1Password migrants thread

[svenmany]

Maybe it has some art philosophy behind it which I do not know. But if you strip colors out of it, it looks dull like Minimalist on the other hand add too much color and it looks convoluted like KeePass. Same issue with Libreoffice toolbar vs MS Office.

I value pretty. I use 1Password (the full application) all day long and enjoy using it, partially because it is appealing to look at. There are certain applications that, as Marie Kondo says, spark joy when I use them. The 1Password application is one of those.

Unfortunately, the 1Password browser extension doesn't spark much. I've looked at BitWarden as a possible alternative to 1Password; it doesn't have any sparks.

But, we're all different in our tastes and how much aesthetics affect us.

 

[jido]

I use PwSafe.

 

[svenmany]

I use PwSafe.

I know nothing about it. Is it heavily used? The website says it uses the file format of the well-known Password Safe

Password Safe

and it's mentioned on their related projects page, but they say they haven't tested any of those projects. I tried to look into a bit. I see that it's from Huvisoft, which seems to be a company in Vietnam and a member of HuviTek, a general software services business. I wonder what competence they have in this field. Do you know?

Maybe this is another example of just relax and assume everything's gonna be alright.

 

[jido]

I know nothing about it. Is it heavily used? The website says it uses the file format of the well-known Password Safe

Password Safe

and it's mentioned on their related projects page, but they say they haven't tested any of those projects. I tried to look into a bit. I see that it's from Huvisoft, which seems to be a company in Vietnam and a member of HuviTek, a general software services business. I wonder what competence they have in this field. Do you know?

Maybe this is another example of just relax and assume everything's gonna be alright.

It doesn’t just use the same format, it also uses the same source code (Password Safe is open source). I am going for open source and safe compatibility I don’t want to lose my passwords.

 

[svenmany]

It doesn’t just use the same format, it also uses the same source code (Password Safe is open source). I am going for open source and safe compatibility I don’t want to lose my passwords.

Good to hear. I didn't see any mention of that on their website. I guess that's something like 1Password, in that they use open source libraries for some things. But, all I read on their site was

pwSafe uses the same file format as the award-winning Password Safe PC open source PC app. Password Safe has been originally created by security guru Bruce Schneier and nowadays is maintained by Rony Shapiro. Since it has been around as an open source project for more than a decade, it has been extensively reviewed by many experts.

Because the file format is open-source and widely used, there are compatible clients for many platforms.

I understood that to just mean that the vault stored on disk can be opened with compatible clients. On the Password Safe repository there is no macOS or iOS source code. Didn't PwSafe have to port it?

Too bad they used the domain pwsafe.info. The actual open source project is pwsafe.org. It seems like they were trying to suggest an affiliation with that project. We can continue this discussion in my forum at https://forums.macrumors.online.

 

[MisterSavage]

The native Bitwarden iOS app is out of beta. I pulled down the update this morning. I like it!

 

[Jay-Jacob]

The native Bitwarden iOS app is out of beta. I pulled down the update this morning. I like it!

Thanks! I been waiting for that too. I like it too. Also feels smoother and faster too. Before it was delay bring up information, it noticeable before and now it instant! I like new look too.

EDIT: iPad app I had to delete it and reinstall then it works. I keep getting error when I tried to open app after update.

Mac version of app still on old style. I can't remember if it going be update same time or separately?

EDIT 2: It seems new design is mobile apps only (iOS, iPadOS and Android). Not desktop like Mac and Windows etc. Hopefully desktop comes next in future.

 

[Dan From Canada]

I still have 1Password 7 still installed on my iMac but switched over to Bitwarden two years ago and am still loving Bitwarden.
Edit: I paid for the premium version and host the vault myself.

 

[k.alexander]

I value pretty. I use 1Password (the full application) all day long and enjoy using it, partially because it is appealing to look at. There are certain applications that, as Marie Kondo says, spark joy when I use them. The 1Password application is one of those.

Unfortunately, the 1Password browser extension doesn't spark much. I've looked at BitWarden as a possible alternative to 1Password; it doesn't have any sparks.

But, we're all different in our tastes and how much aesthetics affect us.

I agree, I use 1PW on the Mac all day long. It is a very pleasing UI and a pleasure to use. The iOS app, since the last major redesign, unfortunately, is the complete opposite. When I have to use it, I just open, search, pull info, and move on. There is a lot to be said for a UI that doesn't look like Windows 3.1 -- I'm looking at you Keypass and derivatives, and to a large extent (when I last looked) Bitwarden.

 

[Apple_Robert]

I agree, I use 1PW on the Mac all day long. It is a very pleasing UI and a pleasure to use. The iOS app, since the last major redesign, unfortunately, is the complete opposite. When I have to use it, I just open, search, pull info, and move on. There is a lot to be said for a UI that doesn't look like Windows 3.1 -- I'm looking at you Keypass and derivatives, and to a large extent (when I last looked) Bitwarden.

Strongbox has a very polished GUI.

 

[MisterSavage]

Mac version of app still on old style. I can't remember if it going be update same time or separately?

EDIT 2: It seems new design is mobile apps only (iOS, iPadOS and Android). Not desktop like Mac and Windows etc. Hopefully desktop comes next in future.

ha! You beat me to it. It's a bummer a reword of the Mac app isn't on the table yet but I barely use it so it's not even remotely a big deal to me.

 

[Jay-Jacob]

ha! You beat me to it. It's a bummer a reword of the Mac app isn't on the table yet but I barely use it so it's not even remotely a big deal to me.

Yeah it bummer but same I don’t use Mac app too often so doesn’t bother me too much but would be nice all native though. When I was on 1Password in past (before subscription) I never ever have Mac app, iPhone and iPad only. So I am used to using them more than Mac. Now have Bitwarden and Enpass both get free Mac app and it is first time I do have Mac password app.

 

[k.alexander]

Strongbox has a very polished GUI.

Thanks. Just took a Quick Look and at least the Mac app looks largely like a copy of 1PW’s app. Tempting to just buy a life license, for roughly what a family 1 PW costs for a year, and switch over. On the other hand Apple PWs, which I’ve been trying out for the last few weeks, is not as great as 1PW, but maybe close enough and is free and I’m all in on the ecosystem. We’ll see. Plus, maybe Passkeys do make the need for these involved Pw managers less and less of a thing going forward; I mean 99% of users out there don’t use anything but whatever their browser remembers, and they don’t even know how to look that up.

What’s the general consensus on Keepass and their apps? I know it’s open source but never really looked much past that; is the KDBX database considered safe? Is there further exposure by using third party apps that work with KDBX.

 

[MacBH928]

ha! You beat me to it. It's a bummer a reword of the Mac app isn't on the table yet but I barely use it so it's not even remotely a big deal to me.

don't they have that thing where you program an app one time, in swift I think, and it works on macOS+ios+iPadOS?

We’ll see. Plus, maybe Passkeys do make the need for these involved Pw managers less and less of a thing going forward; I mean 99% of users out there don’t use anything but whatever their browser remembers, and they don’t even know how to look that up.

Speaking of, how do passkeys work with sharing with family members?

What’s the general consensus on Keepass and their apps? I know it’s open source but never really looked much past that; is the KDBX database considered safe? Is there further exposure by using third party apps that work with KDBX.

Keepass is Windows only. what you want is KeePassXC which is like multiplatform improved KeePass. Still ugly though. Still ugly though. The only reason I see to use it is if you want FOSS app that stores passwords locally.

Strongbox uses KDBX AFAIK, much better GUI for Apple users.

 

[MisterSavage]

don't they have that thing where you program an app one time, in swift I think, and it works on macOS+ios+iPadOS?

It's not that simple, but yes, you can code in SwiftUI and have your app run on those platforms. But it's a lot of work to properly support a different platform. Not saying they can't do it, but it's not just flipping a switch.

 

[rme]

Has anyone tried running 1PW 7 on Sequoia yet?

 

[Pag46]

Same for me, when I tested it straight after release it was really too “green”.
I have tested it again this week and it starts having almost everything I use:
- logins
- credit cards
- embedded 2FA
- shared vaults
- passkeys
- custom fields
- alias email addresses

And it is open source.

One of my strongest initial concerns was that it was unlocked just with the proton account credentials. They have now added an extra layer of security via an optional, additional password specific to proton pass db.

It is missing some non-fundamental goodies, like a dedicated entry for passports (but there is an identity one, where you can store passport details), bank accounts and similar. Notes are an obvious workaround for them.
The worst thing I have found so far, but again it is not a real showstopper, is that it is not possible to attach files or images. I do it in 1Password for the passport, for example. I could use proton drive instead, but having images embedded in Proton Pass, sharing them just sharing the vault, would be nice.
I think I’ll give it a go, migrating everything from 1Password to Proton Pass and trying to use it for a while.

For whoever is interested, I’d like to share my impressions after almost a month of Proton Pass usage, coming from 1Password.

