For that kind of money you can build (apparently) 10-20 of them.

What does a company like 1Password do with that much money?

I've used 1Password for years.

It would be nice to say goodbye to Electron, though...

What do they all do?

I love 1Password and use it for business and for personal. I recommend it to family and have migrated many people to a more secure setup as happy paying customers. Shared vaults for families are so important for emergencies.

It’s expensive though.

It doesn’t provide a quick way to share a URL with a client that isn’t a PITA.

The interface could be prettier and make more sense. Like why is the “new” button almost a secret location and barely visible.

Enabling two-factor with it is the absolute BEST but was buggy setting up. No simple iOS integration either.

There hasn’t been any super “major” updates in like 2 years to functionality (despite what blog boasts)

List goes on but it’s the best for now.

I can’t justify paying more. So hopefully there huge funding plan isn’t to squeeze little folk and is more for big business.

If Apple just went a little bit further with its manager (or even Google) I’d probably jump ship.

What is it that they plan to add that needs 620 mil ?

Wish I could be happy for them but instead I’m worried that I’ll lose what I have.

This is a 50-50 proposition, at best.

I hope this doesn't mean I'll need to start looking or a new password manager.

I'm very bullish on 1Password. They are the only product that I can use across my entire family and workplace with such little hand holding.

While they've pretty much solved the consumer front, there is much to be done to solve the needs of businesses. For example, right now if an employee leaves, we have to rotate everything they had access to. Their SSO support and API are pretty new, but historically managing vaults and users has been a pain. They're making steady progress.

I'm excited to see what comes next.

- Some items did not import correctly at all because the 1password export format did not quote values (CSV). This means that if I have a password with a comma in it, I get two broken entries. This is more of a 1password issue though.

- 2FA tokens did not import and would have to be manually reset. I guess this is to be expected though.

- Some fields had different names than bitwarden was expecting, so values were imported into the wrong destination and had to be manually corrected.

This was a while back so I'm not sure if anything has been improved.

https://support.apple.com/en-gb/HT210425

For a password manager? Damn.

The founders are clearly willing to bet their company on their expansion plans. In the post they allude to expanding to the security space more generally. Curious to see this develop in the coming years.

But I can't for the life of me understand why KeePass isn't the defacto gold standard.

It's secure, open source and you have control over the data. I would never for the life of me think of storing my important passwords with a company ever. Am I over reacting?

Well, at least not for a few years.

https://taoofmac.com/space/apps/1password

(I am now using Secrets while trying out iOS-friendly KeePass implementations)

I wish it just worked so that anytime I needed to fill a password, I just scan my finger and get right in. Why can’t it be that simple?!!!!!!!

Password manager is still hard to use for the elderlies and technically non savvy people.

And what's the "unique selling point" that stops me switching from one to another?

Hopefully they don’t go all cryptocoin and NFT with the funding… but given their dna, I think they will expand wisely.

I can't find Secrets Automation pricing info. Is it just, every developer needs a paid 1password account and that's it, or what?

*edit* oh wait I just found it, the answer to pricing is "Contact Sales". Booooo.

Why such a large round? Why not go for an IPO?

Not sure what... eg. perhaps some server-facing & app-facing API that would log customers in more touchlessly in a bid to become the SSO nexus of the world.

Seems like each of them reached their valuation going above and beyond just a "store your password securely" product.

Ah fuck. They now need to grow at any cost to earn all that money back. And they'll throw their users under the bus, if they have to, because it's either grow like a unicorn or go bust.

Also, I sincerely have no clue how a password manager could be so expensive. Last time I checked, the excellent KeePassXC was still free open source and developed by volunteers in their free time. How come 1Password needs the equivalent of 7750 years of $80k annual salary to build the same?

This is once again just a case of investors hoping to make a pile of money so big they can corner a market. Sadly, they have no idea how cornering a market works (or doesn't work) in the case of digital products like this.

They already through their consumer users under the bus when they switched to a subscription business.

I haven’t upgraded since v6, and I plan to avoid it as long as I can.

