a public website tomorrow, and you would still be safe. To be any use, an attacker would have to get your password, and secret key (in 1Password's case) to get any useful data whatsoever.

There are much easier targets for attackers. Sites that store your information in plain text, for example.

Are you an AgileBits employee, or working for them in any capacity?

 

[jessebkr87]

Happily deleted the previous 1password app after installing this, only to realise that there is no watch app for the latest version (which I refer to couple of time a day for work accounts). Now I have 2 1password apps on my device.

An employee of theirs was on Reddit today answering questions and they mentioned that the Apple Watch app just wasn't ready for launch day, so hopefully it's coming.

 

[_Spinn_]

I still prefer Bitwarden.

 

[svish]

The changes seem to be good. Customisation is welcome.

 

[jsamuelson]

what's condescending about it ? You asked what I meant by "centralized database of passwords" and I explained it .You can't ask people questions then get upset because they answer you.


well , if you consider well known 60 year old security experts and cryptographers like Bruce Schneier to be "20 year old fear mongering"...
( unless you were referring to me, but considering I grew up programming using punch cards on Vax computers, I'm not familiar with what 20y old kids do these days 😁 )

Agile would be getting much fewer complaints if they kept offering the local vaults / non-sub versions in addition to the sub / Agile hosted version. People could then choose what they feel confortable with. Especially when it comes to something as touchy as security software.

I didn't ask you to explain anything...that's the condescension.

I just pointed out you were wrong.

 

[jsamuelson]

It's very obviously a commercial/business choice, not a rational or technological one. If you "own" your vault, you're not constantly dependent on them. If your vault is basically a monthly rented space, you're completely dependent on them , forever.

It's one thing to have an opinion it's another to just invent drama to support your point - you are not dependent on Agile forever. If you stop subscribing your data is still yours, freely exportable just as many have chosen to do in this very thread. Now, if they locked your data the day your sub ended and you could not export it in a format that any other app could import, I would go grab my pitchfork and join you.

So here's some other things to think about. A recent article suggested that 20% of SSDs developed uncorrectable errors and bad blocks within 4 years. What about the integrity of your local vault then? Generally, what about versioning? What about accidental deletion and recovery? Wait, now extend that across a typical family of four, like mine? Who travel and go to university and perhaps aren't as diligent with backup as you are? You back everything up, I hear you say? Great. What about fire, flood and other damage? So - offsite backup - sneakernet to a drive stored in your bank vault? Highly inconvenient. Cloud backup is the way! But...oops...that belongs to someone else, like rented space, and if you don't pay that bill your data will definitely be deleted irrecoverably.

Seriously this position on Agile's apps and servers being somehow bad or insecure in the absence of any reliable evidence is baffling. I guess these people are all irrational and dishonest and it's all part of some grand conspiracy.

And with that - I am definitely out as this is getting just ridiculous.

 

[patearrings]

Weird, I still see 7.9 as the latest version available


On desktop yes, but Electron apps are not allowed on the App Store so this has to be either native or using some kind of cross platform framework that still outputs a native binary

This is not true. There are many electron apps on the app store. Slack being a very well known one. Despite very persistent pressing by the 1p community on their forums, they will not disclose why 1p 8 is not available on the app store. Whatever the reason, and it's likely a security reason that apple won't allow it (not great for a password manager), it's not cos it's using electron.

At the end of the day, they switched it 1pw from a native app to a browser environment app, and they are notoriously insecure. So I will stay on 1pw 7 until it dies, and then switch.

None of my dev friends are staying with 1pw now and all are switching away as they were horrified that they had switched to electron.

 

[Abazigal]

It's very obviously a commercial/business choice, not a rational or technological one. If you "own" your vault, you're not constantly dependent on them. If your vault is basically a monthly rented space, you're completely dependent on them , forever.

Nothing is stopping you from writing your passwords down in a notebook. But it too can go missing or get eaten by your pet dog. No matter how or where you choose to store your passwords, something could theoretically happen to your storage medium.

so I fail to see what your issue is. We each pick our poison, and move on.

 

[Quasi26]

Well, of course nothing is 100% secure in life. One day, 256 AES encryption will be broken in as easily as a paper agenda. But everything in security is about decreasing the odds that something bad happens, it's about making things harder for hackers, it's about increasing substantially the difficulty to do so, to the point that the hackers has to think about how much is it worth to spend additional material resources and time VERSUS the potential gain. That's really how security researchers ( regardless of age ! ) look at it.

When one says that one method is less secure than the other , it doesn't mean that one is 100% secure and the other is totally insecure. It might mean that one is , say , 40% more secure than the other . And security is basically about putting the odds/chance in your side, it's not a binary game.

Look at 2 step authorization, that's what it is about : spreading the potential point of failure over 2 nodes instead of one. You can even increase it to a more secure 5 step authorization, and you can still get kidnapped and tortured to give your passwords and activate your devices with your biometrics. But unless you're a very special "person of interest", that's unlikely to happen , and for a hacker that just wants to steal some of your money, not worth the trouble and risk.

If we consider that 1P software has a point of failure ( as shown by those out of date "fear-mongering-20y old" ), and if the amount of energy/time spent to hack one person's local vault is almost the same as the one spent to hack thousands ( or hundred of thousands of 1P users ?) because all their vaults are in one server instead of thousands of servers , then the effort is absolutely worth it for organized hackers. It doesn't mean it's guaranteed to happen , but it just increased the odds substantially.

So local vaults are objectively and inherently more secure, not just different. They are "different" in the sense that they are less convenient than Agile hosted vaults. The latter is also "different" in the sense that they are more convenient but less secure ( because of what's said above). You're trading increased security ( or should I say less probabilities of a hack ) for convenience.That's worth it for some people, and not for others. It should be up to the user to make that choice, and it would have been extremely easy for Agile to make 2 versions of 1P, one with local vaults only, and one hosted by them. It's not like they are some poor lonely developper making software from his grandma's kitchen table. They just got 64 Millions$ of funding.

It's very obviously a commercial/business choice, not a rational or technological one. If you "own" your vault, you're not constantly dependent on them. If your vault is basically a monthly rented space, you're completely dependent on them , forever.

Mind you , they're not the only ones. A majority of software turned-subscription isn't justified at all by any technological or "progress" reasons, only by making your data hostage unless you pay the monthly rent forever. Very few are really justified.

We will probably not come to agreement on this. This argument avoids context in the sense that the aggregated stored data "most likely" is way more secured than peoples local storage. A software bug that exists in the product exists with cloud storage and with local storage and needs to be fixed regardless. The distribution idea really doesn't apply in the sense that automation makes is near seamless to attack millions of people around the world at once. In fact, the idea that "most" people will have simple, limited security routers and protections at home combined with scripting and automation means those local vaults are easily attacked all at once and inherently less secure as the most people operating them are not security experts.

Once again, by that token you would never put your money in a bank because that's where all the money is and now its a honey pot for hackers

Tens of thousands of companies aggregate their data in publics clouds like AWS and GCP, that doesn't mean they are all sitting there in unstructured storage and the data is easy to grab all at once. Taking this same example and extending it, this is why most companies don't run their own data centers.....because a highly secured (even if grouped together with other companies) data center is WAY more secure than your local data center. The vast majority of companies (and people with passwords) are WAY better off using a highly (not perfectly) secured system even if data is more centrally located. Having a local vault when some company gets hacked doesnt make you more secure.....it just means you got lucky. No reasonable security professional relies on "security through obscurity"

Now if you want to make the Subscription argument, thats perfectly valid. Some people dont like subs and thats fine for that person. But that doesnt mean 1Password is a worse product because its a sub, just that its cost/value proposition is not for you.

 

[Kraszim]

Not only this, your passwords are not stored in plain text on 1Password's (or other password manager vendors') servers. A rogue employee could post anyone of those databases to a public website tomorrow, and you would still be safe. To be any use, an attacker would have to get your password, and secret key (in 1Password's case) to get any useful data whatsoever.

There are much easier targets for attackers. Sites that store your information in plain text, for example.

We have no idea if this is true. Their applications are closed source and none of those claims are verifiable. They could as well have a copy of your main password on their servers.