Migration
Migration has been pretty good, but not effortless. From the 1Password MacOS app, I’ve exported the data in 1PUX format. I have imported the file in Proton Pass and the big bulk of entries were there, including their respective vaults.
What I had was:

• 22 out of 461 items were not imported. Proton Pass listed all of them, so that I could fix them manually. They were categories not implemented (yet, I hope) in Proton Pass, like ID cards, bank accounts details, attachments…
• passkeys stored in 1Password have not been exported or imported. I don’t know where the missing step was, but I had to recreate them in Proton Pass, for the few web sites where I had them. They are not many now, but I see this a potential burden with wider adoption of this technology. I have not asked to the Proton Pass support nor community, to be honest, as I had only 3 or 4 to recreate, but I will ask.
• attachments are not supported. This is the most annoying thing, I would say. I have created a dedicated folder in my Proton Drive where I put all the files I had in 1Password (photo of passport, some pdf files, nothing big). These small files should be really attached to the items in Proton Pass. I would not mind if they had to use the space in my Proton Drive to store them, but it’s a missing feature, for me. Proton has a system where feature request can be posted and voted. This one is quite up in the list, I hope it will come at some point.

That’s it. Not a big work, but some manual steps to be done.

Usage
Flawless for logins, 2FA, passkeys, credit cards… no issues so far, on iPhone, iPad, macOS.
i had a shared vault in 1Password, migrated to Proton Pass and shared with a free account. It worked perfectly, with the limitations of a free account, but I had no problem with sharing either.
Sharing passkeys for items in the shared vault works perfectly as well.

When Proton Pass was released, I was concerned that accessing my Proton account only would have given access to everyone to all my passwords, 2FA and absolutely everything else. This is not the case anymore, as you can add a second password to unlock the vaults, which has the same function, to me, than the 1Password master password. If someone accesses your Proton account, they still need to overcome an additional encryption layer protected by a dedicated password. And you can force the Proton Pass app to enforce the biometric authentication, without falling back to the device lock code when it does not work. With 1Password it was the same, is some can guess my iPhone code, they still need to guess the master password to access the vaults.

Major issue, but still not a showstopper, I consider it major only because the other ones are really minor, is the lack of support for attachments.

Minor issues I have found are:

• Limited categories. No specific ones for WiFi password, bank accounts and similar. I have been able to add all the information in Proton Pass, using Notes or custom fields in login items. Custom fields can have any title and be in clear text or hidden like a password field, this gives you the flexibility to store everything, but it is not as handy as dedicated item types.
• As a consequence, missing small handy features like the QR code to share WiFi password with guests.

Conclusions
I have fully switched to Proton Pass. The full version was included in my existing Proton Unlimited account, so it was a no brainer. The additional password to unlock the vaults, different from the Proton account one, and the enforcement of biometric authentication to unlock the app gives me the peace of mind I was looking for,
For my wife, with whom I am sharing a vault in 1Password family plan, I have been evaluating the various options. A Free account would have worked for almost everything, considering what her usage of 1Password is, but I was afraid that some of the unavailable features would be required at some point. The 2 ($|€|gpb|chf)/month full account for Proton Pass only was my choice, until they came out with a new Proton Duo plan. With 4 $/month she could have the full set of features of a Proton account, so at the end I went for this.

For regular users who are not interested in all the other services, is 2 $/month, which I consider fair. I am not against subscription models, there are people working behind these tools and they receive a salary, as I do, so I don’t mind paying for a service, if it is worth. Proton Pass is open source (look for it on GitHub if you are curious), which is a big big plus for me. If you want full features, you pay for the infrastructure and the people developing the code and making sure it runs.

Still, the vault is not only local to your device, but it is stored on their cloud (not AWS, Azure ore whatever, Proton owns and operates the infrastructure, again a big plus for the paranoid side of me), so it does not fully address the concerns of people even more paranoid then me, but I consider this a little risk, if you trust the organisation of course. In this sense, the potential review of the open source code gives more peace of mind.

All in all, I would consider this a successful migration. Some saving at the end of the year, but this was not the only reason for me.

I hope this helps!

 

[svenmany]

I hope this helps!

It helps a ton. Thanks for that great write-up.

You mention that you prefer Proton's data center over Amazon's or Microsoft's. Do you have any information that leads you to think it's safer?

 

[Pag46]

It helps a ton. Thanks for that great write-up.

You mention that you prefer Proton's data center over Amazon's or Microsoft's. Do you have any information that leads you to think it's safer?

No no, nothing to be worried about data security with the cloud giants. It is more a general concern for monopolies.
On top of that, with a cloud provider the costs go up with the number of user, almost linearly. With your own hardware it is the opposite. This is why Proton dropped the price of some of their services, during its history.

 

[MacBH928]

For whoever is interested, I’d like to share my impressions after almost a month of Proton Pass usage, coming from 1Password.