You cannot really throw users under the bus in highly competitive and lucrative space.

It's not that difficult to export full data from 1password and move on.

Agreed, an outbreak of featuritis is almost guaranteed. The core product works well for the job intended, but I don't want to be bothered with an expanding scope and the inevitable spam promoting the features that I don't really need.

Fine by me, 1password was too expensive to begin with. Sad to see they're wasting it.

But that is nature of the beast.

Can't you say the same about Linux vs Windows, Gimp vs Photoshop, PostgreSQL vs Oracle, Godot vs Unity, etc?

Dude, that ship sailed at their last (and first) raise. It took a little while for the shoe to drop, which was about 6 months ago.

1password is just more usable for most people.

1) whenever VCs invest in shares of a project

2) they tend to subsidize money-losing unit economics to “reduce friction” resulting in attempts to lock-in people and monetize their attention later

3) when the VCs later dump it on the public, the company has to now answer to wall street shareholders and its executives are heavily pressured to have quarterly earnings calls

4) they must find ways to extract rents forever because whoever bought at the top (the majority) wants to see their shares go higher, even at the expense of the public interest

5) whereas cryptocurrency could be about collective ownership, if there is no separate shareholder class then the network participants ARE collectively owning the means of production (basically, textbook socialism)

Whenever something like this is stated, anarcho-capitalists and right wing libertarians say:

Oh, there is NOTHING wrong with capitalism. That’s not REAL capitalism. That is corporatism / cronyism. (Some go further and quote Mises/Say/Praxeology: “only individuals can act, organizations can’t act.”)

Then about collective ownership of the means of production / distribution / the network they say… “That’s not REAL SOCIALISM. Socialism is when you use central government and planning and has led to so much misery and famine…”

So, a mainstream application of capitalism isn’t “real” capitalism because laissez faire capitalism doesn’t require the State. But credit unions, housing cooperatives, democratically run universities and now cryptocurrency DAOs are not “real” socialism because socialism requires the State?

There is a huge double-standard here, and I would encourage ancaps to answer the following questions:

  Why not use mainstream dictionaries and
  encyclopedias for definitions?

  Why not admit libertarian socialism exists

  Why not compare the results of democracy
  vs top down ownership in organizations
  on both the participants and the public good

You can have cryptocurrency run top-down where people work on stuff to survive, and the parent company must make profits. Or you can remove the profit motive and have wikipedia, open source, science, etc. But then you’d need to subsidize people’s maslow’s needs with a UBI.

See for example how your very news and media is affected by the profit motive… compare something like WikiNews vs CNN and Fox. Where are the movements to do something about it? Here is one example I am working on myself: https://rational.app

Using a 1password family plan is the only way I've been able to wrangle my parents across their slew of iOS, macs, Android, Windows, and Linux machines to stop typing in passwords.

1password lets you share passwords with other people, even if they don't have a 1password account.

No built-in browser password manager will handle that.

I’m sure a family with multiple users and half a dozen devices will run into issues as well.

I don't have any special insight into 1Password's strategy. But I run a company that is essentially bootstrapped and what I described is exactly how we think of cash reserves. In the bootstrapped case, there's a basic math problem that to maintain a constant runway while growing rapidly you must be cash flow positive by an increasing percentage as time goes on. Perhaps 1Password is just looking to protect a long runway that will get them to IPO.

Imagine if the chinese government could buy all its stock through a third party company, and sit on the board, install a "party affine" CEO without morals, etc.

Just a single silent software update can upload everyone's master key un-encrypted to the cloud, and decrypt everyone's passwords, attach them to email and corporate ids, etc. without anybody noticing.

How valuable does that make 1Password?

I get that there's an untapped market of non-technical users, but I am rather skeptical that advertising alone will have much success in activating it -- they'd need some innovative approach that changes the way non-technicals approach password management.

It's the same reason there should be no such thing as a "structural integrity" company separate from the building contractor.

Then you have leadership, sales, marketing, HR, finance, support, and retention. By a huge margin sales, support, and retention were the largest. B2C is marketing heavy, B2B is sales heavy. If you're both then well..

