Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Anyone use this before? Is it safe to save all password in one place?

I've been using this for several years. Haven't found a better solution. You set a master password to access the app. The contents are encrypted. It's essentially a safe.


For Mac / iOS and Windows.

I don't have any complaints about the android version. It's ugly, but functions. My only "complaint" would be Linux. All these years and it still gets no love.
 
Funny thing is you don't need a complicated password to be secure. You can use words that mean something to you that are easy to remember but still secure. The use of UPPER and lower case letters with numbers makes a password a lot harder to crack.

password_strength.png
 
1Password works with other browsers - Firefox, Chrome as well as Safari - Keychain does not. Also, there's a windows version and Android version.

1Password stores more than keychain offers - software licenses for example.

More frequent updates and bug fixes too!

---
Password security -
https://www.schneier.com/blog/archives/2013/06/a_really_good_a.html

Oh ok guess since I only have macs and iOS devices in my home I'm not missing anything. Also only use safari....
 
Hopefully there is better syncing with Dropbox because it is often not syncing up correctly between my iMac and MacBook Air and I don't get the most up to date information or I end up with new info on two separate vaults that are the same vault.

If you're having trouble with syncing, please private message me and I'll get you into our support system and we can look into why it's not working for you.

This app has always been worth it. For a non-subscription fee, they have been great at updating both the OSX and the iOS versions of this application. Been a customer for nearly 4 years.

Thanks for your continued support!

You are correct in that we do not charge a subscription. Other similar applications do, so with pricing you do have to take into account the differences on this. As pointed out in later replies, we tend to release often but paid upgrades are few and far between. 1Password 3 for Mac was released in November of 2009, and 1Password 4 for Mac was released in October of 2013, that's nearly 4 years between releases. A very similar timeframe was between 1Password 3 and 4 for iOS, though I don't have a changelog in front of me to check this.

I would give it a shot, but $50.00 is out of my range at the moment. Wish they would throw out a few free codes or have a $10.00 sale.

As others have mentioned, there is a trial version available on our website: http://www.agilebits.com/downloads

It'll work for 30 days and then after 30 days it'll limit you to 20 items, if you exceed 20 items the application goes into a read-only mode. You can use the application with your existing logs but you won't be able to add anything new. You won't be locked out or anything like that. If you purchase, it'll unlock that limitation and you'll be able to add as many items as you want.

If you have further questions please let me know via PM, I'd be happy to talk with you one on one.

Anyone use this before? Is it safe to save all password in one place?

This is a great question, I'm going to pull in our security expert, who also writes all of our blog posts, and he'll be happy to answer this question in more detail than I can. My job tends towards the technical support side, where his is security related.

Yeah, it sounds impressive, but then they told passengers the Titanic was unsinkable due to it's state of the art engineering.

So while "256 bit locker encryption" sounds great, I don't understand what it means, whether it's appropriate, nor do I have any way of verifying it really is secure.

Same as the question above, I'm going to bring in our security expert for this, keep your eyes peeled. He's in a different time zone so I will get him in here as soon as I can :)

With 1Password, don't you have to purchase the iOS version as well, or does the $50.00 cover both platforms?

You need to purchase both the Mac and iOS applications separately. Both applications are fully featured. You can use _just_ the iOS app if you want or you can use just the Mac application if you want. Previously with 1Password 3 the iOS side was much more of a companion. With 1Password 4 we now have an application that can be used without the need for a Mac application.

The iOS version is a full fledged application, just like on the Mac, in a much smaller interface.

If you have questions regarding price, please private message me and I'll be happy to help answer any specific questions you have regarding your particular needs. Just let me know how many people and devices you plan to use 1Password with and I'll work it all out for you.

1Password is excellent. I've been using it for about four years now and I will gladly keep paying for upgrades because 1Password has completely changed my family's approach to passwords by getting us to use unique strong passwords for each site we visit.

I just wish the iOS app was updated with a more iOS 7 feel. It's even still using the pre-iOS 7 keyboard.

Thanks so much for your support! :)

If you watch the video here: http://vimeo.com/88901304 you'll see a quick preview of the iOS 7 application.

We're adding far more than just the iOS 7 look. Keep your eyes peeled for that!

Here is a little information on the subject from the 1Password site.
http://learn.agilebits.com/1Password4/Security/keychain-design.html

That's a great starting point if you understand the technical details. It is a bit heavy on the technical side though. I'll be bringing in our security expert as soon as I can to get him to answer any of the security questions, stay tuned!

This really worth $50? And do you have to buy separately for the iPad and iPhone version? $50 for a Mac app seems like a bit much when it just stores passwords...

I certainly think it's worth it :)

1Password doesn't just store passwords. It stores Logins (which are website credentials), Credit Cards, Identities (name, address, etc), Secure Notes (free form text) among other bits of data. It's a general purpose wallet and data storage system.

Now, the trick is that once your data is in 1Password, it fills the data in for you on sites. Logins can be filled using our browser extension. A simple tap of Command+\ will fill the username and password for the site you're on, or if you're not on it yet you can have it visit the page and fill it in for you. If you're on a site ordering something, you can have it fill your credit card and address information as well.

All of this data can sync to our other platforms as well. Add information on your Mac, you can sync it to the iOS application, which is separate, yes. There's another reply above this one that includes some information about the iOS application as well, but a quick summary is that it's a full featured application all on its own.

If you have questions regarding pricing or other concerns, please private message me with any details and we can figure out the best combination for you. I can walk you through the whole thing.
 
Last edited:
Quick question for you: Do you consider any of the following passwords secure?

  • thereisnofatebutwhatwemake
  • eastofthesunwestofthemoon
  • !)@(#*$&%^Test123
  • *tecno9654postgres
  • !@#$%^&*()_+lisa
  • Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn1

If your answer to just one of the above is "Yes": Think again real hard about using a good password manager!

Those passwords above were all guessed using "dictionary lookup" attacks within hours or days (not weeks or years)! Several hours to days!

(And please note: there are all considerably longer than your simple "8 or 9 character passwords"!)

Rule of thumb: if you try to come up with a password that is based on any (combination of) word(s) that can be found "on the Internet" (Twitter, Wikipedia, websites, news groups, the Bible, other book texts available in electronic form, ...), it is very likely that it will be guessed! Even 1f u d0!permutat1ons$and_try2bcl3v3r! ("rule-based substitution attacks").

For a detailed background why you should be very concerned:

http://arstechnica.com/security/201...ing-the-next-frontier-of-password-cracking/2/
"How the Bible and YouTube are fueling the next frontier of password cracking"

And considering that several major (commercial) sites were hacked and millions of encrypted passwords were stolen in the past few months, you should really have different passwords for each and every service!

(What people often forget: they might have a hugely "secure password" for e.g. their Apple ID, but they have a weak password for their email, so attackers can guess the email password, reset the Apple ID with a confirmation email sent to that email address, and *zonK*! There you go! Your Apple ID accessible now to them as well!)




Well, as I said: reconsider of what you think is "secure"...

I input some of the passwords from that list into 1Password and it claims the password strength is good! How am I to trust 1Password then? I prefer to have memorable, non-random passwords for certain logins. 1Password suggests a long string of words for the Master Password. Are these long strings really so vulnerable to cracking?
 
If you're having trouble with syncing, please private message me and I'll get you into our support system and we can look into why it's not working for you.



Thanks for your continued support!

You are correct in that we do not charge a subscription. Other similar applications do, so with pricing you do have to take into account the differences on this. As pointed out in later replies, we tend to release often but paid upgrades are few and far between. 1Password 3 for Mac was released in November of 2009, and 1Password 4 for Mac was released in October of 2013, that's nearly 4 years between releases. A very similar timeframe was between 1Password 3 and 4 for iOS, though I don't have a changelog in front of me to check this.



As others have mentioned, there is a trial version available on our website: http://www.agilebits.com/downloads

It'll work for 30 days and then after 30 days it'll limit you to 20 items, if you exceed 20 items the application goes into a read-only mode. You can use the application with your existing logs but you won't be able to add anything new. You won't be locked out or anything like that. If you purchase, it'll unlock that limitation and you'll be able to add as many items as you want.

If you have further questions please let me know via PM, I'd be happy to talk with you one on one.



This is a great question, I'm going to pull in our security expert, who also writes all of our blog posts, and he'll be happy to answer this question in more detail than I can. My job tends towards the technical support side, where his is security related.