Migration
Migration has been pretty good, but not effortless. From the 1Password MacOS app, I’ve exported the data in 1PUX format. I have imported the file in Proton Pass and the big bulk of entries were there, including their respective vaults.
What I had was:

• 22 out of 461 items were not imported. Proton Pass listed all of them, so that I could fix them manually. They were categories not implemented (yet, I hope) in Proton Pass, like ID cards, bank accounts details, attachments…
• passkeys stored in 1Password have not been exported or imported. I don’t know where the missing step was, but I had to recreate them in Proton Pass, for the few web sites where I had them. They are not many now, but I see this a potential burden with wider adoption of this technology. I have not asked to the Proton Pass support nor community, to be honest, as I had only 3 or 4 to recreate, but I will ask.
• attachments are not supported. This is the most annoying thing, I would say. I have created a dedicated folder in my Proton Drive where I put all the files I had in 1Password (photo of passport, some pdf files, nothing big). These small files should be really attached to the items in Proton Pass. I would not mind if they had to use the space in my Proton Drive to store them, but it’s a missing feature, for me. Proton has a system where feature request can be posted and voted. This one is quite up in the list, I hope it will come at some point.

That’s it. Not a big work, but some manual steps to be done.

Usage
Flawless for logins, 2FA, passkeys, credit cards… no issues so far, on iPhone, iPad, macOS.
i had a shared vault in 1Password, migrated to Proton Pass and shared with a free account. It worked perfectly, with the limitations of a free account, but I had no problem with sharing either.
Sharing passkeys for items in the shared vault works perfectly as well.

When Proton Pass was released, I was concerned that accessing my Proton account only would have given access to everyone to all my passwords, 2FA and absolutely everything else. This is not the case anymore, as you can add a second password to unlock the vaults, which has the same function, to me, than the 1Password master password. If someone accesses your Proton account, they still need to overcome an additional encryption layer protected by a dedicated password. And you can force the Proton Pass app to enforce the biometric authentication, without falling back to the device lock code when it does not work. With 1Password it was the same, is some can guess my iPhone code, they still need to guess the master password to access the vaults.

Major issue, but still not a showstopper, I consider it major only because the other ones are really minor, is the lack of support for attachments.

Minor issues I have found are:

• Limited categories. No specific ones for WiFi password, bank accounts and similar. I have been able to add all the information in Proton Pass, using Notes or custom fields in login items. Custom fields can have any title and be in clear text or hidden like a password field, this gives you the flexibility to store everything, but it is not as handy as dedicated item types.
• As a consequence, missing small handy features like the QR code to share WiFi password with guests.

Conclusions
I have fully switched to Proton Pass. The full version was included in my existing Proton Unlimited account, so it was a no brainer. The additional password to unlock the vaults, different from the Proton account one, and the enforcement of biometric authentication to unlock the app gives me the peace of mind I was looking for,
For my wife, with whom I am sharing a vault in 1Password family plan, I have been evaluating the various options. A Free account would have worked for almost everything, considering what her usage of 1Password is, but I was afraid that some of the unavailable features would be required at some point. The 2 ($|€|gpb|chf)/month full account for Proton Pass only was my choice, until they came out with a new Proton Duo plan. With 4 $/month she could have the full set of features of a Proton account, so at the end I went for this.

For regular users who are not interested in all the other services, is 2 $/month, which I consider fair. I am not against subscription models, there are people working behind these tools and they receive a salary, as I do, so I don’t mind paying for a service, if it is worth. Proton Pass is open source (look for it on GitHub if you are curious), which is a big big plus for me. If you want full features, you pay for the infrastructure and the people developing the code and making sure it runs.

Still, the vault is not only local to your device, but it is stored on their cloud (not AWS, Azure ore whatever, Proton owns and operates the infrastructure, again a big plus for the paranoid side of me), so it does not fully address the concerns of people even more paranoid then me, but I consider this a little risk, if you trust the organisation of course. In this sense, the potential review of the open source code gives more peace of mind.

All in all, I would consider this a successful migration. Some saving at the end of the year, but this was not the only reason for me.

I hope this helps!

-I checked it out and its a viable option. It has improved and I assume it will further improve in the future given proton past record with apps. one down side to me is there is no dedicated app on MacOS but not a big issue.

-They might have their infrastructure but I am 100% sure they backup to others.

-I don't understand how software security works, but given proton's massive current offering, any misstep would lead to infiltration of their systems and the user's data (privacy, which is the selling point of Proton) . If I was on Proton developers team I wouldn't be able to sleep in comfort knowing that someone might figure out a bug that leaks the user's data.