Engineering can be really lean with respect to the number of customers/clients but the rest of the business can't.

To use a real world example: DisneyWorld is a city owned by a corporation, instead of democratically run. Because the people who own DisneyWorld shares (shareholder class) aren’t the visitors — the visitors buy DisneyDollars. They are the consumer class.

And there is also the working class (people who work in DisneyWorld) and their employers (small capitalists) who run a business inside DisneyWorld and pay rent.

Disneyworld and other cities could have its own smart economy with DisneyDollars and never have to raise money from speculators. Think of DisneyDollars as utility tokens and shares as security tokens for speculators.

Here is how it works in detail: https://intercoin.org/communities.pdf

https://keepassxc.org/

But of course they can’t do that because VC, right?

[0]: https://support.1password.com/cs/1password-classic-extension...

That being said I hate that 1Password needs that. It’s just a password manager at the end of the day.

But to some extent it took her compromised passwords to finally start using everything.

The same could be said about any password manager though

There are things available via the Cloud version that aren't available with local vaults and, in order to maintain those, they decided not to put the time into implementing those changes for local vaults. Local vault users are less than 1% of their user base.

So I can't habe autofill, automatic saving of new/changed passwords and password creation and also use the same vault for the mobile app (Android). The mobile app can access the self hosted vault without any issue.

I would love to fully migrate to self hosted bitwarden, but the browser extension irks me. Maybe it is possible and I am just too dumb to find the solution.

However, after reading your comment, I hope this is the direction they go. I actually really like the future where I can have instant accounts attached to a more anonymous backend than my social media. I'm sick of things as mundane as my local gym asking for access to my fucking friends list.

Sign-up hurdles are a real thing too. I recently read that it was a major factor to Microsoft's video gaming stream service never taking off.

So a 1- or 0-click login once you hit the login form, as opposed to the current 3-click system (see login list, click to fill, click to submit). And looks like it also might handle the 2fa portion (which essentially makes it 1fa).

[1]: https://developer.mozilla.org/en-US/docs/Web/API/PasswordCre...

I honestly can’t, do you mind sharing a few examples to prove your point?

I have a long list of “stopped using because went to shit after VC was injected”

1. WhatsApp and Facebook relation

2. Twitter and the loss of control over my feed

3. Spotify and the podcasts shenanigans

4. Dropbox and their assholery against free users

5. Evernote and their assholery against free user, increasingly useless redesigns and lack of improvement on the basics

Etc.

The value one gains from a personal security product (data portability, availability, accessibility) is often at odds with the interests of capital, which lean towards moat construction and rent-seeking. Over time, in a for-profit company, capital will always "win". Trading equity for other peoples' cash investments only accelerates the process.

For an adjacent example, LastPass never took a dime of VC money (afaict), but their structure as a for-profit company pushed them to lock down their product and charge rents, where they had not previously. If they had taken VC money or went public instead, it may have delayed the inevitable, but it only would have been a delay, not a solution.

People in this thread are disappointed, because these companies began their lives with a compelling, free, and user-empowering invitation, and it is sad (although not at all unpredictable) to see those features taken away by the incentives of capital. I think it's understandable, and I wouldn't read it as an indictment of VC writ large.

I would think most people view YC more in line with the Angel round, which is an entirely different view point; Angel's are actual helpful people who did something on their own to achieve success (not poser VCs) and/or are mentors and coaches who want to give back, but it's unfortunate that people need to go beyond angel to VC, and the expectation from the angels is that you must or they won't make their money.

Just because we are on a YC forum doesn't mean we have to suck the industry's dick.

But rarely improved the product. At best you have a company that does keep it's soul, and continues to improve the product as they would have on their own. Far more often, the product and pricing structure is made worse in the long run through VC investment. It's not necessarily VC interference that is solely to blame, the change in size and scope that tends to come with such investment is a massive hurdle on its own.

