Security Experts Wary as 1Password Subscriptions Push Users to Cloud-Based Vaults

[CatalinApple]

if you don't trust encryption then sorry but you're boned.

the only way trust on the internet works for banking, secure network traffic, etc is encryption.

and the encryption used for those things is far easier to break due to using less rounds of encryption and usually less secure, faster ciphers than your typical password manager.

your passwords are already out there in hash form everywhere on the internet. your banking info is already traversing the internet in encrypted form. if you do not trust encryption, then sorry but that horse has already bolted whether you use a password manager or not.

Using the internet in any way is a risk. Even having an account on this forum or email address can be risky. If you are all so freaked out about servers then we should go back to the ice age. No internet, no servers, no stress, 100% secure.

$36.00 a year is unreasonable to you?

In my opinion, three dollars a month for a quality app that has regular updates and staff that respond promptly to questions and concerns is worth it.

Do you expect the developers to keep working and updating the app for life for free? Don't they deserve some renumeration?

Do you work for free?

Totally agree with you. People are expecting Agilebits to work for free for the rest of their lives. How would all of you react if your boss would tell you "Hey, I am not paying you anymore. You will be just fine with a one time payment for the rest of your life" This mentally of "free stuff" must change.

 

[ginkobiloba]

I understand the complaint with this specific article, but in general people need to accept that subscriptions are the future of software. This isn't iOS 2 (or whatever it was called) and most of the apps are sound effects that cost a dollar.

No. You are confusing "i don't want to pay for software" with "I don't want subscriptions"
I have software on my mac that costs more a thousand dollar ( go check the prices of 3D, high end audio or video compositing software ). Yet I refuse to pay for subscriptions, and it has turned out pretty bad for some companies that tried to shove it down their customer's throats ( see Autodesk ) and have started losing ground to their competitors that sell permanent licenses.

 

[Michael Scrip]

I am. Lastpass has been hacked more than once.

At least they told us they got hacked.

I wonder how many other companies try to keep it secret? Only to be embarrassed when someone else reports it?

I believe what LastPass says about their security. When you send your passwords to LastPass... they get encrypted on your local machine before they get sent to their servers. So even if the hackers were able to download your data... they can't read it.

Also... LastPass doesn't even store your Master Password... which is a big part of the the encryption key.

So yeah... I feel safe with LastPass. Even though they've been "hacked"

It would be kinda hard to use MANY products or services since so many have been "hacked" these days.

 

[KeepCalmPeople]

At least they told us they got hacked.

I wonder how many other companies try to keep it secret? Only to be embarrassed when someone else reports it?

I believe what LastPass says about their security. When you send your passwords to LastPass... they get encrypted on your local machine before they get sent to their servers. So even if the hackers were able to download your data... they can't read it.

Also... LastPass doesn't even store your Master Password... which is a big part of the the encryption key.

So yeah... I feel safe with LastPass. Even though they've been "hacked"

It would be kinda hard to use MANY products or services since so many have been "hacked" these days.

Do we know for sure that 1Password doesn't do the same thing?

 

[twhensley]

If they remove local storage, my family and I are out. Apple's Keychain would work for passwords and that is free.

What other options remain?

pwsafe
https://itunes.apple.com/us/app/pwsafe-password-safe-compatible-password-manager/id520993579?mt=12

 

[B60boy]

Like having Verizon expose your info.

http://money.cnn.com/2017/07/12/technology/verizon-data-leaked-online/index.html

 

[Michael Scrip]

Do we know for sure that 1Password doesn't do the same thing?

I'm sure 1Password does something similar. They'd be crazy not to.

But my point was... I'm not scared of storing data with LastPass in "the cloud" because they do a VERY good job of keeping it secure.

Your actual passwords are wrapped in a ball of encryption... and LastPass themselves don't have the key.

Yes they've been "hacked"... but nothing of value can be used. The hackers can't get your key. That's the whole point.

 

[Wreckus]

Using the internet in any way is a risk. Even having an account on this forum or email address can be risky. If you are all so freaked out about servers then we should go back to the ice age. No internet, no servers, no stress, 100% secure.

Totally agree with you. People are expecting Agilebits to work for free for the rest of their lives. How would all of you react if your boss would tell you "Hey, I am not paying you anymore. You will be just fine with a one time payment for the rest of your life" This mentally of "free stuff" must change.