This gets even more fishy when you realise they had an option for local storage but it got removed. Why remove it? Why not charge sub and allow for local storage at the same time?

 

[eduardodfj]

Why remove it? Why not charge sub and allow for local storage at the same time?

Because that is their only justification to charge for a subscription.

Password managers are a dime a dozen these days and I don't think 1P has any real, solid, significant advantage in terms of security or features over many other options.

 

[Kraszim]

I don't think 1P has any real, solid, significant advantage in terms of security or features

After removing local storage they definitely don't, as they just removed a feature, and lowered the security at the same time. I disagree this is a part of push for subscription. There are plenty of applications that have local/on premise options as a part of premium offering. They are fine charging sub at the same time. There are even password managers that do exactly that. Bitwarden being the prime example.

 

[bice]

...

To the people who complain on every 1Password post about the subscription… we get it. You all beaten this dead horse enough. If you moved to a new password manager, good for you.

Some of it is pure complaining, yes.

Some of it is consumer info though. Macrumors promotes this subscription service over and over again (no doubt because of the good kick-back they get as there is zero rumors-value to these posts). I find it refreshing that posters report their experiences of cheaper solutions that cater for the need.

 

[Mr. Heckles]

Some of it is pure complaining, yes.

Some of it is consumer info though. Macrumors promotes this subscription service over and over again (no doubt because of the good kick-back they get as there is zero rumors-value to these posts). I find it refreshing that posters report their experiences of cheaper solutions that cater for the need.

Macrumors do get a kick back when they post the 50% off for 1 year deal that they post from time to time, and they even say this is the post (in small writing). I get it, this site doesn’t run on dreams.

I just get annoyed “mine is better than yours”, it gets old. If you use a password a manager, awesome. But don’t tell people they are dumb for using whatever brand they use. It’s becoming like Apple Vs. Android, Mac Vs. PC, and even politics. People who think whatever they use or believe in is the best, they need to stop it. It’s all opinion, not fact. Use what works for you.

I got a great deal with 1Password. Years ago they had a deal for 10 users for the family plan for $4.99 a month. That’s less than $0.50 a users, and they have guest accounts also. Those things are great for my needs.

I like Bitwarden, but doesn’t fit my family needs. I do recommend that and 1Password to people. I think both are probably the best out there.

 

[srbNYC]

I just get annoyed “mine is better than yours”, it gets old. If you use a password a manager, awesome. But don’t tell people they are dumb for using whatever brand they use.

Hear hear. It also makes for boring reading for the rest of us.

 

[TheMacUserUHD]

Still on 1P7.

Since i‘m using the Dropbox Sync option, will this still be possible on the new 8 version of 1P?

Or am i forced to sync my vault now to AgileBits and AgileBits Servers only?

That would be a no-go for me.
Would stay that way on 1P7 as long as possible, since i‘m using a mix out of 1P & the iCloud Keychain anyways.

 

[bice]

...

I just get annoyed “mine is better than yours”, it gets old. If you use a password a manager, awesome. But don’t tell people they are dumb for using whatever brand they use. It’s becoming like Apple Vs. Android, Mac Vs. PC, and even politics. People who think whatever they use or believe in is the best, they need to stop it. It’s all opinion, not fact. Use what works for you.
...

Yeah, I agree in general. But with this being a rumors site and most of the real articles here also gets a alot of "mine is better than yours" posting, isn't it what to expect? It would be odd if paid content was the only section without such comments.

Hear hear. It also makes for boring reading for the rest of us.

Again, I agree in general.
But I am kind of curious about this: If one is already subscribing to this service, why is Macrumors "the place" to read and comment about the version releases? The vendor surely has their own channels to talk to customers about versions?
Especially if we agree that the regularly posted "rumors" about 1Password basically is just paid content. I am having a hard time to understand why anyone pleased with this service would care to read and comment it on macrumors.

 

[MacBH928]

Another thing that is beaten with a Bitwarden, open source. I can name 2 issues that the programs were open source and had issues for years and years before anyone cause it. Meanwhile, attackers were using the issues for their own good. Log4j and the Heartbleed bug are the 2 big ones that I can think of off hand. I think the one issue with Equifax was from a program that was open sourced. Is open source stuff good? Yes, but it can’t be the only selling point.