Same as the question above, I'm going to bring in our security expert for this, keep your eyes peeled. He's in a different time zone so I will get him in here as soon as I can :)



You need to purchase both the Mac and iOS applications separately. Both applications are fully featured. You can use _just_ the iOS app if you want or you can use just the Mac application if you want. Previously with 1Password 3 the iOS side was much more of a companion. With 1Password 4 we now have an application that can be used without the need for a Mac application.

The iOS version is a full fledged application, just like on the Mac, in a much smaller interface.

If you have questions regarding price, please private message me and I'll be happy to help answer any specific questions you have regarding your particular needs. Just let me know how many people and devices you plan to use 1Password with and I'll work it all out for you.



Thanks so much for your support! :)

If you watch the video that MacRumors here linked to you'll see a preview of the iOS 7 application. It's near the end.

We're adding far more than just the iOS 7 look. Keep your eyes peeled for that!



That's a great starting point if you understand the technical details. It is a bit heavy on the technical side though. I'll be bringing in our security expert as soon as I can to get him to answer any of the security questions, stay tuned!



I certainly think it's worth it :)

1Password doesn't just store passwords. It stores Logins (which are website credentials), Credit Cards, Identities (name, address, etc), Secure Notes (free form text) among other bits of data. It's a general purpose wallet and data storage system.

Now, the trick is that once your data is in 1Password, it fills the data in for you on sites. Logins can be filled using our browser extension. A simple tap of Command+\ will fill the username and password for the site you're on, or if you're not on it yet you can have it visit the page and fill it in for you. If you're on a site ordering something, you can have it fill your credit card and address information as well.

All of this data can sync to our other platforms as well. Add information on your Mac, you can sync it to the iOS application, which is separate, yes. There's another reply above this one that includes some information about the iOS application as well, but a quick summary is that it's a full featured application all on its own.

If you have questions regarding pricing or other concerns, please private message me with any details and we can figure out the best combination for you. I can walk you through the whole thing.

How about a 1-day sale to celebrate 1Password's new update. Say... $24.99 for 24 hours! I'd be in for copies for me and my wife on the App Store. :)
 
Two things.

1) Can anyone compare this with LastPass?

2) Is there a way to transfer LastPass info into 1Password? I'm thinking of making the switch but I have HUNDREDS of login credentials.
 
So while "256 bit locker encryption" sounds great, I don't understand what it means, whether it's appropriate, nor do I have any way of verifying it really is secure.

It means that your passwords are safe and you can sleep at night knowing that as long as you have a nice, secure master password, it will take a hacker a few hundred million years (and maybe much, much longer) to crack your password.

I have about 103 logins stored in 1Password. Each password is unique and is 25 characters minimum (or whatever max length sites allow), has mix of all types of characters, and I don't even know one of them. I only know my master password.

----------

$50.

You may also want to try out Pastor. Its donation ware.

Umm, Apple's Keychain while using Safari is NOTHING like 1Password. If I get physical access to your computer and you use the keychain/Safari to store passwords, I can go to you bookmarks, go to paypal/amazon/anything, and simply get logged in by visiting the site.

1Password IS NOT that. If someone steals my computer, they cannot log into any website without my master 1Password. They just can't run Safari and simply have Safari pop in my login info on my bank's site.

----------

For all those who don't understand the usefulness of 1Password, I have two observations. 1.) You don't understand how it actually works -OR- 2.) You are too cheap to spend money on apps.

1Password is a million times better than the home-brew way you are handling your passwords right now, and is a million times better than using Safari/Keychain to keep your passwords.

If 256bit encryption is too lax for you, I don't know what to tell you.
 
I have about 103 logins stored in 1Password. Each password is unique and is 25 characters minimum (or whatever max length sites allow), has mix of all types of characters, and I don't even know one of them. I only know my master password.

Ever get that thing where a site (in my case a bank site) would only accept 6-8 characters that had to have a number, a letter, an uppercase, a lowercase, a special character from the following list..., and you were just thinking to yourself "this is almost feasible to brute force manually...".
 
I still haven't been able to get the iOS version to sync via iCloud with the Mac version.

Please private message me and we'll look into this.

Exactly. That kind of thing annoys me.

If you look at the video here: http://vimeo.com/88901304 you'll see a preview of the iOS 7 application. It's near the end.

It took me awhile, but I finally broke down and bought it. Actually I've bought it across both platforms so I have it at work as well. It is was expensive, but now all of the sites are secured with real passwords.

