Comment

Comment by caymanjim

1Password has become fundamentally insecure since about a year ago. You used to be able to run multiple instances of it and log into them separately. You could also run the browser plugin in multiple Chrome profiles and they were fully independent. This is the only sensible, secure way to manage something as sensitive as passwords.

Now they have intentionally crippled your ability to maintain isolation. They want you to go to "one place" to manage all your passwords, across accounts, and muddle through their clunky UI to change vaults. It's not obvious which vault new credentials are saved in. It will pull credentials from all vaults when you go to fill out forms, so now when I log into the different Google accounts I have to use (various clients), even though I'm using separate Chrome profiles, it's all a single 1Password behind the scenes, so I'm prompted to pick from a list of many accounts. I constantly use the wrong credentials to log into things and have to log out and start over. I'm constantly worried that I'm going to leak client credentials into another client's system. It's a huge anti-security pattern, and they did it on purpose. I went to the 1Password forums to learn more about this, and a representative from 1Password stated this was intentional and was proud of it, stating something to the effect "it wouldn't be 1 password otherwise".

I won't use 1Password if I can avoid it, but I'm often required to due to clients using it. I switched to Bitwarden with a self-hosted server for all my personal credentials.

parent caymanjim 4 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton