1Password Releases Safari Extension for iOS 15 and iPadOS 15

[ivan86]

And the extension doesn’t support local vaults. It’s like the 1Password team is begging their users to look for alternatives. If anyone is in that boat, Minimalist Password Manager is looking like a good alternative - http://minimalistpassword.com/

Right. Thats why after giving permission I have not seen any fields filled, since I am using standalone vault on iCloud. Now that makes sense.

Moreover however, at the very moment I tried it I and felt that it hardly would improve the existing workflow, when 1P fills in passwords almost instantaneous now anyway (with Face ID authentication). Do not see a need to have basically just a different kind of pop-up on iOS to use the passwords I need. In rare cases when autofill does not work as desired, well copy-paste hardly takes much time at all.

I do have subscription for a while now, but do not plan to change to v8 for quite a few (elektron) reasons. One other is absent ability to migrate from v7 to v8 with all attachments placed inside the concrete item. This how it was always working in standalone vaults synced to iCloud / Dropbox (or via WiFi), but after 1P.com subscription sync has happened - all attachments are shown as a separate links which are “polluting” the entire password / items list and which is not a desired behavior for sure.

That is: if I have attached two small license files to a single software license item, in standalone vault they would simply be readily attached inside that item (and it will be one entry). On 1P.com synced vault - there will be a link to two license files inside the item, but they will be stored as separate items with own names. I have reported that issue on forums back in the days and decided that I will stay with using a standalone vault for this very reason (and , like many, since I simply preferred to have it on my iCloud, rather then centrally on 1P servers).

Apparently 1P v8 brings such ability back, but… Migration is not working

Since I hardly ever changed names of attachments, other than making list of items much bigger, it will be a complete mess if I switch to v8 now.

Will keep using v7 which I am more than satisfied with on macOS / iOS for as long as I can.

*Not even touching the feel of the elektron v8 app in this post…

Thank you for suggesting Minimalist. Will be monitoring it’s development for sure. At first glance the main thing it is lacking is shared vaults, which I use quite a lot too other than the standalone 1P vault. But, if things go rough, for sure there are less convenient, but working alternatives out there including simply storing a KeePass vault on a shared cloud storage. A bit less convenient, but this is well tested and works just fine for simple needs of sharing passwords with some team members.

 

[noraa]

This assumes that I am updating my client. Right now, due to how old my Mac is and how far it can be supported, I can't, nor will be able to update. I'm stuck on 1Password 6 because of the functionality needed. That has been mentioned and documented a number of times.

BL.

Gotcha. I think that's the sticking point of myself and the OP - the assumption that you were upgrading 1P (while still using WLAN sync). If you aren't even updating the client, then yeah, someone would need physical access to your computer.

With that being said, what the OP stated is still somewhat valid. Let's say you move to a different program (like a KeePass variant), there is still a possibility (albeit very slim) for the client you download to have been hacked.

Actually, now that I think of it more, if you use a program like LittleSnitch you can completely block all network traffic of your password program, accept for LAN traffic.

 

[noraa]

You are missing the point. Your client will be connecting to a remote server if it is compromised in the way the PasswordState "hack" occurred. It will be sending your data to a remote server, or servers plural. That's the entire point of delivering a compromised client payload. The hackers modify the client to take control of your data. They don't care whether your vault is cloned in the cloud, or stored only on your Mac, once you've decrypted your data with the master password they can control that data with a hacked client.

Keeping the data local on your Mac is only good until a) your Mac is hacked or exploited in some way, or b) the client you use to interact with that data is compromised in some way.

You cited a terrible example to demonstrate your WLAN cause. That's the point. I'll help you out some more: run a little Google search on "Lastpass hacked". There's a slightly better example for you to use.

One thing that would prevent such an attack from occurring (something that a cloud server couldn't prevent) is if you use a program like LittleSnitch to block all network traffic for your password manager, except for your LAN (for WLAN sync).

Being able to have full control of your data is always going to be more secure than handing it over to a 3rd party - no matter how trustworthy and secure that 3rd party is.

 

[steve62388]

That would be the problem with the people holding the data. The card processing companies are subject to audits annually if not more frequently, and have not had a problem. The company I worked for handles fraud monitoring for every major bank in the country. In the 12 years I have been there, there has not been a single breach. And this is for a company that also provisions credit card terminals for merchants.

If data has been stolen, that would be at the merchant's end, not the processor. For example, TMobile would be the merchant, while TSYS, FISGlobal, or similar would be the processor.