With that said, if you are only in the Mac / iOS world, the Safari password system built into Mavericks is secure (actually, the design of the process is very secure). The weakest link would be your password to access your Mac and / or iOS device.

Thanks so much for purchasing! I think you'll find the value is there after using it :) Before I was an employee at AgileBits I was a college student on a very limited income. I still found room to purchase 1Password because it was the first thing I installed on my computer. It contained all of the serial numbers for applications I had purchased, all the passwords for websites I visited frequently. It only made sense that an application I used 30 times a day would be the first installed.

Please let me know if you have any questions though. I'll be happy to help!

I've been beta testing iOS 7 version along with the (now) released OS X version. You can select which browser in iOS you wish 1Password to use (such as Safari) and autofill. It's coming.

Thanks for helping beta test. At this time there is no way to have 1Password fill in another browser than our own (1Browser). The reason for this is that applications have limited functionality for interacting with each other. We cannot interact with Safari for example, other than to have them open a webpage.

This is a limitation of iOS, and therefore also a limitation of 1Password. We hope that Apple will give applications the ability to interact more with other applications, including Safari in the future. But until this functionality is implemented into iOS we are kind of at the mercy of the operating system with regard to trying to fill into other applications, such as Safari.

We want this functionality just as much as our users do :)

About this kind of product, feature or encryption level is not important.
It is but the most important thing is if the developer is trustworthy or not.

There are alternative products for Mac and iOS. But I believe it's stupid to use unknown software.
They can send your passwords to their server.

We specify everything we request or send out here:

http://learn.agilebits.com/1Password4/Security/privacy.html

1Password has a lot of users, many of whom are experts in the security field, and monitoring outgoing traffic from a computer (assuming you have physical access) is very trivial. If we, or any application for that matter, was sending information you'd be able to detect it reasonably well. The only information we transmit is what is specified above in the URL.

Please let me know if you have any further questions with this, I'd love to get you the answers.

Does ANYONE knows IF it …. allows you to input/type security questions and answers for certain sites, such as government, banks, certain data base, etc….???

I have been doing it the old fashion way, on paper …. actually on Pages. For example, for one site I have a password (long) and four security questions, none of which I can really remember. It's a pain to go back and forth.

You can certainly create custom fields for this data. You could also use the secure notes section for items to store it if you wish.

As for filling it into webpages. This gets tricky in the case of rotating questions (i.e. you have 3 security questions, but it asks for 1) because the field name is often the same regardless of the question and there's no way for us to easily tell which question it is asking.

But you can certainly store this information in 1Password's custom fields area and input those manually.

Using 1Password 4's new "anchor" feature, you could open the item in our menu bar item, click the "anchor" icon and it'll pop up a window with the data visible, you can then click a field in the window and paste it into the appropriate field on the webpage.

Let me know if you have any questions, I'd be happy to go into more detail on this if you want.

Here are the official release notes:

https://app-updates.agilebits.com/product_history/OPM4

Apparently they still haven't implemented Wi-Fi sync between desktops :(

Wifi sync between desktops is actually pretty tricky. I'll certainly note your request for this and pass it along to our developers.

Have you looked into using folder sync? This is how I have mine setup. I share a folder on my server (just a Mac Mini) and folder sync to that folder. Then each computer can simply be setup to log in to that shared folder and sync to it.

Also works with NAS devices.

How is this any better then iCloud Keychain?

Someone below answered already, but my favorite feature is the fact we work with all of the major browsers (Firefox, Chrome, Safari and Opera), including a few of their derivatives.

We also sync via several different methods, Dropbox, iCloud, Folder Sync (local folders) and wifi (to iOS devices).

Finally, we're also cross platform, so if you use Windows you can use our Windows application to view and input your passwords as well. We also have a full featured Android application in the works.

We think iCloud Keychain is a great thing for users, but there are definitely users out there that require something a bit more configurable, and I think we offer a lot more features, especially in terms of storage of data.

Please let me know if you have any other questions though!

lol I refuse to use one password as well.

I don't have a problem remembering the few passwords I use on a daily basis even if they are over 8 or 9 characters long. Also with keychain it's made devices a hell of a lot easier to log in.

I know the benefits off the app but I'm not a big fan of a program generating passwords for me even if they might be slightly more complex.