1Password has audits. As long as they pass the audits, I’m not worried.
As for the price, it would cost me more with Bitwarden’s family plan. Before the users in 1Password and the guest vaults, I have about 9-10 separate vaults, so with Bitwarden, I would need 2 family plans…. Costing me more than 1Password.

Bitwarden isn’t bad, and I’ll recommend it also. I don’t think it’s as polished as 1Password, but that’s my opinion. As someone said also, Bitwarden’s Mac app is also electron. I hated election apps until I gave 1Password a chance and I think it’s one of the best apps I have on my MacBook. Bitwarden is probably one of the best free password managers, but it doesn’t do what I need it to do.

1Password is the only subscription I don’t mind paying. It’s more then Netflix, and I use 1Password more often.


That’s your opinion. A few people already said they like it. I like it and I’m happy with it.

Trust: Your choice is up to you but I will always trust an open source software over closed source software as long as its a popular and active one not some junk someone uploaded to github. You never know whats in the closed source software. You talk about Bitwarden having log4j or whatever, but you never know what 1password had. I didn't look too much into it but Bitwarden too seem to have audits too.

Price: 1password is $60/year for family plan 5 users Bitwarden is $40/year for 6 users. Negligible but still Bitwarden has the advantage here. There is also Enpass for $50 a year for 6 members which I believe lets you store the vault where ever you want, although i have to warn that it is no where as polished and smart like 1password. I am hoping it gets better with time.

Indeed if you are happy with 1password I do not urge you to change it but I am telling you there are similar and cheaper options. I really loved 1 password but I had to switch out of principle that I will not agree on forced subscription and forced cloud storage. With Enpass I have peace of mind that it will always work and with Bitwarden I do not have to worry because is free.

 

[MacBH928]

Still on 1P7.

Since i‘m using the Dropbox Sync option, will this still be possible on the new 8 version of 1P?

Or am i forced to sync my vault now to AgileBits and AgileBits Servers only?

That would be a no-go for me.
Would stay that way on 1P7 as long as possible, since i‘m using a mix out of 1P & the iCloud Keychain anyways.

@TzTerri

all new 1password software is forced subscription and forced storage on their servers. If you are looking for options please visit this thread.

 

[MacBH928]

Right? The irony...

I do not store my passwords in iCloud. My Keychain has only my Apple credentials probably but I am forced to do so if I want to use Apple products and log into iTunes. They do not have my credit cards, emails, bank info, and everything else...

It's not really multi-user (you get two with premium) for $10 which is the point I made above...everything else you have said bar open source applies to 1Password and the GUI is infinitely better and more useable.

as I mentioned before there is a family plan for $40/year for 6 users thats more than 1password for cheaper. Yes, both apps do the same thing except Bitwarden is open source and cheaper , so which one will you pick?

yes you are correct 1password is the more beautiful and smoother app but it comes with a price, a higher dollar price, closed source, and forced online server storage. To each his own. (You can setup Bitwarden in your own cloud but you have to jump through hoops to do so)

I swear - 1Password generates some kind of collective hysteria. I'm out. Everyone stay happy, it's public beta day.

Of course people will hate on a company that used to sell a license software then tells people thats not enough now you have to subscribe monthly and you have to store your passwords in our servers and you have to trust us with that. Meanwhile I can get Enpass lifetime license , store anywhere I like, or Bitwarden for FREE. Its just pure greed. I would like to fund more friendlier businesses than greedier ones.

They made their choice, we made our choice. Lets see where it goes.

 

[0924487]

Yes, but they’re in business to make profit.

So, you agree "because servers" is just an excuse.

 

[Mr. Heckles]

Trust: Your choice is up to you but I will always trust an open source software over closed source software as long as its a popular and active one not some junk someone uploaded to github. You never know whats in the closed source software. You talk about Bitwarden having log4j or whatever, but you never know what 1password had. I didn't look too much into it but Bitwarden too seem to have audits too.

Price: 1password is $60/year for family plan 5 users Bitwarden is $40/year for 6 users. Negligible but still Bitwarden has the advantage here. There is also Enpass for $50 a year for 6 members which I believe lets you store the vault where ever you want, although i have to warn that it is no where as polished and smart like 1password. I am hoping it gets better with time.