Of course, taking VC capital is almost certainly necessary to continue to exist, given you are competing against others who will take that capital and quickly use it to out compete you if you do not. I just view this as unfortunate, when I find companies that grow at a more natural speed to generally create better products.

Well, I dunno, you always are depending on the "good will" of leadership. They could decide to squeeze every cent and provide as little value as possible at any time, whether they have venture funding or not. If your alternative is a "non profit", look at Mozilla, plenty of people unhappy with a lot of their decisions and users feeling "betrayed". I don't think we can expect most services to run as non-profits regardless. It's an imperfect system, but is the best we've got so far.

> From a consumer's point of view, once an organization gets in the mindset of optimizing for value capture over value creation and openness, it's time to consider moving on.

I'd argue this comes after the IPO. When you have millions in venture capital, is easy to keep running the business at a loss and keep growing. When it's time to make a profit is when things start getting hard.

I suppose this is what some people don't like. They'd like founders/businesses that stay small and focused on a niche, make money but not too much and keep a good value product running. Without looking at 1Password finances though, even when it was a paid service, we don't know how profitable it was, if at all, and may be going after enterprise customers with this new funding is the only way to not only 'break even' and start making some good profits.

Top left here: https://imgur.com/xCgrot0

If you click on that, the "Server URL" field is where you want to put your private instance: https://imgur.com/Gua3jSb

- Mobile UI is beautiful on 1Password.

- The UX from creating a password entry to auto-filling is easily better on 1Password. Bitwarden doesn't show autofill entries on login forms yet. That's a deal breaker, at least for me.

- Account recovery via a trusted family member.

- Additional security measure: private key in addition to master password.

Personally, the 35 USD fee is justified.

$620M isn’t for a password manager, it’s financing for a business with an enormous and growing user base.

[1] https://community.bitwarden.com/t/account-switching-log-in-w...

[2] https://community.bitwarden.com/t/bitwarden-roadmap/12865

https://fred.stlouisfed.org/series/M1SL

Most users don't want to tweak anything related to their phones, tablets, computers, watches. If everything your app does, isn't reachable within 1-3 clicks/swipes/presses, then forget it.

Someone suggested using two versions KeePass files...one for shared passwords, one for not shared passwords. This is NOT a substitute for clicking Share Password and literally not doing anything else.

Someone suggested storing all your passwords in the browser. This is NOT a substitute for having all of your passwords available at the app level on your iPhone. This is NOT a substitute for sharing passwords with your whole family.

UI/UX is EVERYTHING

Bitwarden is not an alternative to 1Password that passes the wife/parent/elder test because the UX is so bad they need to call me everytime something isnt exactly working as before.

Huh, to me it's both. The UI/UX wouldn't be worth shit if their software ate battery like it was free, crashed often, was frequently janky, hogged resources to the point of being a problem, or all the fancy features underlying their UX didn't work pretty damn well without user fixing or intervention. Software quality is part of why their UX is so good, not just design languages or whatever. You don't get their level of auto-magic if you haven't done a whole bunch of things very right in the underlying code & architecture.

They're far from perfect (practically all consumer-facing software is at least kinda bad, IMO) and one can point to a handful of duds that they just can't seem to get right (Xcode, for instance) but I'd put software quality as my number one reason for using them, and I'd point to that as an absolutely vital element in their UX being well above average. It's that combo that no-one else seems able to touch—in fact, it often seems like no-one else is even trying, and I really wish they would.

Or perhaps nerds do grasp the negative value of anti-patterns in UI/UX, and reject attempts to create interfaces and usage models that remove control from the user, create vendor lock-in, or compromise privacy and security.

This is quite true, but the counterpoint is that nerds enjoy spending that time. We like opening the box, poking at the wires, seeing how the cogs fit together, and tweaking things endlessly. It would be a liability for a normie, but for a nerd whose interest is piqued it's a fun Saturday project. This is why FOSS survives despite the UI/UX problems.

Edit: agree with the rest

Plus like the parent said, proprietary code is a deal break for lots of people.

It's a bit like climate change. Scientists will warn, people will ignore, and then we will abandon Miami and will probably blame the scientists.

