Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Been following this lightly. My 1Password subscription finally expired last week. I was sad to realize that while I had warned my partner, she (and I) had let it go and forgot to transfer her passwords out to KeePassXC like I had. Her response was not what I expected: She was furious that she couldn’t access her passwords - it had a screen asking her to pay that she couldn’t close. Now, the app refuses to open (could need a restart). Anyway… most of her passwords are in keychain so it’s not a complete loss.

I uninstalled 1Password many months ago when I moved to keychain and keepassxc. Still going strong with these. Most people I know just use the browser password manager (Chrome for example).

I just wish Apple made it easier to store secret questions with the password manager - also, getting the 2FA can be a pain sometimes if it isn’t automatic.
You can access your vault in 1Password when the sub is expired. You just can’t edit anything in the vault. All she should have to do is close that announcement window.
 
How is it with auto filing fields? Enpass is a little bit dumb when suggesting autofill . Can it autofill a webform ? Also do they have the cmd+\ autofill shortcut?

So I still have 1password installed on my Mac and when I try that keyboard combo, it defaults to trying to use 1password. So I think the answer to that question is probably no, but I am not sure. HOWEVER, Sticky Password has a field when you are setting up your passwords that ask what you want for an autofill account. It works super seemlessly. I don’t have to enter a keyboard command, the password info just automatically fills in with no intervention from me whatsoever. I love it.

The only password managers that let you store your vault in your own cloud and are multi-platform are EnPass and StickPassword.

Sticky Password does NOT let you store your vault in a cloud of your choice. Rather you either use THEIR cloud OR you can also sync your data locally using your wifi which is what I do.

My 1Password subscription finally expired last week. I was sad to realize that while I had warned my partner, she (and I) had let it go and forgot to transfer her passwords out to KeePassXC like I had. Her response was not what I expected: She was furious that she couldn’t access her passwords - it had a screen asking her to pay that she couldn’t close.

I don’t understand why she can’t close something. My 1password subscription is over, the app is “frozen”, yet I can still make use of the passwords in it. I just can’t add new ones or change anything.
 
Myki (discontinued by April 10 2022 [1])
Damn.....I really dodged a bullet. Before I decided to go with Sticky, I had been considering MYKI and probably would have went with them only to have them bail on me in April. My husband would have been so upset at me and I would have been pretty angry too. I hate when companies pull the rug out on people like that. Password managers are something that just need to keep working. You can’t expect people to constantly move their data around like nomads wandering the desert in search of a home.
 
  • Like
Reactions: maflynn
I don’t understand why she can’t close something. My 1password subscription is over, the app is “frozen”, yet I can still make use of the passwords in it. I just can’t add new ones or change anything.
My bad - I think the app crashed or something - it's not even opening anymore on the computer so we've got a unique experience. My bad for assuming it was locked. (I went over to the computer and double click the app - nothing happens, same for the safari extension). Will reinstall it later. Glad to hear that isn't normal behavior lol.
 
My bad - I think the app crashed or something - it's not even opening anymore on the computer so we've got a unique experience. My bad for assuming it was locked. (I went over to the computer and double click the app - nothing happens, same for the safari extension). Will reinstall it later. Glad to hear that isn't normal behavior lol.
Once the sub expires you cannot edit your passwords on your computer but the IOS version allows edits.
 
  • Like
Reactions: BigMcGuire
Damn.....I really dodged a bullet. Before I decided to go with Sticky, I had been considering MYKI and probably would have went with them only to have them bail on me in April. My husband would have been so upset at me and I would have been pretty angry too. I hate when companies pull the rug out on people like that. Password managers are something that just need to keep working. You can’t expect people to constantly move their data around like nomads wandering the desert in search of a home.

this is part of the danger with going with lesser known products and 1 man team apps. I like to stick with the flock so I know the app will continue to exist.
 
Have not been following this thread, so sorry if a duplicate.

mSecure is going subscription this week with their v6 update. $2/mo for Essentials tier, $3/mo additional for new features tier.

But "perpetual" (at least for now) license on sale right now for $20. Gets you Essentials without subscription.

So get in quick, before the switch is made.

 
  • Like
Reactions: MadeTheSwitch
Been following this lightly. My 1Password subscription finally expired last week. I was sad to realize that while I had warned my partner, she (and I) had let it go and forgot to transfer her passwords out to KeePassXC like I had. Her response was not what I expected: She was furious that she couldn’t access her passwords - it had a screen asking her to pay that she couldn’t close. Now, the app refuses to open (could need a restart). Anyway… most of her passwords are in keychain so it’s not a complete loss.

I uninstalled 1Password many months ago when I moved to keychain and keepassxc. Still going strong with these. Most people I know just use the browser password manager (Chrome for example).