Indeed if you are happy with 1password I do not urge you to change it but I am telling you there are similar and cheaper options. I really loved 1 password but I had to switch out of principle that I will not agree on forced subscription and forced cloud storage. With Enpass I have peace of mind that it will always work and with Bitwarden I do not have to worry because is free.

I’ve been with 1Password for years and I am happy with them. Whenever I had an issue, they got it resolved. It’s also not cheaper for me to go to Bitwarden.

1Password has guest vaults and I have it set up so I use one for my work computer and work passwords, this vault doesn’t count against my 5 users. My wife and 1 kid also has this same set up, so right there is 6 “users” being used with just 3 people. I have my guest vault synced with my personal main user, so I can see work password on my personal computer, but only work passwords on my work computer. I love this set up, it’s great.

Let’s say I used 5 actual users in my family (3 guest and 5 users) this set up right here, I would need the equivalent of 2 Bitwarden family accounts ($80). Or 1 family and 3 single ($40 + $10 + $10 + $10= $70).

I even got on a 1Password deal years ago I actually got 10 users for $4.99. With my plan, I have 8 total users user up, not including the 3 guest accounts. When I get my siblings on (probably next month) it will be less then $6 per user per year.

My parents/in-laws have no issues setting up a new account on their own, and I’m not about to change this also. They are between 70-80 years old and they got the hand of this app, and it took me a while to show them and teach them, why go somewhere else? I have zero reasons too.

The secret key is a selling point also. I don’t have to worry about my moms crappy master password. An attacker would have to guess her master password, security key (40 characters), and 2FA. A persons master password could be 12345 and with the secret key, the account is still very secured.

Even if Bitwarden was actually cheaper for me, I don’t have a reason to switch since I am happy and everyone in my family is use to it and happy also. It’s also not always about cost. If that was the case, I would have bought a cheap android phone and not an iPhone.

 

[Haiku_Oezu]

This is not true. There are many electron apps on the app store. Slack being a very well known one. Despite very persistent pressing by the 1p community on their forums, they will not disclose why 1p 8 is not available on the app store. Whatever the reason, and it's likely a security reason that apple won't allow it (not great for a password manager), it's not cos it's using electron.

At the end of the day, they switched it 1pw from a native app to a browser environment app, and they are notoriously insecure. So I will stay on 1pw 7 until it dies, and then switch.

None of my dev friends are staying with 1pw now and all are switching away as they were horrified that they had switched to electron.

Slack for iOS is not made with Electron

https://twitter.com/x/status/931599784137363459

EDIT: I understand the confusion, I meant the *iOS App Store*, not the macOS App Store
My point was that 1Password 8 for iOS is native while 1Password 8 for macOS isn’t

 

[MacBH928]

I’ve been with 1Password for years and I am happy with them. Whenever I had an issue, they got it resolved. It’s also not cheaper for me to go to Bitwarden.

1Password has guest vaults and I have it set up so I use one for my work computer and work passwords, this vault doesn’t count against my 5 users. My wife and 1 kid also has this same set up, so right there is 6 “users” being used with just 3 people. I have my guest vault synced with my personal main user, so I can see work password on my personal computer, but only work passwords on my work computer. I love this set up, it’s great.

Let’s say I used 5 actual users in my family (3 guest and 5 users) this set up right here, I would need the equivalent of 2 Bitwarden family accounts ($80). Or 1 family and 3 single ($40 + $10 + $10 + $10= $70).

I even got on a 1Password deal years ago I actually got 10 users for $4.99. With my plan, I have 8 total users user up, not including the 3 guest accounts. When I get my siblings on (probably next month) it will be less then $6 per user per year.

My parents/in-laws have no issues setting up a new account on their own, and I’m not about to change this also. They are between 70-80 years old and they got the hand of this app, and it took me a while to show them and teach them, why go somewhere else? I have zero reasons too.

The secret key is a selling point also. I don’t have to worry about my moms crappy master password. An attacker would have to guess her master password, security key (40 characters), and 2FA. A persons master password could be 12345 and with the secret key, the account is still very secured.

