I think that 1Password's Secret Key feature makes 1Password more secure than Bitwarden. Additionally, and this has been covered on this thread before, I don't think that just because something is FOSS makes it more secure than something that isn't.
FOSS doesn't make anything more secure automatically. But because anybody can check the code the probability that security flaws are found and closed very fast is much higher than with closed source software. Both sides have their pros and cons but all in all I would say the combination of FOSS and a high user base is more secure than closed software.
A study by security researchers at the University of Maryland found that open source software had fewer security vulnerabilities than closed software, with an average of 0.32 vulnerabilities per 1000 lines of code in open source software versus 0.45 vulnerabilities per 1000 lines of code in closed software.
Another study by security firm Coverity found that open source software had a lower defect density (bugs and security vulnerabilities) than closed software, with an average of 0.45 defects per 1000 lines of code in open source software versus 1 defect per 1000 lines of code in closed software.
A 1000 eyes see more than a 100 eyes.
Not my experience. Constantly using the main app for websites that don't play well with 1Password, verifying new passwords and logins have been saved, etc. Probably use the main program at least 10 times a day.
I guess then the problem is with 1Password, right? I open Apples Keychain maybe twice a week? Or less? And the rest of the time it works. I'm using Bitwarden on Windows and Linux. I haven't even installed the app because the browser plugin does everything. If pages don't play well with 1Password then you could blame web developers for their inconsistency but this is ridiculous because it is obvious that thousands of websites will make mistakes. I never stumbled upon a site Bitwarden could not handle but I had a ton of problems with 1Password not recognizing password fields correctly. I also tried strongbox for a while and except those strange three field logins it also handles everything flawless.
There's nuance to it. Companies like Lastpass that have been hacked multiple times that say "trust us, it's secure" vs Bitwarden that shows the code and results of security audits? No contest in that scenario.
I don't doubt that 1PW is secure. That's why I used it for years.
This. Yes, Bitwarden also saves stuff online but at least it is open source and you can check what the app does. The best thing, imho, still is a local vault but KeePass is too complicated.
They will also kill the 1PW extension for Firefox, despite Firefox continuing to support for Manifest V2.
*sigh*
I guess the time to switch has come.
And this is one of the reason why I don't like 1Password anymore. They literally promised everyone to keep local vaults possible. They told everyone that they will keep the possibility to BUY the app instead of subscription only.
They broke promise after promise, they lied to their customers, they made it extra hard to cancel subs, they hid the possibility to buy the old version... That are not trustable moves. And I guess a company I trust with all my secrets and finances should at least be honest.
And then how they handled the backlash because of this.
I sometimes wonder why there's a big fuss over much more insignificant things, like when Apple takes a little while to close a security hole. But when it comes to privacy and security, people are often so careless. Adguard installs a root certificate to decrypt https traffic to supposedly better block ads? That's ok. 1Password lies to customers and supporters? That's ok. Now they are discontinuing support for the browser addon of the version they just sold at full price. 1Password 8 is not even a year old. But probably the fanboys still find it legitimate.