I don't want them to work for free but I want them to add options/features to the app we originally paid for without an subscription. One example is add MS Onedrive support to store our Vault for those with windows, Mac, & IOS devices. I don't want to pay for a dropbox account since I use OneDrive for everything already. Hell, I'll buy the app again to have that support. Instead, they want us to go with an subscription in order to have cloud syncing between windows & Mac/IOS devices. I think there was syncing w/ icloud (can't remember) but I couldn't get it to work obviously if I went with the subscription model...which I recently ended and moved to enpass.

 

[twhensley]

iCloud Keychain.

oh wait... that's in the cloud.
But that's probably their reasoning behind this decision; customers want the accessibility of the cloud. And if the cloud reduces friction for customer experience (damm the tradeoff) then perhaps everyday customers (not those who post in security/Mac forums) will more likely buy-in?

I actually don't mind the cloud aspect of this if it is properly encrypted. But their prices are too high. I'm not paying $35/year for myself or $59.88/year for my family for a password manager. If I could buy it for a reasonable one-time price and choose where to store my password vault(s), I would do that. I'd even be willing to use their cloud service for a much smaller amount. Like maybe half what they are charging. Maybe they could ditch the 1 GB document storage. I don't need that baked into my password manager.

 

[riverfreak]

Only Westerners use this thing. Ridiculous.
(Go to Japan, Come to India [and China? Haha] there is no existence of 1Password, America seeks convenience for everything than goes to discover a problem that never existed at first place. The credit card structure have ruined the minds of people.)

Huh?

And I suppose you use unique 25 character passwords on every site? And you probably use random strings for password challenge questions to prevent someone gaining access to your accounts using simple-minded social engineering with your public data? And you've got two-factor enabled on everything -- and not previously lost all your update codes in a botched google update?

 

[Michaelgtrusa]

Only Westerners use this thing. Ridiculous.
(Go to Japan, Come to India [and China? Haha] there is no existence of 1Password, America seeks convenience for everything than goes to discover a problem that never existed at first place. The credit card structure have ruined the minds of people.)

Then why is India begging for USA technology?

 

[Stewie]

In my many years of using 1Password, I've found the owner of AgileBits, Dave, to be incredibly down-to-earth and he seems like a good guy. Based on my previous experiences with them, I'm not currently concerned that AgileBits will, in the end, make a decision that allows them to remain profitable and also satisfies me and allows me to remain a customer.

I wouldn’t mind the subscription fee of the cloud storage, but I won’t put up with lousy customer service. I had paid for a year of thier service and had an issue so I sent off a email to their ‘support’. 73 days later they followed up. 73 days! I will never trust a company with something as important as my passwords that can’t be bothered to support their paying customers.

 

[throAU]

Until the OS changes, Safari, Chrome, Firefox, etc changes and you need a new version.... Then you are screwed. Better to ditch the software and go to something that you are more comfortable with.

i

Just view its nonexistent network traffic.



Of course I have heard of Javascript, but do you understand that you can go to their website and put in your account password and open your vault with no plugin installed in the browser or anything.

Your password is used in some manner to open the vault. Hackers who get your vault will use the exact same method to open your vault, brute forcing your password. Yes it is done in Javascript (meaning your encrypted vault is transferred to your browser where the Javascript then works on decrypting it, using your password) but again your password is the only thing you need to open the vault, no other key is used but the password you supply and that is what will get brute forced.

Let me rephrase

You understand that JavaScript can do the vault decryption locally on your machine, without your master password ever being sent to 1Password, yeah?
[doublepost=1499921541][/doublepost]

It is solved. It is solved with local sync.

No

If you are relying on someone not having access to your password database, you failed.

This is why it is encrypted.

 

[nhannomad]

**** these subscriptions, just apps after apps, I wonder when will my next favorite app go subscription so these developers could go virtue signalling this stupid trending.

 

[myob1984]

In this whole thread I only saw one person ask the question what happens if Agilbits goes away. I asked and the answer was you can't get to your data anymore. You only have local cache and no way to sync if you are on Windows 6 version. I will stay on 4 for Windows and 6 for Mac for as long as I can.

 

[throAU]

In this whole thread I only saw one person ask the question what happens if Agilbits goes away. I asked and the answer was you can't get to your data anymore. You only have local cache and no way to sync if you are on Windows 6 version. I will stay on 4 for Windows and 6 for Mac for as long as I can.

your local cache can be exported to CSV.

it will be in sync up to the point service dies.

same as if you synced via dropbox (and dropbox went broke)
same as if you had no sync at all and relied only on local database files

be aware if you are on version 4 there is a known security problem between the browser plugin and the app. so i'd suggest that's more of a security concern than network database file sync.