BL.

Your company might not have, but plenty have. A quick Duckduckgo came up with a number of articles. I guess the point I'm making is there are vulnerabilities no matter what you do.

The company that processes payments for Amazon and Swiggy has reported a data leak of over 100 million debit and credit cardholders | Business Insider India

Information of over 100 million debit and credit card users has been leaked online from payments processor Juspay. The leak includes the users names, contact information and information related to their debit and credit cards.

www.businessinsider.in

Another credit card processor breached, fraud extent unknown

It's only been a month since Heartland Payment Systems disclosed that it had …

arstechnica.com

MasterCard, VISA Warn of Processor Breach – Krebs on Security

Credit card data breached at unnamed payment processor

Credit unions are reporting that consumer credit and debit accounts were exposed in a breach at a payment processor but the name is being withheld during the forensic investigation.

www.cnet.com

Card Processor Admits to Large Data Breach

A large credit card processing company was breached in an attack late last year that may have compromised more than 100 million accounts. Heartland Payment Services, which processes debit and credit card transactions for 250,000 businesses, said it first learned around late October that it might...

www.wired.com

Payment processor suffers data breach that exposes 50,000 credit card numbers

Global Payments, an Atlanta-based credit and debit card processor for banks and merchants, has suffered a security breach that has exposed information on at least 50,000 cardholders, the Wall Street Journal reported.

www.infosecurity-magazine.com

 

[hammie14]

It is a bit annoying to see the login data above the keyboard and within the login field now as an add on. But great app update of course.

@hammie14:
Same here

@Blue Hawk

FYI i found this on the 1Password forum, I have tested it and it works.

Check out https://1password.community/discussion/123510/1password-extension-unlock-biometrics

The Extension works with faceID or touchID, You will see a UUID this is the UUID from 1Password and there hoping to change this in later releases!

Not sure if anyone else has posted this but I hope it helps!

 

[TriBruin]

I actually would have been protected against any hack, because I would control my vault, not it being in possession of any SaaS. I have never used 1Password.com syncing, nor would I ever intend to. Because of that, anyone malicious would have to get physical hands on my Mac or the drives I have that contain my vault. That is the difference, because 1Password 8 no longer has the WLAN Sync functionality to keep a standalone vault. I would be forced to store my vaults on 1Password's servers. If someone hacks that service and gets physical hands on my vault, I'm compromised. That goes for any SaaS. Passwords, and any PCI or PII data is not worth that risk, especially if the service isn't subject to audit.

I work at a place that hosts and stores credit card (PCI) data. Because of the standards for that industry, we must be subject to multiple security audits regarding that data. No such controls exist on these services, which includes no liability in case those services are compromised. That is a huge liability to any company, and any client of that company (and that includes the government, who are also clients of that company).

Like I said in another thread, the feature of having convenience should never be at the cost the security of your data.

BL.

Just to make sure you are consistent. You have turned off all iCloud functions on all your devices right, especially iCloud Keychain. And you use NO cloud services are all?

 

[bradl]

Just to make sure you are consistent. You have turned off all iCloud functions on all your devices right, especially iCloud Keychain. And you use NO cloud services are all?

Not necessarily. Find My requires iCloud, as I have very forgetful children and a blind wife. However, I am not using iCloud Keychain to store any of my passwords. I do not use any other cloud service: Dropbox, Google Cloud, AWS, Azure, nothing.

I have two Synology NASes here, in which I run my own cloud services through one, via WebDAV (the other is just a straight NAS for internal network use only). However, I am in control of those, not a third party.

BL.

 

[Mr. Heckles]

Not necessarily. Find My requires iCloud, as I have very forgetful children and a blind wife. However, I am not using iCloud Keychain to store any of my passwords. I do not use any other cloud service: Dropbox, Google Cloud, AWS, Azure, nothing.

I have two Synology NASes here, in which I run my own cloud services through one, via WebDAV (the other is just a straight NAS for internal network use only). However, I am in control of those, not a third party.

BL.

How about email?

 

[bradl]

How about email?

Nope. No iCloud for email. Granted, it creates the account for it when you sign up for iCloud, but I don't use it, no, with the exception of anything that comes in gets forwarded to another address. If it helps, I'm a Linux sysadmin; I built my own mail server in which I connect to that with my mail client. For the outgoing mail, I send back out to my mail server, which would then relay to my ISP or anywhere it would need to go before going further outbound.

BL.

 

[HSVBamaBob]

The subscription has nothing to do with hosting in the cloud.

