1Password Launches Anti-Phishing Warnings for Pasted Passwords

[JamesMay82]

I’ve been using 1Password since their beginning and have stayed with it ever since. I’ve had no regrets, as it’s been solid, reliable, and does exactly what I need. Passkeys, however, have been somewhat incompatible for me, largely because I use multiple operating systems. The phishing feature isn’t really new either; it is just a different spin on their existing validation scheme. 🤷‍♂️

I've also used it for years but switched to apple passwords as I found the autofill a bit buggy on iOS and Mac OS. it sometimes wouldn't work all the time and I had to then manually copy and paste. have you not had that issue?

 

[urnotl33t]

Having used both, the UI and ease of use are worlds better with 1Password.

Plus the API support for retrieving passwords from a vault.

 

[LordArchie]

I've also used it for years but switched to apple passwords as I found the autofill a bit buggy on iOS and Mac OS. it sometimes wouldn't work all the time and I had to then manually copy and paste. have you not had that issue?

They’ve made quite a few changes with the extension. It seems to be working pretty darn good right now across my Mac my iPad and my MacBook Air.

If I was all in with Apple Passwords, I’d look at Uplock. Nice companion app for the rest of the stuff that you used to store in 1Password

 

[eltoslightfoot]

What a mess of a UI, it looks like the old windows days, so many missing features of 1Password.

No tags
No location aware entries
No travel vault
No expiration date monitoring
No passkey monitoring
Limited templates

Oh good. I don’t use a single one of those features. Looks like Bitwarden is perfect for me.

 

[TriBruin]

I've also used it for years but switched to apple passwords as I found the autofill a bit buggy on iOS and Mac OS. it sometimes wouldn't work all the time and I had to then manually copy and paste. have you not had that issue?

I have had no issues with the extension with either Chrome or Edge. I only have problems with the extensions with Safari. Wonder why that is? I am sure Apple makes it very easy to design extensions /s

 

[JamesMay82]

I have had no issues with the extension with either Chrome or Edge. I only have problems with the extensions with Safari. Wonder why that is? I am sure Apple makes it very easy to design extensions /s

yes I just use safari... I did still keep my subscription while I transitioned as a bit of a back up so I'll maybe give it another try.

 

[TJFDenver]

Should be using passkeys, no passwords. Ideally with a pair of Yubikey or similar.

unless and until iApple supports the exporting of PassKeys, I wont adopt any passkey offer on any website ...

I use iApple Keychain for all iApple devices, and BitWarden for a for all non-iApple devices ... passkeys wont/dont export/port ...

 

[DEMinSoCAL]

Nothing is free. Bitwarden incurs cost for their basic hosted plan. What value are users providing to them such that they can make money to at least cover their cost?

Btw, in my case I would want the family plan. That is not free and priced similar to competitors.

It always amazes me how people don't stop and think how businesses that offer free product or services actually make money...you know, to pay the employees and keep the lights on, at a minimum? I guess they think it's just from the goodness in their hearts! 😀

 

[Howard2k]

unless and until iApple supports the exporting of PassKeys, I wont adopt any passkey offer on any website ...

I use iApple Keychain for all iApple devices, and BitWarden for a for all non-iApple devices ... passkeys wont/dont export/port ...

That’s the idea. They don’t export so you cannot share them. That’s part of the security augmentation.

 

[TriBruin]

yes I just use safari... I did still keep my subscription while I transitioned as a bit of a back up so I'll maybe give it another try.

I will say, it seems like the extension has gotten better over the past few months. I am seeing much better results in Safari. Still not as good as the Chromium extension, but definitely getting better.

I don’t see moving away from 1Password. It is t oway more powerful than Apple Passwords. I get that it not as important to others, but my workflow would be impacted.

 

[dlopan]

I stopped using 1Password when they switched to subscription-only. There is value in the app (and I'd gladly pay for it) but nothing whatsoever in a monthly payment. Enpass has been great ever since and I still have all the features, including syncing via several options (iCloud, wifi-only, etc.)

I agree totally. One other thing, I keep the data local not in Ca.

 

[TJFDenver]

That’s the idea. They don’t export so you cannot share them. That’s part of the security augmentation.

The FIDO Alliance, the consortium behind passkey standards, has developed draft specifications—Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF)—to enable secure import and export of passkeys. These specifications are designed to allow users to transfer passkeys between different password managers and platforms while maintaining encryption during transit. The goal is to prevent vendor lock-in and enhance user control, ensuring credentials are not exposed in the clear.

FIDO Alliance Publishes New Specifications to Promote User Choice and Enhanced UX for Passkeys | FIDO Alliance

The FIDO Alliance has published a working draft of a new set of specifications for secure credential exchange that, when standardized and implemented by

fidoalliance.org

 

[Howard2k]

The FIDO Alliance, the consortium behind passkey standards, has developed draft specifications—Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF)—to enable secure import and export of passkeys. These specifications are designed to allow users to transfer passkeys between different password managers and platforms while maintaining encryption during transit. The goal is to prevent vendor lock-in and enhance user control, ensuring credentials are not exposed in the clear.

