181–190 of 352 posts
But this is just how ~the software~ business works now. Investors want predictable ROI. If your business can’t/won’t show *aaS revenue predictability, investors will take their money somewhere that can.
Earlier quoted context omitted.
> It’s one of those apps which has been made with proper craftsmanship and care Is it? I've been using it for sometime as well but it seems like there is a lot of room for improvement. E.g: - Support for unlocking via Watch ID on the Mac. - Currently on iOS when searching for a password within an app, if a site prefix is included that doesn't match what's in 1Password the list will just show no results, with no way t…
A login can have multiple URLs. For sites which don’t automatically load the right entry, you can add another URL to give 1pw a hint. This won’t solve all your problems. It won’t even solve the problem you describe the first time you encounter it. Nor will it solve it for apps that fail to provide an INTENT URL. But hopefully it will make things a little easier.
Earlier quoted context omitted.
>How can one be sure that the passwords are even encrypted, without having seen the program? We have seen the program. We can have as many binary copies of it as we’d like. > Audits don’t mean much for various reasons, including the conflict of interest. [citation needed] > Agencies such as NSA don’t have to say loudly that they have agreements with such and such companies through PRISM-like programs. The product use…
But that's the point the OP is making, you have to trust what 1password is telling you. And they do have a very clear business interest in telling you that it uses best security practices even if they don't. I'm doubtful that you are able to look at the binaries and extract the inner workings from that.
Yeah, I have to trust a lot of software authors not to be actively malicious, because I don't have the time to audit literally everything I rely on. I have more reason to trust the authors of 1Password than those of almost any other package I use.
>And they do have a very clear business interest in telling you that it uses best security practices even if they don't.
It's been audited several times, and the authors are well known, respected, and vocal in the infosec community. And you think they have more of a business interest in hiring security professionals and lying about their practices than they do actually building a product that safeguards their users' data as they say it does? A backdoor in a product like that would be the end of their business, professional reputation, and career.
>I'm doubtful that you are able to look at the binaries and extract the inner workings from that.
Me personally? No, but there are absolutely people with that skillset, this sort of thing is perfectly doable. As far as "is this sending all my stuff to China in plaintext" goes, it's not even that hard to evaluate. You could do that without any reverse engineering at all.
I’ve been using 1Password every day for over 11 years now. The oldest passwords I’ve got stored are for Twitter and Dropbox (yes, the passwords have been changed but the records were first created in 2009). It’s one of those apps which has been made with proper craftsmanship and care, so while I’m not a Linux user, I’d have no problem recommending based solely on Agilebit’s reputation.
Apparently that craftsmanship went astray with the adoption of Electron.
I just moved from (paid) 1p to bitwarden at the weekend due to lack of proper Linux support. I was just testing bitwarden and found I couldn't easily get a good export of my passwords from 1p on Linux, because only their desktop apps support that. It won't run under wine and I ended up installing a Windows VM specifically to do the export. Was so frustrated at this it pushed me to move to bitwarden. Good for them for…
... I wish I'd thought of booting into my Windows partition and installing 1password there, instead of spending an evening writing up an extremely overwrought export script on top of the commandline client.
That'd be pretty great.
Earlier quoted context omitted.
So sorry we scared you away! Linux has been on our radar for a while but our biggest challenge was finding a way to share code between apps without writing everything in C++. Thankfully we found Rust, a systems language built around efficiency and safety. From there we were able to build the common core we've always dreamed of and were off to the races. Please give us another chance and let us know what you think. <3
> without writing everything in C++ That sounds interesting. Can you list the major technical reasons behind this decision? Also interesting will be if you could explain how Rust addressed those pain points (I have read about the general advantages that Rust has over C++, but interested in hearing how it plays out in the wild).
I’ve been using 1Password every day for over 11 years now. The oldest passwords I’ve got stored are for Twitter and Dropbox (yes, the passwords have been changed but the records were first created in 2009). It’s one of those apps which has been made with proper craftsmanship and care, so while I’m not a Linux user, I’d have no problem recommending based solely on Agilebit’s reputation.