 

[patrickbarnes]

Another company that's trying to get people to pay many times for the same product.

I gladly pay subscription for something like Netflix, Hulu, Apple Music... things that CONSTANTLY come up with new content. I can't say the same for (almost) all apps.

Do you think wages, rent and servers are a one time fixed cost?

No software company can survive on a single purchase model. That's just a way to get you hooked before they eventually switch to a subscription model.

Get used to it.

That said, no way i would trust Agile Bits to store this data. Mac developers have no clue about security or web services.

 

[AlexH]

Do you think wages, rent and servers are a one time fixed cost?

No software company can survive on a single purchase model. That's just a way to get you hooked before they eventually switch to a subscription model.

Get used to it.

That said, no way i would trust Agile Bits to store this data. Mac developers have no clue about security or web services.

Companies can and have survived without subscription models. Can they make more consistent money with a subscription model? Yes. But let's not pretend the only profitable way to do business is a subscription. It's just not true.

 

[myob1984]

your local cache can be exported to CSV.

it will be in sync up to the point service dies.

same as if you synced via dropbox (and dropbox went broke)
same as if you had no sync at all and relied only on local database files

be aware if you are on version 4 there is a known security problem between the browser plugin and the app. so i'd suggest that's more of a security concern than network database file sync.

Can you provide a link to the security problem? I did a quick google search and didn't find anything.

No you aren't in the same boat if dropbox went away as you would be if Agilbits went away. I can switch to another cloud or use WiFi sync and continue to use the apps.

 

[bice]

if you don't trust encryption then sorry but you're boned.

the only way trust on the internet works for banking, secure network traffic, etc is encryption.

and the encryption used for those things is far easier to break due to using less rounds of encryption and usually less secure, faster ciphers than your typical password manager.

your passwords are already out there in hash form everywhere on the internet. your banking info is already traversing the internet in encrypted form. if you do not trust encryption, then sorry but that horse has already bolted whether you use a password manager or not.

I think that you do not understand the issue I am talking about.
A bank surely trust their vault, but they do not tell everyone where it is. Even if you think you have the perfect security solution, why would you weaken it by exposing it? The attitude "this is so failsafe I can brag about it" is a security risk in itself.

"My banking info transversing the internet" is not the same as millions of user passwords stored in one location. One of them are easily located in space and time, the other is not.

 

[Cloudane]

"Security Experts"? Okay let's see who they are. A panel called Crypto Village from a convention.. never heard of them..

What's the basis of their research? Are they able to provide some good quality evidence that the average personal computer, wifi connection, home brewed Nextcloud installation, etc with their own personal security policies and practices is less of a security risk than an experienced security company's datacentres with triple encryption, multi factor authentication and full time staff dedicated to keeping their datacentres secure? Here's 1password's model. https://1password.com/security/

Or are they just stirring the FUD (Fear, Uncertainty and Doubt) of people who don't understand how it works?

If and when a hacker does get hold of some highly encrypted data that is useless to them, I assume these same "news" outlets will be churning out sensationalist "1password's datacentre hacked and all of their user's passwords shared all over the internet" kind of headlines to scare people into thinking their unencrypted passwords can be garnered from a quick google search.

Any word from Tavis Ormandy, the researcher who works for Google and has documented actual vulnerabilities in Lastpass? (Which incidentally they very quickly fixed, were open and honest about, etc)?


I mean yeah I'm as cynical as anyone else that it's yet another company shoving everyone onto a subscription licensing model so they can take your money forever instead of a one-time license fee (I'd guess that a lot of users don't buy the paid upgrades). Agilebits probably saturated their market and need more money, at a guess. But seemingly that's all this is, and is completely separated from their recommended storage solution. They're still letting you use your own syncing or local only, if you choose to. I don't see how the outrage is justified when it's based on fairly shaky allegations about their security model rather than their pricing (which is rather expensive in comparison to Lastpass)

 

[throAU]

I think that you do not understand the issue I am talking about.
A bank surely trust their vault, but they do not tell everyone where it is. Even if you think you have the perfect security solution, why would you weaken it by exposing it? The attitude "this is so failsafe I can brag about it" is a security risk in itself.