I just wish Apple made it easier to store secret questions with the password manager - also, getting the 2FA can be a pain sometimes if it isn’t automatic.

I tried Keychain before switching to EnPass but it was so limited in comparison. I am super happy that I switched from 1Password to EnPass! I am not missing anything at all and it works very well, plus I no longer have to pay for a subscription. I even got a full refund of my last 1Password payment when I contacted them and told them why it was no longer convenient for me.
 
  • Like
Reactions: AleRod and MacBH928
I tried Keychain before switching to EnPass but it was so limited in comparison. I am super happy that I switched from 1Password to EnPass! I am not missing anything at all and it works very well, plus I no longer have to pay for a subscription. I even got a full refund of my last 1Password payment when I contacted them and told them why it was no longer convenient for me.
It is very limited. I use KeePassXC for my secret questions and other things that I need stored in a safe way. But it is free and that I like :D.

Nice to see 1Password refunding like that. I was a customer of theirs for a very long time and I look back on that with a smile not a frown.
 
Have not been following this thread, so sorry if a duplicate.

mSecure is going subscription this week with their v6 update. $2/mo for Essentials tier, $3/mo additional for new features tier.

But "perpetual" (at least for now) license on sale right now for $20. Gets you Essentials without subscription.

So get in quick, before the switch is made.


I really liked mSecure screenshots unfortunately the subscription system is immediate no for me, in addition to being properitary , add to that its obscure and the development does not seem consistent. They kind of have the right idea for a password manager but I can not rely on them.

Password managers are a bit like emails, once you get it you stick with it, you don't do password manager hoping.

I tried Keychain before switching to EnPass but it was so limited in comparison. I am super happy that I switched from 1Password to EnPass! I am not missing anything at all and it works very well, plus I no longer have to pay for a subscription. I even got a full refund of my last 1Password payment when I contacted them and told them why it was no longer convenient for me.


welcome aboard! I do not find it as nice as 1Password but its not subscription and gets the job done. I am hoping their user base grows and make money to make the product better in the future.
 
  • Like
Reactions: AleRod
I really liked mSecure screenshots unfortunately the subscription system is immediate no for me, in addition to being properitary , add to that its obscure and the development does not seem consistent. They kind of have the right idea for a password manager but I can not rely on them.

Password managers are a bit like emails, once you get it you stick with it, you don't do password manager hoping.




welcome aboard! I do not find it as nice as 1Password but its not subscription and gets the job done. I am hoping their user base grows and make money to make the product better in the future.
The design is a little different but it has the same features. I really don't miss anything. Actually the auto save seems to work even better for me
 
Does Enpass family plan over the one time plan have any advantage?

Should be similar features. Look their website: https://www.enpass.io/pricing/

Looks like their family plan has no lifetime license and must be subscription, so there is no advantage here over 1PW except that you can store the vault where ever you want and 1PW stores on their servers.
 
I am happily migrated to iCloud Passwords. I have setup this shortcut to launch the Passwords UI with cmd + \, much like 1Password does.
Thanks for the shortcut will be using this! Question, how are you using iCloud Keychain to save passwords for an app on your iPhone? For example if an app updates and I have to put my password back into it sometimes it cant find it.… unless I am doing something wrong…
 
Thanks for the shortcut will be using this! Question, how are you using iCloud Keychain to save passwords for an app on your iPhone? For example if an app updates and I have to put my password back into it sometimes it cant find it.… unless I am doing something wrong…
This happens automatically. There is no better integration than Keychain. It works flawless in any app.
 
I just learned that password managers do not encrypt passwords in their online storage, but stores them as hashes. Any one care to explain the difference?

my understanding is that both are stored as gibberish that can only be decrypted with a password
 
I just learned that password managers do not encrypt passwords in their online storage, but stores them as hashes. Any one care to explain the difference?

my understanding is that both are stored as gibberish that can only be decrypted with a password

close. Encryption is two-way, as you could have a way to encrypt whatever you want encrypted, as well as decrypted. For example, I could create a public and private key with PGP or GnuPG, and give you my public key. I could then take this exact post, encrypt it with my private key (there's one-way), and send it to you. You could then use my public key and decrypt it back into a readable format to read (two-way).

With Hashing, this post would be scrambled and put into a unique digest. Then with an encryption salt (RSA, IDEA, Blowfish, Twofish, SHA256, SHA512, etc.), be encrypted, not to be decrypted again. It is this method that makes it so that the SaaS providers can not know what those passwords are.

Now while that is a bonus for SaaS providers, there still are the other mitigating reasons one may not choose them over personal storage.