Well said - and this is the important part of the 'non-proprietary' argument of mine (above) - right now I consider 1Password's real customers being their shareholders/investors, not its users - the users are just another tool they use to bring value to their real customers (investors,etc.).

BitWarden's customers are their actual users.

For the record, I'm not. The overall discussion was that charging for a product was somehow bad. Bitwarden does charge for their product, just at higher tier levels. My bigger point is that you do want a provider that is going to stay solvent so charging money (which Bitwarden also does) is not some perverse way of satisfying customers.

Yubikey and its likes are advanced features that the overwhelming majority of regular users will never need.

This is separate from having TOTP 2FA on the Bitwarden account itself, which is available on the free plan.[4]

[1] https://bitwarden.com/help/authenticator-keys/

[2] https://bitwarden.com/pricing/

[3] https://github.com/dani-garcia/vaultwarden

[4] https://bitwarden.com/help/setup-two-step-login/

IMHO it isn't intrinsically impossible to serve both enterprise and single customers, but the business people will always be internally grumbling about the slight additional expense that doesn't have a good ROI vs improving their enterprise product, and the marketing team will want every other screen to be an ad to upgrade to enterprise which discriminating users will rapidly get tired of. It'd take strong and even a bit quirky executive leadership to overcome those issues. Not impossibly strong, but strong.

Edit: Also, they don't have the option of slathering their app with generalized ads. Running ads in the context of a password manager would be insane and lose all their thought-leader users in a heartbeat, permanently. So that door is not open to them.

To me; that’s immensely valuable, but it’s solved for most by a combination of just using the same passwords or, on iPhones, iCloud Keychain.

Now some folks have dumped the better half of a billion into a tool I pay about $35/year for and is basically feature complete. They’ll want a return on their investment. How do you expect 1Password will give it to them?

Going public has very tangible costs, but also massive intangible costs. Private markets are extremely frothy and keep ownership and control within an aligned group of investors. This can make all the difference in the world to management.

After that, I would teach KeePassXC to serve the 1Password browser extension websocket protocol, because I found its UX far, far, far, far superior to KeePassXC's browser extension UX

I have fond memories of 1Password and wish them luck. But I have felt forced by them to move to a subscription model and I cannot justify that.

I say this as a 1Password subscriber and user of its products going back all the way to 1Password 3.

I think a lot of it is the separate "vaults" concept can be easy to fuck up. I've had multiple instances where users have accidentally saved individual credentials in a shared vault because they didn't realize they weren't saving to their private vault.

Perhaps it's just the enterprise use cases that can confuse people, I'm guessing if you're just using it as 1 person with a single private vault there are fewer issues.

https://en.m.wikipedia.org/wiki/LastPass

2011 2015 2016 2017 2019 2021

Those are just the famous ones. After 2014, their plugins and UX were so bad, I switched my team(s) to 1Password and never looked back.

The brand damage has been done regardless.

Nitpicking but 1P is a Canadian company :) . I guess the pattern is almost universal?

This may have overlapped with when Guido was working there, though they may have built those clients before he joined, of course.

On another note, I've been using 1Password for years, for free. The mobile app can edit local vaults without signing in, and the desktop program can view local vaults in read-only mode. If I want to edit or add a password, I do it on my phone—it's not worth $150+ to be able to do it on my PC a few times a year.

Someone in this thread suggested Strongbox which looks very promising. I will stick with 1Password until they've decommissioned 7, and then make my decision whether to stay or not I think.

Strongbox is the most polished but doesn't offer browser integration.

KeePassXC has a terrible UI, and MacPass doesn't remember your key file between sessions. Both require staying in your Dock and need the janky KeePassHTTP-Connector to work with a browser.

That's not what I'd call a "solution"

For example, using MacPass I can access my KeePass DB managed by Strongbox from iCloud Drive but the OTP field seems to be opaque to MacPass, it does not know what to do with it.