So, the biggest reason why 1Password is so valuable is that if you use the same password on several sites, all it takes is one break in and those passwords could be stolen. Now malicious users could have access to your passwords in some form or another from that site's database. Many times users use the same username/email and password combination. At that point it's simple for the malicious user to try that combination on other popular sites and possibly gain access.

With something like 1Password, you can have a unique, randomly generated password for each site. If a malicious user gets a hold of a site's password database now they have the password for only _that_ site and not all of your other sites.

Using the same password you'd have to change the password on any number of other sites. Using 1Password you'd only have to change the password for the site that was broken into.

Examples of sites that were recently broken into: Kickstarter, Adobe, LinkedIn, and dozens of others over the last year or so. Many of these are high profile sites.

Even if you don't use 1Password, we strongly encourage you to use unique passwords for each site. Preferably randomly generated.

  • It actually generates secure passwords for you!
  • Cross-platform
  • Cross-browser (Safari, Firefox, Chrome, ...)
  • Stores more than just "web-passwords" and credit-card numbers, such as router passwords, notes, ... well, any structured secure data you could imagine (and you can extend those structures with additional fields, e.g. for your local DVD store membership ID card)
  • Most importantly (for me): local Wi-Fi sync between iOS/OS X!

Great list! Thanks for writing that up :)
 
It means that your passwords are safe and you can sleep at night knowing that as long as you have a nice, secure master password, it will take a hacker a few hundred million years (and maybe much, much longer) to crack your password.

I have about 103 logins stored in 1Password. Each password is unique and is 25 characters minimum (or whatever max length sites allow), has mix of all types of characters, and I don't even know one of them. I only know my master password.

----------



Umm, Apple's Keychain while using Safari is NOTHING like 1Password. If I get physical access to your computer and you use the keychain/Safari to store passwords, I can go to you bookmarks, go to paypal/amazon/anything, and simply get logged in by visiting the site.

1Password IS NOT that. If someone steals my computer, they cannot log into any website without my master 1Password. They just can't run Safari and simply have Safari pop in my login info on my bank's site.

Excellent point about the huge difference between keychain and 1Password.

In my opinion, keychain is more about convenience than real security.

I don't know about others, but it was my experience many times, that keychain didn't have any problem suggesting a password. However, it did have an issue with pulling up passwords that supposedly had been saved. Pain in the butt. Those two reasons are why I now steer clear of keychain.
 
Please private message me and we'll look into this.



If you look at the video here: http://vimeo.com/88901304 you'll see a preview of the iOS 7 application. It's near the end.



Thanks so much for purchasing! I think you'll find the value is there after using it :) Before I was an employee at AgileBits I was a college student on a very limited income. I still found room to purchase 1Password because it was the first thing I installed on my computer. It contained all of the serial numbers for applications I had purchased, all the passwords for websites I visited frequently. It only made sense that an application I used 30 times a day would be the first installed.

Please let me know if you have any questions though. I'll be happy to help!



Thanks for helping beta test. At this time there is no way to have 1Password fill in another browser than our own (1Browser). The reason for this is that applications have limited functionality for interacting with each other. We cannot interact with Safari for example, other than to have them open a webpage.

This is a limitation of iOS, and therefore also a limitation of 1Password. We hope that Apple will give applications the ability to interact more with other applications, including Safari in the future. But until this functionality is implemented into iOS we are kind of at the mercy of the operating system with regard to trying to fill into other applications, such as Safari.

We want this functionality just as much as our users do :)



We specify everything we request or send out here:

http://learn.agilebits.com/1Password4/Security/privacy.html

1Password has a lot of users, many of whom are experts in the security field, and monitoring outgoing traffic from a computer (assuming you have physical access) is very trivial. If we, or any application for that matter, was sending information you'd be able to detect it reasonably well. The only information we transmit is what is specified above in the URL.

Please let me know if you have any further questions with this, I'd love to get you the answers.



You can certainly create custom fields for this data. You could also use the secure notes section for items to store it if you wish.

As for filling it into webpages. This gets tricky in the case of rotating questions (i.e. you have 3 security questions, but it asks for 1) because the field name is often the same regardless of the question and there's no way for us to easily tell which question it is asking.

But you can certainly store this information in 1Password's custom fields area and input those manually.