BL.
 
close. Encryption is two-way, as you could have a way to encrypt whatever you want encrypted, as well as decrypted. For example, I could create a public and private key with PGP or GnuPG, and give you my public key. I could then take this exact post, encrypt it with my private key (there's one-way), and send it to you. You could then use my public key and decrypt it back into a readable format to read (two-way).

With Hashing, this post would be scrambled and put into a unique digest. Then with an encryption salt (RSA, IDEA, Blowfish, Twofish, SHA256, SHA512, etc.), be encrypted, not to be decrypted again. It is this method that makes it so that the SaaS providers can not know what those passwords are.

Now while that is a bonus for SaaS providers, there still are the other mitigating reasons one may not choose them over personal storage.

BL.

doesn't this makes them safe for cloud storage?
 
doesn't this makes them safe for cloud storage?

It does, from a technical aspect, yes.

Where SaaS providers have a problem is with the legal aspect. Here's a good example, and I'll apply it to here in the US (check local laws/regulations for similar laws in your home country).

True, hashes mean that the SaaS provider can't even read or decrypt those hashes to reveal your passwords. That is a good thing. But let's again ask the question: Does the password - let alone the password hash - at the SaaS provider belong to you, or to the SaaS provider? According to the Facebook rule*, it belongs to the SaaS provider.

*Facebook went to court over the question of if Facebook owns any data that a user has and uploads to their platform. The courts agreed, so currently the law states that the person/business/entity who is in physical possession of that data is the owner of that data.

So as it has been judged that the SaaS provider owns the passwords and password hashes that are in their physical possession, they can do whatever they please with those passwords and hashes. Legally, they could delete them, sell them, whatever they want with them, as they are the owners of it. Granted, they have entered a legal contract with the customer that binds them to what they can do with that data, but the situation exists. However, when that contract is terminated, the SaaS provider is still in legal ownership of that data, to do with it whatever they please. So while they may not be able to decrypt that hash, they would still have some entry (read: metadata) into where that password may be applied; so who says they couldn't try to use that username and password at the site in question, to gain access to whatever is there, after the contract with the user has ended? Again, those issues still abound.

Now, take ownership of that data, and apply it to any investigation of the user. In the US, our 4th Amendment to our Constitution protects us from any illegal searches and seizures, by making sure that the government requires a warrant to get hold of our possessions. Well, as proven above, we don't own the passwords we store at a SaaS provider; the provider does. As they would be 3rd party to that investigation, a warrant to get your data from that provider would NOT be required, circumventing that user's 4th Amendment rights. It can simply be handed over with a subpoena. Making it worse, a subpoena does not have to be asked for by the police; any Clerk of the Court could write up their own subpoena, and ask a judge to sign off on it. The problem with that: every lawyer is a Clerk of the Court.

So let's apply this to a decent hypothetical example. a person who lives in the US named Fred is being investigated by the police for fraud. Fred uses Dashlane for his online provider to store his passwords. Through a subpoena (banks are a 3rd party), they get access to his bank account, and discover high figure transactions from the place reporting fraud activity leaving his account and going to another account that is online only, as well as a monthly transaction for Dashlane.

The Authorities subpoena Dashlane for his vault, and get it (again, 3rd party). The authorities then either on their own, or asking Fred for his password to his vault, obtain that password, get access to the vault, find the bank account that is the destination of those high figure transactions, and see that it is in the same amounts that were claimed from the original fraud complaint, tying Fred to the entire crime.

Yes, Fred then waived his 5th Amendment right when he provided them with the password, but you can see where having your passwords stored at a SaaS provider can cause a person to not be protected by all of their rights granted to them by law. Sacrificing those rights for the sake of convenience is the question that needs to be asked, and if it is worth it. People can say "well, I have nothing to hide!", but that is a poor excuse because if that situation exists for one person, it would exist for every person, regardless of if they have anything to hide or not.

BL.
 
  • Like
Reactions: johnkree
I just learned that password managers do not encrypt passwords in their online storage, but stores them as hashes. Any one care to explain the difference?

my understanding is that both are stored as gibberish that can only be decrypted with a password
Strongbox has very good security practice.

 
I’ve been using Strongbox but it’s pretty rough for storing bites/credit cards. Every field seems to require a username which is pointless. What am I missing?
 
I’ve been using Strongbox but it’s pretty rough for storing bites/credit cards. Every field seems to require a username which is pointless. What am I missing?
In the default new entry template, just leave the username field blank, populate whatever else you want, add custom fields, TOTP, attachments etc. Choose done to save the new entry. The unused username field is deleted upon save. Same for any unused field if you leave it blank.
 
  • Like
Reactions: sppunk
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.