FIDO Alliance Publishes New Specifications to Promote User Choice and Enhanced UX for Passkeys | FIDO Alliance

The FIDO Alliance has published a working draft of a new set of specifications for secure credential exchange that, when standardized and implemented by

fidoalliance.org

Thanks, secure export makes sense.

I was thinking export to a text file or spreadsheet.

 

[WU27f1xcCs]

Only a few of the websites I use lets me use passkeys.
Passwords aren’t going anywhere anytime soon.

I predict that they will be a slow burn for a year or two, and then be adopted widely quite quickly as the technology is simple and very good.

 

[deconstruct60]

Nothing is free. Bitwarden incurs cost for their basic hosted plan. What value are users providing to them such that they can make money to at least cover their cost?

Basically like a progressive tax model with a minimal cut-off . The people/business that pay support the non paying folks resources .

They also reduce some of the free users because get them to self host . ( self host doesn’t unlock all the features )

Free also doesn’t get direct support . If someone in forums helps you fine but not going to use paid helpers. Doesn’t have emergency access either ( fall into coma and account may be toast )

Free model does not have attachments. So the amount of data is relatively extremely limited . User name , password , URI , and some notes is like kilobytes at best in most cases per entry. So 10k entries is likely less than 10kb . Pay and get a 5GB budget . The business group pay and get 5GB per user and 5GB shared between users in the organization ( I.e., charged more ) . So those folks are paying for most of the storage and backup overhead.

The free model may increasingly be feature static just to drive a bigger feature gap.

Btw, in my case I would want the family plan. That is not free and priced similar to competitors.

Value of the social group leads to a decent number of people paying . So really a matter of adding paid for features that paying customers mostly want.

 

[Passthru]

If 1PW went away, my next choice would be Proton Pass. They are adding functionality regularly, not near 1PW yet but I feel they have passed Bitwarden and their UI is so much better

I tried Proton Pass for a while, but the thing with Proton Pass is that your Proton account password becomes your "one password". And, of course, if you have 2FA enabled, you'll need that to log into your Proton Pass account. Which seems kind of bonkers to me. I ended up having to use the Proton entry from my (frozen at the time) 1Password vault to log into Proton Pass, which seems like it wholly defeats the purpose of a password manager. With 1Password, all I need is my master password and my security key; with Proton Pass it's a lot more...complicated.

 

[Mr. Heckles]

I predict that they will be a slow burn for a year or two, and then be adopted widely quite quickly as the technology is simple and very good.

I don’t. Most companies look at cost.

They have to pay someone to implement this on their website. Then you have users who don’t understand passkeys and end up locking themselves out of their accounts, which means the company now has to support them.

Why would companies fix something that they think isn’t broken?

You also have companies like Google that still require a password even when you use a passkey. What’s the point?

I also find it interesting that Apple doesn’t actually use passkeys yet.

 

[Howard2k]

You also have companies like Google that still require a password even when you use a passkey. What’s the point?

I also find it interesting that Apple doesn’t actually use passkeys yet.

You don't still have to use a password with Google when using a passkey. You can just use a passkey.

Apple supports passkeys.

 

[Mr. Heckles]

You don't still have to use a password with Google when using a passkey. You can just use a passkey.

Apple supports passkeys.

With Google, you cannot remove your password and use a passkey only.

I just looked, and I stand corrected about apple websites.

 

[Howard2k]

With Google, you cannot remove your password and use a passkey only.

I just looked, and I stand corrected about apple websites.

But you can sign in to Google with just a passkey and without a password. Or at least, I can. If you can’t it might be a browser issue. I think Firefox is still pretty flaky with passkeys.

 

[Mr. Heckles]

But you can sign in to Google with just a passkey and without a password. Or at least, I can. If you can’t it might be a browser issue. I think Firefox is still pretty flaky with passkeys.

I can sign in using a passkey. But what’s the point of a passkey when they still require a password, and passwords are the weak link?

 

[Howard2k]

I can sign in using a passkey. But what’s the point of a passkey when they still require a password, and passwords are the weak link?

You don't have to use a password, it's not required.

 

[Mr. Heckles]

You don't have to use a password, it's not required.

You’re missing the point. Most people reuse password, and they are in data breaches. Password can be compromised because of that (along with other ways). What’s the point of a passkey for an account when a password, that can be compromised, is still required?

I just went on my Google account and I cannot remove my password and use a passkey only.

 

[Howard2k]

You’re missing the point. Most people reuse password, and they are in data breaches. Password can be compromised because of that (along with other ways). What’s the point of a passkey for an account when a password, that can be compromised, is still required?

I just went on my Google account and I cannot remove my password and use a passkey only.

You cannot log into my Gmail without my passkey, even if you know my password.

You can log into my Gmail with my passkey and without my password.

The password is not required.

I think you’re misunderstanding how it works.

 

[Mr. Heckles]

You cannot log into my Gmail without my passkey, even if you know my password.

You can log into my Gmail with my passkey and without my password.

The password is not required.

I think you’re misunderstanding how it works.

No, I’m not. Even if you have a passkey set up, the password still works.