Every password manager out there uses cloud hosting, including Apple. 1Password is the most secure and robust of all. I have been using it from 13 years.

I too love 1PW. I HATE Subscriptions but even worse is the 'one size fits all' "Family" plans - I don't need 5 accounts - it is just me and my spouse...why can't 1PW offer a partner account like BitWarden?

 

[Seend1983]

This isn’t how it works. Nothing would be exposed.

More info here: https://blog.1password.com/what-if-1password-gets-hacked/


My 1Password subscription is the best money I spend each year.

Can you share what features make the subscription so great? Feature that you can't get with the standalone vaults

 

[Mr. Heckles]

Can you share what features make the subscription so great? Feature that you can't get with the standalone vaults

With the family version, you can recover family members accounts. This is a huge help especially with my mom, i had to do this twice to get her data back.
They just released where you can Share passwords with people who don’t use 1Password also. You can set time limits, how many times they can look the password, and so on. You also can use 2FA to secure your account (or a key like Yubico). This is just off the top of my head.

 

[Seend1983]

With the family version, you can recover family members accounts. This is a huge help especially with my mom, i had to do this twice to get her data back.
They just released where you can Share passwords with people who don’t use 1Password also. You can set time limits, how many times they can look the password, and so on. You also can use 2FA to secure your account (or a key like Yubico). This is just off the top of my head.

Can't the recovery feature be accomplished with a simple backup? Share password is fine, but nothing that can't be accomplished by some other, less flashy, means. In other words, no feature you mentioned would really convince me that it's worth paying and paying and paying every single month for.

Do you really think these features are worth recurring payments for?

 

[Mr. Heckles]

Can't the recovery feature be accomplished with a simple backup? Share password is fine, but nothing that can't be accomplished by some other, less flashy, means. In other words, no feature you mentioned would really convince me that it's worth paying and paying and paying every single month for.

Do you really think these features are worth recurring payments for?

How can you recover a password from back up if the person forgets their password? You can’t. On the non-subscription version you lose all of you data and have to start over.

The family version is $4.99 a month per person for 5 people, so less than $1 Per month per person. IMO that’s cheap. I also can have 1Password on as many devices as I want. I have it on 10 devices, and that’s just me (on iOS, macOS, Windows, Linux, and Android).

I also can share vaults with other family members (one for my wife and myself, one for us and the kids, one for us and each of our parents). You can set restrictions on these vaults also (others can’t change anytime/read only).

I can also have Guest Vaults that don’t count against my family member count (that uses its own master password). There are a lot of ways to use them. I have a guest vault on my work computer with just work passwords. That guest vault is shared with my personal 1Password so I can see the work passwords in the same area as my person stuff. So on my personal devices I’ll see personal passwords and work passwords, but on the work computer I just see work passwores. My wife has this same set up for her work. So, if you think about it, we have 7 members (5 family + 2 guest vaults) each with its own separate master password.

I also have an area to upload documents, and can share with anyone I want on my account. My wife and I use one with our mortgage documents, business documents, insurance, and other things. Yes, there are other services to do this, but it’s nice to have it all in one spot.

It it worth the price for us? Yes. I spend more than that on a milkshake when I take the kid out for lunch. I would even pay the single version also.

 

[bsmr]

1Password can read all my website data and my history and so on… don’t know if I like that.

They know exactly who I am, they know where I am at the moment…

And their iOS App does have tracking enabled.

Yes. My passwords are safe… but the rest??? ?

 

[jlc1978]

1Password can read all my website data and my history and so on… don’t know if I like that.

They know exactly who I am, they know where I am at the moment…

And their iOS App does have tracking enabled.

Yes. My passwords are safe… but the rest??? ?

It keeps crashing on my MBP AS machine. I just keep it since it has a bunch of attachments, otherwise I use BitWarden.

 

[bsmr]

It keeps crashing on my MBP AS machine. I just keep it since it has a bunch of attachments, otherwise I use BitWarden.

Did you try 1Password 8?

 

[jlc1978]

Did you try 1Password 8?

No. I’m done with them and the subscription model.

 

[Doctor Q]

1Password can read all my website data and my history and so on… don’t know if I like that.

They know exactly who I am, they know where I am at the moment…

And their iOS App does have tracking enabled.

Yes. My passwords are safe… but the rest??? ?

For the record, they claim otherwise:

"Your data is end-to-end encrypted and only you have access – we can't see what you store in 1Password or which sites you visit."​