I'm in agreement with parent, I think putting your passwords in the cloud is a wild single point of failure. Even if you can tell a compelling story about how they carefully encrypt everything right now, you're always a silent update away from it all being dumped on the internet.

I think people (in aggregate) just don't care about the risk and will take the path of least resistance. They don't have to draw the line there, but they will.

> My password manager being compromised would indeed be a huge time suck, but I don't think the long-term consequences would be any more severe than a few key individual accounts that are probably even more vulnerable.

Having your main email account compromised seems like an absolute nightmare where you potentially lose control of every single service that you subscribe to (banking, utilities, cell phone (so maybe 2fa is even broken), medical portals, social media, etc).

Having your entire set of passwords compromised is like that on steroids. Rather than your attacker having to use your email to get to each of those services one at a time, they just have them immediately. And who says you'll even know that your stuff was compromised?

I'm a bit of a crank though. I don't do any of the smart home stuff. I see my phone as a necessary evil. If some company shoehorned an app or a WiFi connection into their product, I don't buy it. After being in tech long enough, I just want things that work for me, not for the company I bought them from.

Money for service is fine, but this is a long term thing, and I'm not going to pay $180 per 5 years to keep 100KB in sync. And the software doesn't justify that price either.

I thought this is a common pattern for assessing user interest. If you don't display it users don't know it is available.

Very common in A/B testing to show different variations of CTAs as well.

How much did they quote? (if you're able to share)

Sure, they could mess it up, but any company or open source project can mess everything up.

So they go where there's real money to be made. They are well-positioned to become the default choice to handle corporate day-to-day cyber-security needs of most non-tech businesses, and if they can pull it off even moderately successfully it will make them the biggest Canadian IT company. Family accounts never ever will.

That doesn't mean their product won't remain the best* choice for individuals and families. Microsoft also doesn't give a damn about family or single users of Office, yet we all* use it because it's still the best* product on the market.

* words like 'all' and 'best' are approximations of what's going on in the real world, not in HN where significant numbers of people may very well be using LibreOffice and the Nth fork of Keepass.

How do you have a universal login that doesn't require corporate onboarding? You're just not the person this landing page is positioned for. They need corporate buy-in so you the user can login with one login across all of those sites. If you the single user want to easily login to Netflix and Amazon with a click of the button, then how do you expect 1P or any org for that matter to offer that if they don't have a direct relationship with Netflix or Amazon?

This is like using Google.com to search for things to find and screaming "Google is too corporate" when you landed on the Google AdWords landing page (ads.google.com).

With 100k individual users and its background as a consumer application, 1Password wouldn't neglect the non-corporate customers—at least until David Teare retires or otherwise leaves.

I remember noticing the announcement of subscriptions (possibly a couple weeks after it happened), being concerned it'd spell the end for dropbox sync so I checked it out ASAP, and then discovering my fears were mostly justified - it still existed (and remained around for a couple years), but it was shoved waaaay off into a corner. E.g. in the next subscription-oriented version of the apps, unless you attached a synced file FIRST, the option for dropbox syncing or standalone licenses was never available. The official instructions for fixing this were to reinstall the app from scratch and attach to the file first, before signing in.

Notice that only a few months later, the standalone license mention at the bottom of the page isn't even there any more: https://web.archive.org/web/20170215115945/https://1password...

Super hostile behavior, right out the gate. It was clear they were going all-in on subscriptions.

Previously it was one license per user per platform. I’ve bought 1Password at least 3 times and pointed them to the same vault. Can’t remember if they had paid upgrades.

If you are not inclined to host your own server, it really doesn’t seem clear to me to migrate away. Only the single and 2 user free licence and the single premium license for bitwarden is a clear winner. For families it’s not much cheaper.

I’m not even opposed to paying. I’ve bought 1P a few times. And I’d pay for another service. I think it’s the fact that they are forcing the choice that gives me a bag taste in my mouth. But this is irrational if my 2nd choice is to pay bitwarden a similar amount of money for a family subscription.

> Does that mean I should add another one that I can easily avoid?