Using 1Password 4's new "anchor" feature, you could open the item in our menu bar item, click the "anchor" icon and it'll pop up a window with the data visible, you can then click a field in the window and paste it into the appropriate field on the webpage.

Let me know if you have any questions, I'd be happy to go into more detail on this if you want.



Wifi sync between desktops is actually pretty tricky. I'll certainly note your request for this and pass it along to our developers.

Have you looked into using folder sync? This is how I have mine setup. I share a folder on my server (just a Mac Mini) and folder sync to that folder. Then each computer can simply be setup to log in to that shared folder and sync to it.

Also works with NAS devices.



Someone below answered already, but my favorite feature is the fact we work with all of the major browsers (Firefox, Chrome, Safari and Opera), including a few of their derivatives.

We also sync via several different methods, Dropbox, iCloud, Folder Sync (local folders) and wifi (to iOS devices).

Finally, we're also cross platform, so if you use Windows you can use our Windows application to view and input your passwords as well. We also have a full featured Android application in the works.

We think iCloud Keychain is a great thing for users, but there are definitely users out there that require something a bit more configurable, and I think we offer a lot more features, especially in terms of storage of data.

Please let me know if you have any other questions though!



So, the biggest reason why 1Password is so valuable is that if you use the same password on several sites, all it takes is one break in and those passwords could be stolen. Now malicious users could have access to your passwords in some form or another from that site's database. Many times users use the same username/email and password combination. At that point it's simple for the malicious user to try that combination on other popular sites and possibly gain access.

With something like 1Password, you can have a unique, randomly generated password for each site. If a malicious user gets a hold of a site's password database now they have the password for only _that_ site and not all of your other sites.

Using the same password you'd have to change the password on any number of other sites. Using 1Password you'd only have to change the password for the site that was broken into.

Examples of sites that were recently broken into: Kickstarter, Adobe, LinkedIn, and dozens of others over the last year or so. Many of these are high profile sites.

Even if you don't use 1Password, we strongly encourage you to use unique passwords for each site. Preferably randomly generated.



Great list! Thanks for writing that up :)

Lol why would u think I only use one password for everything ?

Even my mom uses a different password for every log in ha
 
1Password for iOS does have autofill if you use their web browser. I use it in those cases where I do need autofill in iOS.

Yup, exactly. We do support filling into our own built in web browser. We have the ability to do it within our own but not within Safari.

This is a limitation of iOS, and therefore a limitation in 1Password. We would love to see the ability to fill into Safari (and other browsers) but until these features are added to iOS we won't be able to do it.

We would love to see this just as much as our users would.

The problem with an app remembering all your passwords is that if one day you find yourself at someone's house or on a device that doesn't have the app installed, you're basically screwed and pretty much locked out of the internet. I still think there's no alternative to remembering them all. Most of your passwords can be the same, since most sites aren't that important. I mean who cares if the password for the pizza delivery site is the same as the one you use for some forum you only logged into once?

I use 1password on my laptops and my iPhone. The danger is if you are traveling and loose you iPhone and computer (say taxi robbery) and need to access a bank account details for transfers etc. You then need to download and install 1Password on a borrowed or public computer and sync it with your dropbox. This mean you need to know your Dropbox password! My suggestion is to make it and your 1Password vault password the same.

So, a couple of thoughts here. One from a security perspective. If it isn't your computer, do you trust it? If not, I wouldn't put my password into it.

If you do trust it, you can sync to Dropbox and use our 1PasswordAnywhere feature: http://learn.agilebits.com/1Password4/iOS/Tutorials/ios-1pa.html

This gives you a read-only viewer for your data. It's fantastic in a pinch and I use it for my backups. I put the keychain on a flashdrive, along with instructions for accessing it. Then it goes into a safe deposit box in case of my demise. Inside the keychain I include all of my regular bills, information on canceling them, etc.

The master password is only known by me, and is put in a place that family is aware of in case they need it.

Double useful in this case as I can access my data if needed via Dropbox, and it's in each of my backups so I have access even in the backup files.

Does 1Password access TouchID in iOS 7 to unlock the app?

As mentioned by others, Apple does not give access to TouchID to developers. If they did we would look very carefully at possibly implementing some way to use TouchID. We'd like to see this actually.

The best part of 1Password for me isn't with the password generation and storage, but all the other features.

