1Password for Mac Gets Updated with 30 New Features, 1Password Mini Item Editing

Yeah, it sounds impressive, but then they told passengers the Titanic was unsinkable due to it's state of the art engineering.

So while "256 bit locker encryption" sounds great, I don't understand what it means, whether it's appropriate, nor do I have any way of verifying it really is secure.

So if you don't know what it means or don't understand, you just blow it off? You could, you know, read a little (http://blog.agilebits.com) and educate yourself (http://en.wikipedia.org/wiki/Encryption). If you're not going to do that, there's really no use proudly announcing you don't understand something so you're not going to use it. You basically have to trust a bunch of other people telling you a thing is real and good at what it claims, and 1Password is definitely the real thing and highly secure. Or you can just keep using the same weak/annoying password system you're using now.

This app has always been worth it. For a non-subscription fee, they have been great at updating both the OSX and the iOS versions of this application. Been a customer for nearly 4 years.

I don't have a problem remembering the few passwords I use on a daily basis even if they are over 8 or 9 characters long.

Quick question for you: Do you consider any of the following passwords secure?


* thereisnofatebutwhatwemake
* eastofthesunwestofthemoon
* !)@(#*$&%^Test123
* *tecno9654postgres
* !@#$%^&*()_+lisa
* Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn1


If your answer to just one of the above is "Yes": Think again real hard about using a good password manager!

Those passwords above were all guessed using "dictionary lookup" attacks within hours or days (not weeks or years)! Several hours to days!

(And please note: there are all considerably longer than your simple "8 or 9 character passwords"!)

Rule of thumb: if you try to come up with a password that is based on any (combination of) word(s) that can be found "on the Internet" (Twitter, Wikipedia, websites, news groups, the Bible, other book texts available in electronic form, ...), it is very likely that it will be guessed! Even 1f u d0!permutat1ons$and_try2bcl3v3r! ("rule-based substitution attacks").

For a detailed background why you should be very concerned:

http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/2/
"How the Bible and YouTube are fueling the next frontier of password cracking"

And considering that several major (commercial) sites were hacked and millions of encrypted passwords were stolen in the past few months, you should really have different passwords for each and every service!

(What people often forget: they might have a hugely "secure password" for e.g. their Apple ID, but they have a weak password for their email, so attackers can guess the email password, reset the Apple ID with a confirmation email sent to that email address, and *zonK*! There you go! Your Apple ID accessible now to them as well!)

I know the benefits off the app but I'm not a big fan of a program generating passwords for me even if they might be slightly more complex.

Well, as I said: reconsider of what you think is "secure"...

If I am not mistaken, both programs have 256 bit locker encryption. OneSafe has Tri-Pin protection for securing the vault. Makes it virtually impossible to crack.

Yeah, it sounds impressive, but then they told passengers the Titanic was unsinkable due to it's state of the art engineering.

So while "256 bit locker encryption" sounds great, I don't understand what it means, whether it's appropriate, nor do I have any way of verifying it really is secure.

* It actually generates secure passwords for you!

So does Keychain

1Password is excellent. I've been using it for about four years now and I will gladly keep paying for upgrades because 1Password has completely changed my family's approach to passwords by getting us to use unique strong passwords for each site we visit.

I just wish the iOS app was updated with a more iOS 7 feel. It's even still using the pre-iOS 7 keyboard.

I think I must be in the minority in not needing these kind of apps. I really don't get it.

My (#$%DF345#$%) type passwords are not only stored in my brain but require my personal authorization response with a time limit + Google authenticator.

Unless you have dementia or something I don't see the need for these password apps.

Anything I let Safari autofill I don't care about and can be hacked away to a hacker's delight.

Is there something I'm missing/not getting? Am I missing a cool convenience or something?

I can't remember all the different passwords I use on each site I am a member of or do transactions with etc. And having a program on my computer, iPad or iPhone is much better and more secure (in my mind) than having unsecured text notes with the passwords on them. The program ensures that I can have hard to hack passwords and security of storage and use, without the hassle of trying to memorize numerous passwords that are 12 characters long (with numbers, letters, and symbols).

The problem with an app remembering all your passwords is that if one day you find yourself at someone's house or on a device that doesn't have the app installed, you're basically screwed and pretty much locked out of the internet. I still think there's no alternative to remembering them all. Most of your passwords can be the same, since most sites aren't that important. I mean who cares if the password for the pizza delivery site is the same as the one you use for some forum you only logged into once?

I always have my iPhone with me. In the case where I need a password that can't be autofilled on a device that does not have 1Password installed on, I lookup the required password in 1Password on my iPhone and hand type it in.

For what it's worth, I've never seen ANYONE have anything bad to say about 1Password other than "I can't afford it".

For me, that's reason enough to buy it. They're the only product out there (AFAIK) that is actively writing about their security processes (including flaws). I wouldn't trust _any_ of the other applications.

I'm shocked, to be honest, by all of the people on this "tech" site that think that
1 - reusing passwords is okay
2 - they can remember all of the secure passwords that they need

For 1: you will be burned. it may not be today, it may not be tomorrow, but you will be burned. someone will spoof your name on a forum, or you'll forget that "hey, that pizza place actually has my credit card on file... oops"

For 2: it's either one or the other. they're either secure, or you can remember them. choose one. not both.

I think I must be in the minority in not needing these kind of apps. I really don't get it.

My (#$%DF345#$%) type passwords are not only stored in my brain but require my personal authorization response with a time limit + Google authenticator.

Unless you have dementia or something I don't see the need for these password apps.

Anything I let Safari autofill I don't care about and can be hacked away to a hacker's delight.

Is there something I'm missing/not getting? Am I missing a cool convenience or something?

Oh, I have trouble remembering my 16-30 character passwords with random numbers and letters. Perhaps I should think of a pneumonic or something. You know... to prevent dementia and stuff.

Lets see here...

Every day Jay eats # of Three 3 cabbage and a ^ for brunch while Listening to A b& on 98.7!nd%fM

Well, that covers my MR password...now to come up with one for my bank...