All other things being equal? Avoid it, of course. I firmly oppose letting perfect be the enemy of good in the sense that more secure is better than less secure even if it's not perfectly secure. But I also oppose it in the sense that rejecting beneficial functionality because it's not perfectly secure, especially when it's not close to the biggest or most attractive attack surface, doesn't make sense. Even when password managers' servers were compromised— LastPass, for example— I don't think anybody ever got ahold of passwords. KeePass OTOH was broken with KeeFarce and RATs are a lot more common than cloud service server breaches.

> This seems focused on the case of a dedicated attacker focused on you specifically. Id think each of us is more likely to be affected by various automated attacks that are backed by large dumps of account credentials.

Nope— If it was automated the distinction is even less significant. A script would only need to search your email for whatever specific types of logins it supported and fire off password resets. Non-email 2FA becomes even more of a hurdle without the option of social engineering it or some other human-touch fix.

Consider this. (very) Roughly, this is the market penetration for these products:

* computer: 90%+

* smart phone: 85%

* tablet: 50%

* computer, smart phone and tablet: 40%

Most people (in this country, at least,) have multiple devices. Most people have internet access. Most people aren't going to be able to manage storing and sharing passwords among their devices at all, let alone more securely than cloud storage would do it. So for most people's use cases, it would be like citing health when refusing to put a teaspoon of sugar into the cup of tea they're having with cake and ice cream.

So like I said, avoid it if it doesn't improve your life— I have no stake in your password management choice— but I will actively butt in to qualify the sentiments expressed in this thread because, a) many users, even on this site, aren't sophisticated enough to engage in the sort of cost/benefit analysis that we are, and b) to them, this conversation is unintentional FUD. Cloud-based password management is vastly superior to regular folks' existing methods. If they're put off by technically savvy people saying they're fundamentally insecure, that is the embodiment of perfect defeating good.

Look at the lengths Microsoft goes to in order to maintain backwards compatibility for their enterprise customers, Apple in comparison just doesn't care.

Obviously I don't have access to the sales figures but my guess is most Mac Pros are going into audio/visual studios or else high net worth individuals. It's not the sort of thing enterprises will buy if they can avoid it.

Cool, I'm planning to use it for a lifetime. The point is that you didn't just use the monthly number because it's extremely low as far as paid software subscriptions go...

-

And I don't do this:

> Decisions like this shouldn't be taken in complete isolation and rounded to zero.

So I don't end up worrying about:

> For this single app. It's easy to justify $3 at a time, but suddenly you're paying a whole cable bill for marginal value.

-

> I don't want the service, just sell me the program.

First off you literally just said:

> Money for service is fine, but this is a long term thing, and I'm not going to pay $180 per 5 years to keep 100KB in sync.

So clearly you want the service but feel it's too expensive...

But secondly, software doesn't exist in a time bubble! Security updates, maintenance and support all exist and these are people trying to make a living while handling all that.

It's super cool that you want to get their hard work in the most personally beneficial way, but they have this very reasonably priced service that lets the people have the software, and them have their livelihood.

You can say "oh well I don't care about maintenance, I'll buy the new version if it's compatible with my OS", which again is super convenient for you... but once they hit plateaus in new users are they just supposed to pause development until old versions break?

If the utility of the program was so low you wouldn't be asking them for it without the service after all... if it's "just storing 100kb of text" there's plenty of other options out there.

10 cents a day for something that saves a lot of stress is a great price.

This sounds so much pithier than it actually is, but of course every reply will say it.

Does 1Password asking for 3 dollars make every other app on your computer suddenly need 3 dollars a month?

Every piece of software needs its own plan for continued development.

Some software you use exists because people work on it for free, some exists because massive ad-tech companies defiling the globe's privacy fund it, etc.

-

Paid subscriptions is one of those types, and as far as paid subscriptions go 3 dollars a month is bottom of the barrel.

Like if every paid subscription you had was 3 dollars how would your bills look?

Many MANY companies have tried one time payments and died over it. People are allergic to upfront payment. People just might not have the funds to pay a fair price all at once. A tech forum isn't exactly where to get perspective on that for example...

