Security Experts Wary as 1Password Subscriptions Push Users to Cloud-Based Vaults

[trainwrecka]

iCloud Keychain.

oh wait... that's in the cloud.
But that's probably their reasoning behind this decision; customers want the accessibility of the cloud. And if the cloud reduces friction for customer experience (damm the tradeoff) then perhaps everyday customers (not those who post in security/Mac forums) will more likely buy-in?

I don't care about storing stuff in the cloud, but I do care about subscriptions. I'm sure if they were making enough money to sustain operations going forward, this wouldn't be needed. Unfortunately, they have a user base that bought the product once and don't see a need to upgrade to anything else. The app still does what it was supposed to do - manage passwords through one password. Why buy an upgrade if it still does what you want?

They don't realize that people are constantly updating 1Password to make things stay secure. Subscriptions seem like the solution to that.

They don't gain new customers, because iCloud Keychain and other password managers (like Safari remembering passwords) is good enough. That worked for me for over 10 years. Sure, 1Password is light years ahead of that stuff, but I didn't realize that.

 

[dogslobber]

As for security, I would suggest reading up on how 1Password is storing and encrypting your data. I'm no expert, but it seems like it would be an insurmountable task for any hacker to first download your entire vault from AWS and then break the encryption. Not to say it's impossible, but it's not something I'm worried about.

Every hacker loves a challenge. Then it's too late. The biggest security flaw in the universe is complacency.

 

[stulaw11]

FYI the Lastpass breach in 2015 was a bit over-hyped: "hackers obtained “email addresses, password reminders, server per user salts, and authentication hashes.” The stolen data didn’t include either master passwords or encrypted data."

Nothing of significance was taken and no breaches using user credentials were noted anywhere that I could find. At best the got your email address (big deal those are relatively easy to find on the web) and password reminders (whatever those are).

ANY cloud service, dropbox, onedrive, icloud, your gmail/email, even your ios backup has SOME level of vulnerability on the cloud. If all you do is live in fear of the ever so slight chance of a significant (not simply getting your email address or useless bit, but a major breach exposing your full logins) hack then you will never progress in technology usage. You mine as well go back to writing them on a piece of paper in your wallet then.

I agree not paying when others are free, but you already ALL have stuff in icloud (and likely keychain) if you use iOS that isnt more secure necessarily.

 

[tkermit]

Ugh, how disappointing. Better start looking for alternatives now. I used to be such a fan of the company, too.

 

[Sa1Nt]

Every hacker loves a challenge. Then it's too late. The biggest security flaw in the universe is complacency.

That's not really an argument lol

 

[silvetti]

FYI the Lastpass breach in 2015 was a bit over-hyped: "hackers obtained “email addresses, password reminders, server per user salts, and authentication hashes.” The stolen data didn’t include either master passwords or encrypted data."

Nothing of significance was taken and no breaches using user credentials were noted anywhere that I could find. At best the got your email address (big deal those are relatively easy to find) and password reminders (whatever those are).

ANY cloud service, dropbox, onedrive, icloud, your gmail/email, even your ios backup has SOME level of vulnerability on the cloud. If all you do is live in fear of the ever so slight chance of a significant (not simply getting your email address or useless bit, but a major breach exposing your full logins) hack then you will never progress in technology usage.

I agree not paying when others are free, but you already ALL have stuff in icloud (and likely keychain) if you use iOS that isnt more secure necessarily.

From your post I seem to get the impression that you qualify 1Password security to the same level as Apple and Google?

 

[Dainin]

Disappointing move on their part. The day they stop letting me get updates and don’t let me buy a permanent license I’m out.

 

[stulaw11]

From your post I seem to get the impression that you qualify 1Password security to the same level as Apple and Google?

i know no particulars about any of them and thus assume none are better than the other as ALL (including Lastpass and Microsoft) have had some type of data breach over the past few years.

So no, I see none as "better" than the rest who have not been hacked at some level.

 

[silvetti]

i know no particulars about any of them and thus assume none are better than the other as ALL (including Lastpass and Microsoft) have had some type of data breach over the past few years.

And who do you trust more?

 

[stulaw11]

And who do you trust more?

None. That's the point.

So I use whatever I want to and dont dwell in some panicked state on the offshoot chances equal to that of being struck by lightning while jumping off a bridge and being shot mid air

 

[Rigby]

If they remove local storage, my family and I are out. Apple's Keychain would work for passwords and that is free.

What other options remain?

Give Keepass a try. On the Mac I recommend KeepassXC (which is a fork of KeepassX). On iOS there is Minikeepass. All are free and open source. There are several alternative apps that can open the Keepass vault files too, so you will never be locked in to a particular app.

The apps aren't quite as polished as 1Password, but are much more configurable and, once you have figured out features such as autotype, quite comfortable to use.

 

[coolbreeze]

Lastpass + 2FA works great for me. I wish Agilebits the best. Nope.

I understand developers want to make money, but damn...1password's apps were priced sky high, and now the want a constant revenue drip? Yikes. Lastpass is $1/month. A helluva bargain IMO.

And yes I understand the risks of cloud based services. 2FA + frequent master password changes are good by me.

 

[silvetti]

None. That's the point.

So I use whatever I want to and dont dwell in some panicked state on the offshoot chances equal to that of being struck by lightning while jumping off a bridge and being shot mid air

And if none, why do you prefer to pay 2.99 to host your password database vs iCloud for free?

 

[stulaw11]

And if none, why do you prefer to pay 2.99 to host your password database vs iCloud for free?

I dont, where did I say I used 1Passwordd anymore?