Even if Bitwarden was actually cheaper for me, I don’t have a reason to switch since I am happy and everyone in my family is use to it and happy also. It’s also not always about cost. If that was the case, I would have bought a cheap android phone and not an iPhone.

You seem to be in a scenario where yes 1password is best for you and I urge you not to switch but your case scenario is more on the rare side.

I still do not understand your users though, current 1password family option is $60-year/5 users and you seem to have more so you have to opt for their $240-year/10 users (Team Starter Pack). Bitwarden is actually more expensive if you have 10 users at $3/month = $360 year. I think you are on an older plan and I am surprised 1password is still honoring it given how they are forcing people into their $36-year plans.

I also think that you can create multiple vaults in Bitwarden its just called organizations. I do not understand what the secret key is as far as I know because you can unlock a backup of your vault via the password only.

Honestly, I see no reason to have shared vaults. Everyone can get his free copy of Bitwarden. For the few shared passwords between everyone initially you can export them and give each user a copy to import in his vault. If for whatever reason the password needed changing (passwords should not change imo, they do not have expiration date) there is an option in Bitwarden to send the password via a link, copy the link and send it via any encrypted messaging platform.

yes its more hassle but it is also $240 a year less. Not everyone has a plan like yours, again you are a unique case.

 

[Mr. Heckles]

You seem to be in a scenario where yes 1password is best for you and I urge you not to switch but your case scenario is more on the rare side.

I still do not understand your users though, current 1password family option is $60-year/5 users and you seem to have more so you have to opt for their $240-year/10 users (Team Starter Pack). Bitwarden is actually more expensive if you have 10 users at $3/month = $360 year. I think you are on an older plan and I am surprised 1password is still honoring it given how they are forcing people into their $36-year plans.

I’m not paying $240 a year. As I said, I got a deal years ago and pay $59.88 a year for 10 users (normally that price is for 5 users). It’s not an old deal at all, it was a promotion that I got they were offering at the time. For a normal family account, you can add a user for $1 a month, you don't need a teams account. I even included a photo that says it that’s in my billing area of the deal I have:

I also think that you can create multiple vaults in Bitwarden its just called organizations. I do not understand what the secret key is as far as I know because you can unlock a backup of your vault via the password only.

You probably can, but you cannot create guest vaults, a feature that I really like. My wife, my 1 kid, and myself all use this as a work account/vault. it doesn't count against my users for my account. I love that I can see my work passwords in my personal vault and personal computer, but ONLY my passwords on my work vault on my work computer. This comes in handy a lot.

I do not understand what the secret key is as far as I know because you can unlock a backup of your vault via the password only.

Secret Key info. So you need you Master password, Secret key, and 2FA. If a person gets into my account, puts in my Master password and 2FA, they cannot get in.

Honestly, I see no reason to have shared vaults. Everyone can get his free copy of Bitwarden.

My wife and I have a shared vault for bills and other things we need to share. We also have each others 1Password info in case something happens to one of us. If I die, my wife needs access to the bills. If one of us changes a password for a bill account, it will reflect in each other vault. We have a shared vault with the whole family that has passwords for streaming services and anything else the whole family needs to know.

If for whatever reason the password needed changing (passwords should not change imo, they do not have expiration date) there is an option in Bitwarden to send the password via a link, copy the link and send it via any encrypted messaging platform.

Why on earth would I do this? it's MILLION times easier to share a vault, especially doing this with more than 1 person. I change a password, and I don't even need to tell my wife I changed it (because I will probably forget to tell her anyways), it will change on her side too. Same with the family share vault. If I change the password to Netflix, everyone's 1Password will get an update. I also have it set up so my kids cannot change passwords in the family shared account, it's read only for them.

You can also share a link to a password in 1Password also. This is one a few ways I can share with 1Password.

yes its more hassle but it is also $240 a year less. Not everyone has a plan like yours, again you are a unique case.

Again, I am paying $4.99 a month/$59.88 a year for 10 users. I have zero reason to change. I also don't think Bitwarded is as polished also. I try it once a year and play with it. It does the job, but it has nothing that will make me move. I said before, it's not always about price.