1Password clearly tried the one time payment model, and if I had to imagine for a second, I bet you one-time payment users ended up being some of their most expensive users since they had to manage disparate sync schemes.

Now at least subscription users can subsides that cost a bit...

Can I interest you in a cloud license for ls? It’s clearly critical you your day to day work, surely $5 per month it reasonable for a too, you use so frequently???

(Im a long time 1pw user and vocal supporter. I’m now wondering how they are going to generate the expected return in this investment, because I can’t see any realistic avenues for that which aren’t likely to fuck me and everybody I’ve recommended 1pw to in the last decade or so over…)

> Can you ever actually prove a negative?

Does that mean that you agree that we can't know the extent to which things have been exposed? Cause that's part of my point. Of course you can flip that around and say well you can't prove that nobody compromised your local machine, but one of those things is open to attack from many orders of magnitude more attackers by virtue of being on the open internet and in a physical space that you don't control.

> You're propping up a straw man using a hyperbole.

You're cooking up a tasty word salad there, chef. Can you give me a little more meat here? I don't quite follow. Have you never heard people say that you shouldn't write an email or send a picture that you wouldn't want to see in the newspaper? Its a similar concept. Once you send something out over the wire, your power to make decisions over what's done with it is gone. You have to hope that whatever was listening on the wire is (and will continue to be) benevolent. How do straw men and hyperbole apply here?

> The most difficult factor to wrangle is human psychology. Without intervention, phishing attacks just work. People re-use passwords. People switch from redox1 to 1redsox1 when forced to change them. They do this all to avoid having to think about it.

> The entire point of password managers is to mitigate this.

I agree. That's part of why I use a password manager, and recommend that others do so too. We just disagree on whether or not its advisable to cede control over that kind of tool to a third party.

It feels a lot like the argument that your money is safer in a bank than in your mattress, which is an argument I agree with. Except replace all the banking regulations and security with a ToS that can change anytime and emails about how very deeply we care about your security. I'll keep my cash in my safe at home in that scenario. Maybe there are some people who'd still be better off using that bank. I wouldn't feel good giving that recommendation though.

I said buying it is "fine". Even if that was directed specifically to this service, that doesn't mean I want it.

> there's also no one person who knows a definitive answer

Then don't be so insistent that the price is good.

> Like, software companies have gone with your reality, and before 10 years passes up and you feel like it's time to upgrade... they're gone!

I'm not saying they have to do it that way, I just think it's a reasonable way to calculate the price of the functionality.

If they want a steadier income that's fine, but wanting a full retail paycheck every single year is going too far.

> It's not just $3 for passwords, it's $3 so I have confidence I'm not relying on 1password having indefinite growth to have people work there.

On the other hand, worrying about whether companies will be around for the long term is a big reason I dislike subscriptions.

That $3 doesn't guarantee they'll still be around. And for a simple product like this, the more ambitious they get the more worried I get.

Also this company is an order of magnitude or two bigger than "sustainable". The only way they would stop selling a password manager is because of bad management or because they choose to pivot into a different market. They're not going to have insufficient money to pay the staff of their core product.

Well that's the big question with these services isn't it? Are they keeping their doors open because they have more value to provide? Or is this just a ruse to keep their doors open without any further value to provide?

Feature-complete, then. It needs updates but it doesn't need significant development work.

> Great way to make my point. MS tried taking just 3 dollars a month for an entire OS, but because they were asking for money upfront they had to turn to a mixture advertising Candy Crush in the start menu and privacy abuse.

They make most of their money off new computers at an even lower price. Adding candy crush and more tracking came after they switched to making upgrades free, and I really doubt it's worth $100 a seat.

They made home windows into a loss-leader. If there was a choice to pay to remove those things I bet they'd make somewhat more money. But it's not where their big revenue streams are so they don't care.

I just now realized you're the same person from the other thread and it all makes sense now, this was never about 1Password for you. My mistake taking the bait.

And of course, I vehemently agree with anything you say about 1Password, or Windows.