The last line of my OP said why pay when others are free (ie Lastpass)

 

[Rigby]

I'm not sure the so called security experts here make any sense at all. Your passwords aren't any less secure on a cloud based server than with the 1PassWord folks. Security comes from encryption of the files not the location of the files. Any server can be hacked it is a lot more difficult to decrypt a well encrypted file.

This is generally correct. The problem is that there might be yet undiscovered implementation flaws in the app, especially since it is a closed-source app that cannot be independently audited. Also, if the user uses a weak password, it may be possible to crack the database using dictionary attacks. Modern password crackers can do amazing things.

 

[tasset]

Ugh, how disappointing. Better start looking for alternatives now. I used to be such a fan of the company, too.

Same here. I kinda feel bad for recommending them to a few people, but I shouldn't be surprised when I saw the size of their development team on their blog that eventually the gravy train of paid licenses would run out and they would turn to recurring subscriptions. Hopefully iOS 12 will go some ways into Sherlocking password apps. I can already use Keychain and the Notes app for 80% of the passwords I have to manage. I don't need all the bells and whistles added to justify subscribing. Just a locked down vault.

 

[ihackalot]

Only Westerners use this thing. Ridiculous.

So what about Eastern people?

 

[LuvMacs]

Switched to oneSafe several years ago after 1Password started to hike up its price. No regrets at all.

 

[mikegem]

This forced migration to the cloud will force me back to an Excel spreadsheet for my password manager.

 

[Apple_Robert]

The article isn’t presenting any new news. 1Password has been very upfront with their business.

I use the subscription and I also backup
locally via 1Password, as well as using the free version of Mac Dashlane, for backup
purposes.

Of course an accident can happen with their servers, or locally. The same can be said for Apple, or any other business or app.

 

[schlotz]

Password manager app 1Password caused consternation in some quarters of the security community over the weekend when it emerged that the service's new subscription-based model will push users to adopt a cloud-based password storage system over locally stored password vaults.

Previously, 1Password was offered as a one-time license purchase that enabled users to store their passwords in an encrypted local vault, which security researchers say is more secure than keeping user data in a remote server because hackers are forced to break into a specific device.

Going forward, the service will push customers to monthly subscription plans that serve up remotely stored password vaults through the 1Password.com website. This allows users to access their passwords from any computer by logging into their account, but as noted Motherboard, the change has not been universally welcomed.

​

1Password responded to criticism on Twitter by saying that it had no plans to remove support for locally stored vaults for users who had purchased the app, but that it was advocating subscription-based memberships because "we feel it's the best way to use 1Password".

"We want our customers to get the best. Some people won't agree with that (which is fine!) so we'll work with them to get set up how they want, but for 99.9 percent of people, 1Password.com is absolutely the way to go," Connor Hicks, an engineer at 1Password, told Motherboard.

1Password's new cloud-based option costs $2.99 per month (or $4.99 for an account for up to five people). However, 1Password developer AgileBits reiterated it had no immediate plans to remove support for local/Dropbox/iCloud vaults, and that it was open to speaking with customers to "help them determine if a one-time license is really what's best for them".

Article Link: Security Experts Wary as 1Password Subscriptions Push Users to Cloud-Based Vaults

[doublepost=1499871495][/doublepost]Really tired of the word game.... 'they feel it's the best way to run 1password' sure they feel that way cause it provides a continued revenue stream. It has NOTHING to do with the customer. Time to start looking for an alternate solution....

 

[Porco]

They could rebrand themselves as 1EggBasket..

 

[dogslobber]

FYI the Lastpass breach in 2015 was a bit over-hyped: "hackers obtained “email addresses, password reminders, server per user salts, and authentication hashes.” The stolen data didn’t include either master passwords or encrypted data."

Nothing of significance was taken and no breaches using user credentials were noted anywhere that I could find. At best the got your email address (big deal those are relatively easy to find on the web) and password reminders (whatever those are).

And "authentication hashes", whatever those are. There's also a general assumption of full disclosure - do you believe the source and why should you? Is the source savvy enough to be able to figure out what was "breached" and what wasn't? How did they figure that out then? And do you believe them or do they even know for sure?

ANY cloud service, dropbox, onedrive, icloud, your gmail/email, even your ios backup has SOME level of vulnerability on the cloud. If all you do is live in fear of the ever so slight chance of a significant (not simply getting your email address or useless bit, but a major breach exposing your full logins) hack then you will never progress in technology usage. You mine as well go back to writing them on a piece of paper in your wallet then.

But is fear not your friend? Does that not prevent you making foolish decisions...like having your financial institution's credentials on some random server somewhere? That's not even questioning the terms and conditions of your financial inst., who might have penalty clauses if you don't secure your financial accounts information. Putting it in "the cloud" is breaching that.

 

[Zirel]

I try but many websites don't really work very well with it.

Yes, they do, and there’s always the manual option...

 

[stulaw11]

But is fear not your friend? Does that not prevent you making foolish decisions...like having your financial institution's credentials on some random server somewhere? That's not even questioning the terms and conditions of your financial inst., who might have penalty clauses if you don't secure your financial accounts information. Putting it in "the cloud" is breaching that.

The dont; we should all just not use web banking, dont use backups of our devices, etc. Going back to old way on going into the bank or ATM every time you need your balance, and when you drop your phone losing everything, is nowhere near convenient to do these days in people's busy lives; nor the way people depend on their data being accessible at all times.

There has to be SOME level of realization of risk in the discussion with everything on the internet without a tinfoil hat on that "omg it will be stolen I dont trust anyone" At some level EVERY person here is trusting some company via the internet, even Macrumors!

FYI, I would NEVER use a password manager for a bank, my investment account, or email to begin with no matter how/where it is backed up. There's a HUGE difference between say your Macrumors/twitter/facebook login info where at most you lose access, and a bank/investment where someone can get at your real money and bankrupt you and make you homeless.