  • It's an awesome software license database, including the ability to attach license files sent from developers.
  • It doesn't require an internet connection to simply look up a password.
  • It allows you to tweak individual parts of a site login via the edit button.

Wonderful list! Thanks so much for putting this up. Thanks for your support :)

Their Android version is a joke

Ahh -- good point. I don't use Android for anything anymore (and didn't have 1Password when I was using it), so I can't confirm directly, but I have seen the same sentiment repeated many places.

We're actively working on the Android application. If you haven't already, you can sign up for the beta:

http://blog.agilebits.com/2013/11/15/1password-4-for-android-the-beta-like-winter-is-coming/

If you use Dropbox sync, you will have access to your entire keychain from anywhere as long as you have a trusted internet connection. The keychain file is actually a folder you can go into in Dropbox and then open the main HTML file to use 1PasswordAnywhere. It's a web-based, mirrored view of all your passwords with the same level of security as the main app. No downloading or installing of 1Password on the guest computer is necessary. This is a great feature for travel (I have a secure note with important info like passport and bank numbers) that Apple's Keychain or competitors don't have.

The only bit of caution is that I don't trust Dropbox to not give the government my password if asked, so I wouldn't use the same password for Dropbox and your 1Password master password. In the end, I have to remember 2 very strong passwords instead of 1, but that's not too difficult and the convenience of this feature is worth it.

The point of using separate master password and Dropbox passwords is a wonderful one. You should definitely use separate passwords as password reuse is very bad.

Thanks for putting up that reply though, it's full of great information.

----------

Still waiting on the update to be posted on the App Store.

We put it in for review on Tuesday, given review times hopefully we'll see it late this week or very early next week.

Thanks for your patience!

Two things.

1) Can anyone compare this with LastPass?

2) Is there a way to transfer LastPass info into 1Password? I'm thinking of making the switch but I have HUNDREDS of login credentials.

We do support importing from LastPass, you can read a bit here:

http://learn.agilebits.com/1Password4/Mac/en/KB/import.html

If you have questions about importing let me know via Private Message. I'll be happy to assist.
 
This really worth $50? And do you have to buy separately for the iPad and iPhone version? $50 for a Mac app seems like a bit much when it just stores passwords...

It's worth it, especially if you have more than one device. It doesn't "just store password"-- it integrates with your browsers, manages all sorts of auto-fill scenarios so you can click and go with just about any website, and keeps everything very, very safe. It also has a collection of data-storage options for keeping assorted sundry information safe besides passwords. It will also generate strong passwords for you, as well as store them.

Support is also great... my emailed questions have been answered very quickly, and then followed-up on.

A useful app from a good group. Worth the money. In this day and age when you really should be using a different strong password for every login, I've found it to be essential. I tried a few others first, and the sophistication of this app combined with the great support make it worthwhile.
 
[Disclosure: I work for AgileBits, the makers of 1Password]

Do they allow anyone to examine the code? If not they could have built a back door in for the NSA etc

This is an extremely important and fair question. We live in a time when governments are coercing "industry partners" to provide access to private user data and for deliberately weakening security tools. I know that we are good guys and would not do anything like that, but you are not in a position to simply take my word for that.

Independently verifiable security

There are a number of things about 1Password's design that means that you don't have to take our word for this.

We never have the opportunity to see customer data in any form at all. Because 1Password is operates entirely locally (which you can verify independently) we've got no data that we could turn over.

As for a backdoor in the cryptography itself, note that we document our data format in gory details, including all of the encryption used within it. So again you can check the data that 1Password generates against our documentation of it and confirm that it does behave as we say.

Publishing our design specification allows for public and expert scrutiny of our design, and having all of the operations local, you can confirm that 1Password is doing what it is supposed to do.

Some passwords managers allow anyone to examine the code to see it does exactly what they say it does.

Our business is not an open source one. We have invited external experts to look at the source, usually in the context of "please check to see that we aren't making any blunders in how we use cryptography".

Full code reviews, however, are expensive and apply only to one specific version. Furthermore, it is extremely difficult to prove that the reviewed source corresponds to the binary that is delivered. So, we've not sought a full code review until we know that it would succeed in demonstrating what it needs to demonstrate.

There is more discussion of the back door question in an article we published last September: 1Password and the Crypto Wars
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.