 

[Pag46]

-I checked it out and its a viable option. It has improved and I assume it will further improve in the future given proton past record with apps. one down side to me is there is no dedicated app on MacOS but not a big issue.

-They might have their infrastructure but I am 100% sure they backup to others.

-I don't understand how software security works, but given proton's massive current offering, any misstep would lead to infiltration of their systems and the user's data (privacy, which is the selling point of Proton) . If I was on Proton developers team I wouldn't be able to sleep in comfort knowing that someone might figure out a bug that leaks the user's data.

There is a native MacOS app, I use it. There are browser plugins as well.

About the infrastructure, I am don’t know why you are sure they back up to others. Proton advertise a lot the fact that they own and administrate the servers. You can be right, of course, but the independence is one of their selling points.

About the security, every software can have bugs, but a good architecture and algorithm choices can help reducing the risks a lot. This is why I prefer open source software in these cases, so that it can be reviewed by experts, which is not the case with closed source ones.

 

[svenmany]

This is why I prefer open source software in these cases, so that it can be reviewed by experts, which is not the case with closed source ones.

Do you know of any experts who have reviewed the Proton VPN code in the context of it being open source?

Closed-source applications would hire experts to perform security audits. That can also be the case of open-source applications. Both 1Password and BitWarden have published the results of security audits.

 

[Pag46]

Do you know of any experts who have reviewed the Proton VPN code in the context of it being open source?

Closed-source applications would hire experts to perform security audits. That can also be the case of open-source applications. Both 1Password and BitWarden have published the results of security audits.

I do not work for Proton nor have any interest in convincing people using its services. I am just curious about these topics (read, I’m a bit paranoid…) and wanted to share my experience.

As I did with 1Password, reading some of their white papers and trying to understand how their tool worked and why it was secure, I searched a bit and found that all the codes from Proton are audited by independent companies.

This is for Proton Pass:

Proton Pass is open source and audited for security | Proton

Proton Pass’s code has been made open source and passed an audit carried out by the security experts at Cure53.

proton.me

This is for all the Proton apps:

An Open Source Privacy Company | Proton

All our apps (Proton Mail, Proton Drive, etc) are open source and independently audited. Anyone can inspect our software and confirm our encryption works.

proton.me

 

[svenmany]

I do not work for Proton nor have any interest in convincing people using its services. I am just curious about these topics (read, I’m a bit paranoid…) and wanted to share my experience.

As I did with 1Password, reading some of their white papers and trying to understand how their tool worked and why it was secure, I searched a bit and found that all the codes from Proton are audited by independent companies.

This is for Proton Pass:

Proton Pass is open source and audited for security | Proton

Proton Pass’s code has been made open source and passed an audit carried out by the security experts at Cure53.

proton.me

This is for all the Proton apps:

An Open Source Privacy Company | Proton

All our apps (Proton Mail, Proton Drive, etc) are open source and independently audited. Anyone can inspect our software and confirm our encryption works.

proton.me

Nice. Proton seems to take their security audits seriously. I do wonder how much those audits cost. 1Password publishes their reports as well.

Security audits of 1Password | 1Password Support

1Password products have been reviewed by multiple independent security firms.

support.1password.com

I tried to look into Proton Pass on GitHub. I can't find any repository covering a desktop application. Also, I have a feeling the open source advantage is hypothetical. I don't see any reported issues in their few repositories, so I wonder if any people other than the developers are looking at the code (other than the paid auditors). I have to admit, I had some problems using GitHub this morning, so I could be missing something.

I would have confidence in using Proton software. I've considered subscribing to their full package. Currently I subscribe to their VPN and infrequently use the free version of their email.

 

[MacBH928]

There is a native MacOS app, I use it. There are browser plugins as well.

mea culpa , I couldn't find it the first time around.

About the infrastructure, I am don’t know why you are sure they back up to others. Proton advertise a lot the fact that they own and administrate the servers. You can be right, of course, but the independence is one of their selling points.

So how I understand cloud backing up works is there have servers around the globe. Proton is based in switzerland so thats where their main servers are but I doubt they have offices around the globe like in Malaysia and Brazil.

I think maybe what they mean is they rented a whole server in some other host provider and only they have access to it for administration but I doubt they are physically there or own the establishment.

Do you know of any experts who have reviewed the Proton VPN code in the context of it being open source?

Closed-source applications would hire experts to perform security audits. That can also be the case of open-source applications. Both 1Password and BitWarden have published the results of security audits.

If the app is open source, doesn't it make it easier for hackers to find the flaw in the code? Given there is no known attacks means no hacker was able to find any flaws?

so kind of the open source methodology audits itself?