Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password Secrets Automation

blog.1password.com

Post reply on HN
Print view View original

41–50 of 186 posts

Re: 1Password Secrets Automation

#41

Post by 1cvmask »

fastball wrote: post #31
xoa wrote: post #24

While this looks interesting, I'll admit I feel like there's been a bit of drift from their bread and butter over the years since they launched their cloud thing and started pushing hard towards a subscription model. I chose them long ago specifically over options like LastPass because I liked having a rich application without internet dependency and their attention to detail and features there, but it's been a while…

Very much agree. My pet peeve at the moment is this[1], where they removed a feature I very much like (TouchID in the standalone browser extension) and still have yet to replace that functionality despite many promises that it is just around the corner. It was removed in August 2020. Definitely feel like they've lost sight of why people chose them in the first place, and stuff like this is certainly not helping assua…

Did you ever look at a password manager like saas pass that does not need a desktop app and the browser extension is a full blown app that is protected by 2fa?

Re: 1Password Secrets Automation

#42

Post by xoa »

fastball wrote: post #31
xoa wrote: post #24

While this looks interesting, I'll admit I feel like there's been a bit of drift from their bread and butter over the years since they launched their cloud thing and started pushing hard towards a subscription model. I chose them long ago specifically over options like LastPass because I liked having a rich application without internet dependency and their attention to detail and features there, but it's been a while…

Very much agree. My pet peeve at the moment is this[1], where they removed a feature I very much like (TouchID in the standalone browser extension) and still have yet to replace that functionality despite many promises that it is just around the corner. It was removed in August 2020. Definitely feel like they've lost sight of why people chose them in the first place, and stuff like this is certainly not helping assua…

It's a fundamental concern I've always had with subscriptions for non-entertainment services or trivially fungible goods. I've become a big believer in business incentives and feedback loops for sustainable commercial relationships. Individual leadership and culture can stand against them to some extent for a time, but individuals move on and it seems that near inevitably over enough years organizations tend to track and/or drift according to their incentives and impactful feedback. In a traditional software upgrade model, the default is that they get no money unless they can convince people to upgrade each time. They make their money from overcoming that default, and if people choose not to upgrade that's the most core unignorable feedback for a business that something isn't right. It doesn't guarantee responsiveness or good choices, but it forces them to think about it. From a customer perspective, not paying means the status quo, they don't gain anything new but they lose nothing either.

But with subscriptions it gets inverted. Now for the customer failure to keep paying means losing existing functionality and/or having to expend additional resources (money and time) actively moving to something else. So rather then needing to be convinced to give the company more money, it's more that they need to be convinced not to.

There's a real difference between "a customer base that is very happy" and "a customer base that is merely not irritated enough yet to overcome the inherent energy hump and go looking for a new local minima" and I worry the subscription business model makes that easier to ignore. Not that companies can't in principle find out in other ways! They can do detailed customer polling and so on. But that requires active effort and expense by the company so the temptation will always be to ignore it and follow inertia. This doesn't require the slightest bit of active malice, just a break in feedback loops resulting in drift as a company starts pursuing things from its own tunnel vision. They then look and see the money keep pouring in, so what's the problem? The threat eventually becomes that if the energy barrier is overcome and the stampede begins it's too late. It's a shame to see happen to companies I really really like and have great visions that could be even better.

Re: 1Password Secrets Automation

#43

Post by CodeIsTheEnd »

microdrum wrote: post #4

Hah. With the gimmicks, tricks, and dark patterns this company has pulled with consumer, what are the chances professionals would trust them with something like this?

To respond to some of the sibling comments:

1Password originally operated on a licensing model, but has since switched to a membership model.

It is still possible to purchase a single license, but they make it very difficult to do so. The option of a standalone license is not mentioned anywhere on their pricing page: https://1password.com/sign-up/

As I understand it, only once you have downloaded the app and are logging in do they mention that standalone licenses are available. (But, at least on Mac, this option is only available on the version of the app downloaded directly from their site, and not the version downloaded from the Mac App Store.) This support thread shows some users' frustration with this, and their support team's insistence on pushing users to the subscription model: https://1password.community/discussion/102412/where-do-i-buy...

I'm not entirely certain of the differences between the subscription model and the standalone version, but I believe the primary difference is that the subscription model will automatically sync your passwords between multiple devices.

You can achieve similar functionality with the standalone license version by storing your vault (1Password's password file) in iCloud or Dropbox, and relying on that for syncing. I use the Dropbox version and it works incredibly well, even on iOS! I think they also support Google Drive for syncing on desktop, but not on mobile. Certainly the syncing offered through their subscription model is valuable, but for users who have other options, it's just doesn't make sense.

I gladly paid for a standalone license, and have purchased licenses for my parents as gifts; the product is incredible. The Chrome extension works great, and the app can be your 2FA device, so it will automatically fill in password forms and copy the 2FA code to your clipboard. It works just as well on iOS too.

Re: 1Password Secrets Automation

#44

Post by bsamuels »

DangitBobby wrote: post #14
bsamuels wrote: post #6

Here's to hoping there's finally a Hashicorp Vault competitor. It's shocking that the only mature option for runtime secret delivery is Vault after all these years. Some companies have created 'competitors', but they aren't even remotely mature (google secrets manager, aws secret manager, etc)

What are your criticisms of Google secrets manager? It works well for me, but it's the only one I've used so I don't know much about the competition.

By far the biggest missing control is you can't restrict access to google secrets manager by source CIDR.

There were a bunch of other smaller nitpicks, but that was the overwhelming reason last time I looked at it.

Re: 1Password Secrets Automation

#45

Post by xoa »

dastx wrote: post #19
jagger27 wrote: post #11

Earlier quoted context omitted.

I thought AgileBits was pretty well respected around here. What dark patterns are you referring to?

I'm assuming he's referring to their beginnings of being a mostly local password manager (iirc they also had a one-off lifetime purchase), to forcing people to migrate to their cloud only infrastructure with a relatively high subscription price. I'd never heard of 1Password before they were fully SaaS, but as I understand it, some of the original users were pretty upset with this move. Either way, I used to be a 1Pas…

>to forcing people to migrate to their cloud only infrastructure ... fully SaaS

A slight gentle correction. I criticize them elsewhere in this thread, but in fairness I have to point out that this isn't quite correct yet. It's still possible (though they've buried it) to buy a standalone perpetual license for the latest 1Password, run purely local vaults, or keep syncing via Dropbox, iCloud, or manually over WLAN. There isn't any hard tie to the 1Password.com service yet.

Perhaps they'll put the kibosh on that in the future. And they can be and I will criticize them for not having better local sync options, which they clearly stopped bothering with in favor of their own cloud offering. But for the time being I've still got a fully local 1Password 7 license that works the same as every previous version.

Re: 1Password Secrets Automation

#46

Post by umacontaparaohn »

paxys wrote: post #25
varikin wrote: post #12

Earlier quoted context omitted.

What gimmicks, tricks, and dark patterns are you referring to? I've been using 1Password for my personal accounts for probably close to 10 years and have been happy with it. There are some things I feel are clunky, but I've never felt like I was being tricked or deceived by the company.

"It used to be free but now you have to pay" is really the only dark pattern they are guilty of.

Where is your source about it being free?

As far as I remember, I've paid for several versions and upgrades until they forced their crappy subscription service on us.

Not sure about OP but I can see a clearly dark pattern by hiding the non subscription option to the point where I had to google how to acquire one. At this point I simply gave up and choose other option.

If I have to pay yearly at least bitwarden gives me fair price and comparable service. Maybe 1pass is better than bitwarden but it's certainly not 4x better.

Re: 1Password Secrets Automation

#47

Post by [deleted] »

dastx wrote: post #30
wferrell wrote: post #21

Earlier quoted context omitted.

What did you switch to if you stopped using 1Password?

Bitwarden. One of the big reasons for doing so was because when I left my company, they took my Mac away from me, so I invested in a new laptop, for me there was no way I was going for Windows or Mac. So Linux it is. 1Password at the time had extremely poor support for Linux - no desktop client, their 1PasswordX was missing a lot of features and was super slow too. I switched to Bitwarden because it's open source, an…

[deleted]

Re: 1Password Secrets Automation

#48

Post by rectang »

xoa wrote: post #24

While this looks interesting, I'll admit I feel like there's been a bit of drift from their bread and butter over the years since they launched their cloud thing and started pushing hard towards a subscription model. I chose them long ago specifically over options like LastPass because I liked having a rich application without internet dependency and their attention to detail and features there, but it's been a while…

> I specifically want my non-technical family and friends to use password managers

I consider it a victory if I can get non-techies to use their browser's facilities to store passwords, and then to choose reasonably long passwords and avoid reuse.

(I use `pass`, myself.)

Re: 1Password Secrets Automation

#49

Post by umacontaparaohn »

xoa wrote: post #45
dastx wrote: post #19

Earlier quoted context omitted.

I'm assuming he's referring to their beginnings of being a mostly local password manager (iirc they also had a one-off lifetime purchase), to forcing people to migrate to their cloud only infrastructure with a relatively high subscription price. I'd never heard of 1Password before they were fully SaaS, but as I understand it, some of the original users were pretty upset with this move. Either way, I used to be a 1Pas…

> to forcing people to migrate to their cloud only infrastructure ... fully SaaS A slight gentle correction. I criticize them elsewhere in this thread, but in fairness I have to point out that this isn't quite correct yet. It's still possible (though they've buried it) to buy a standalone perpetual license for the latest 1Password, run purely local vaults, or keep syncing via Dropbox, iCloud, or manually over WLAN. T…

Well, until they intentionally break something like the 1password4 integration with the browser extention. And after asking why it broke they say: sorry you're out of luck but here is a shining new subscription just for you.

Now you're forced to buy the new version just for the integration that has always worked fine.

Re: 1Password Secrets Automation

#50

Post by trevorishere »

w0m wrote: post #13
bsamuels wrote: post #6

Here's to hoping there's finally a Hashicorp Vault competitor. It's shocking that the only mature option for runtime secret delivery is Vault after all these years. Some companies have created 'competitors', but they aren't even remotely mature (google secrets manager, aws secret manager, etc)

I've had good luck with Azure KeyVault.

KeyVault is ideal when combined with Managed Identities. I would not leverage any service that required a connection string to access a secret.
Post reply on HN