"My banking info transversing the internet" is not the same as millions of user passwords stored in one location. One of them are easily located in space and time, the other is not.

no, i get it - but i also think your paranoia on this particular issue is unjustified.

so, does no body know where things like the UK royal mint, fort knox, etc. are? Of course they do. Yet life goes on.

sure, deliberately exposing it when you don't need to is not the smartest idea, but relying on the fact that no one has your password DB, or that no one knows where your banks vault is (which they do, it's not hard to work out) is not a reliable method of protection. and if you can't rely on it, you need to take other precautions.

you should be assuming the location of your bank is known, or (for your password DB) your password file is stolen and should be taking steps to ensure that when it is, you aren't screwed.

and password safe tools have done just this.

My point is that if you don't trust the encryption, then don't run a password manager at all. Because every piece of software running on your machine potentially has access to the file your password manager is storing data in.

[doublepost=1499933629][/doublepost]

Can you provide a link to the security problem? I did a quick google search and didn't find anything.

No you aren't in the same boat if dropbox went away as you would be if Agilbits went away. I can switch to another cloud or use WiFi sync and continue to use the apps.

if agileBits goes away, you export to csv, switch to keepass. so far, they haven't, they have committed to maintaining the ability for existing local sync users to do local sync.

I don't have a link to the web plugin -> 1password vulnerability, but it was about 1-2 years ago (i.e., well into the life of 1password 5 or 6 or whatever and affected all previous versions.

essentially malware running on your machine could intercept traffic between 1password and the web plugin that was sent in the clear, or something like that.

running ancient versions of security software is not a solution if you disagree with the future direction of the product. accept the direction and continue to keep up to date, or jump ship to another product. software regularly has flaws, and sticking with really old versions of software involved in keeping your passwords secure is a big risk.

at least, if you do so, be SURE to follow the change logs to ensure that you're aware of any vulnerabilities discovered that impact your version of the software.

If you're not going to keep up to date with this based on this future policy direction for new customers only, I'd recommend Keepass.
[doublepost=1499934853][/doublepost]

I don't want them to work for free but I want them to add options/features to the app we originally paid for without an subscription. One example is add MS Onedrive support to store our Vault for those with windows, Mac, & IOS devices. I don't want to pay for a dropbox account since I use OneDrive for everything already. Hell, I'll buy the app again to have that support. Instead, they want us to go with an subscription in order to have cloud syncing between windows & Mac/IOS devices. I think there was syncing w/ icloud (can't remember) but I couldn't get it to work obviously if I went with the subscription model...which I recently ended and moved to enpass.

why?

you bought the product as is. anything outside of defect repair should by rights be a paid upgrade or subscription only.

do you expect GM or Ford or whatever to upgrade the engine in your car whenever some new tech comes out, for free?

 

[tangfish]

I've gotten at least a few dozen people to adopt 1Password over the years (all standalone, 0 1Password.com users). I felt like I was doing them a favor. Now I've got to find them, and myself, an alternative.

Thanks for all these great years Dave, but here is where we begin to part ways. I don't blame you, it's just business and I understand that, but it sure would be nice if you set aside the schtick about 99.9% of users wanting the cloud model over the local vault one... it's clear as day that it's the furthest thing from the truth, as evidenced by this massive worldwide backlash. I think we deserve a little better than this sort of lip service.

Just my 2 cents.

 

[LV426]

People are expecting Agilebits to work for free for the rest of their lives. How would all of you react if your boss would tell you "Hey, I am not paying you anymore. You will be just fine with a one time payment for the rest of your life" This mentally of "free stuff" must change.

Not at all. I'd be perfectly happy if Agilebits simply fixed bugs in their code (which they seem to do quite a lot) rather than add new features. It has all the features I need, thanks. But I did pay for an app that should deliver on its specification in a bug free manner, so I do expect bugs to be fixed without charge.

Operationally, it's not costing Agilebits any money at all to keep my vault ticking over because I sync devices via a cloud account - iCloud.

 

[al404]

I read some pages, not all

I'm really disappointed with 1password and I'm not going to pay a subscription.
Even if it was the best cloud app ever, I used 1password for many years and now i have to spend a lot of my time to move to keychain or a different solution. They can change the fee any time, other cloud service did. And anyway I don't want my password in the cloud, if I have to sync via cloud based service I chose Apple keychain.

Since i did not real all posts:

- did anyone suggest an alternative offline app?
- i guess first time the offline app can stop working is with high sierra