1Password

[jonaharagon]

I want to suggest recommending 1Password in our password managers category, I believe it is at the very least equivalent to Bitwarden in all relevant areas, while likely being easier for beginners, families, and less technical people to use.

This is not an exhaustive list of features/benefits to 1Password, just some highlights over their competition.

Beginner-Friendly

UI: The 1Password experience is much more polished and feature-complete than Bitwarden's clients; Nearly every feature is available via their native clients, whereas Bitwarden requires using the web interface for many advanced tasks. It is also simply easier to use and navigate, which will help non-technical people get on board with using a password manager. Traditionally it has always been the go-to choice for Apple users, however they've reached feature/UI parity on all platforms with 1Password 8. I think we need to be suggesting much more accessible platforms for people, and IMHO Bitwarden falls prey to the classic trap of FOSS projects, which is having good UI/UX second-to or as an afterthought to pure development/features.

Support: 1Password provides great support on all their channels, including over the phone. It's not a big deal to a lot of people, but being able to call someone and talk to a real person is a godsend for others, especially less techy and/or older individuals.

Family Plans: It's been my personal experience and I've heard from many others that managing family plans and shared passwords is just a simpler and more intuitive experience on 1Password. IIRC family plans on Bitwarden is just a version of their (relatively over-complicated) organizations mode.

Security

Secret Key: A mandatory, randomized 34-character key is used in conjunction with your master password to encrypt your data on their servers and to add new devices, meaning your data is secured with high entropy regardless of your master password. I believe Bitwarden security is entirely reliant on your master password.

Audits: 1Password is audited on a regular basis, which are publicly published: https://support.1password.com/security-assessments/

Open Design: Not sure what the right term for this is, but 1Password's security mechanisms are thoroughly documented in their security whitepaper: https://1passwordstatic.com/files/security/1password-white-paper.pdf

Privacy

Tracking/Analytics: Their apps have no trackers. Bitwarden includes analytics trackers, not a big deal but still notable.

Company

Track Record: 1Password is one of the oldest password managers around, and has not had any significant security breaches or flaws in their history. They have a bug bounty program to encourage security researchers to discover issues with their product.

Critical Acclaim: 1Password is near-universally recommended by experts in the infosec space (example). I don't think an argument from authority is a reliable argument on its own, but it is still notable.

Functionality

Offline: 1Password works fully offline. IIRC, Bitwarden does not let you modify your vault offline unless this has changed recently?

[matchboxbananasynergy]

You make a good case for this. I haven't personally used 1Password, but a lot of people I know swear by it. It not being open source is not a concern for me.

The only concern I would have is that a lot of these companies collect a lot of data (for legitimate reasons, such as being able to provide support, but data nonetheless).

Happy to hear others' thoughts, and experiences, if they've used it.

[matchboxbananasynergy]

You: Your IP address, the devices connected to your account, and the name, email address, and profile pictures that you have given to us.

"The devices connected to your account" is kind of vague. I'm trying to visualize exactly what they collect there.

That said, I do think it's more than likely fine, and that once you choose to use a SaaS product, a lot of this comes with the territory. I would expect Bitwarden to collect similar things.

[jonaharagon]

It's likely for this feature allowing you to visualize and deauthorize devices (blurred info includes IP and geolocation):

[matchboxbananasynergy]

It's likely for this feature allowing you to visualize and deauthorize devices (blurred info includes IP and geolocation):

That makes sense.

All in all, does the argument for listing 1Password boil down to "it doesn't have any apparent privacy downsides compared to Bitwarden, but is much more user friendly?"

If so, I think that this can be a convincing argument for listing it, personally. I wouldn't remove Bitwarden, but I'd be fine with this being listed as well.

[ghost]

Down with Psono, up with 1Password

[jonaharagon]

I actually really dislike Bitwarden's reliance on their web vault too, but that might just be personal preference. I don't want to remove Bitwarden, I definitely want to remove Psono :)

[dngray]

Offline: 1Password works fully offline. IIRC, Bitwarden does not let you modify your vault offline unless this has changed recently?

This is correct, it's still like that.

I'm not opposed to adding 1password.

[d4rklynk]

1Password needs more permissions than Bitwarden in the browser

[jonaharagon]

The main differences appear to be the ability to download files, the ability to send notifications, and the ability to alter your browser settings (to disable the built-in autofill). Both extensions require full site data access which is really the main permission which poses a privacy concern, and is required for their functionality.

[seankhl]

I love 1Password. No technical contribution to the discussion, I agree with the OP and I feel 1Password is more usable than Bitwarden, KeePass, and other options.

[d4rklynk]

I don't know why you would want to recommend 1password, it is not foss. Bitwarden is both excellent and foss. There are multiples tools you didn't recommend bc it was subpar. Idk why you would want to recommend this one.

[jonaharagon]

I don't believe it is subpar for the reasons stated in the OP, do you have any specific counter-arguments?

We don't have a FOSS requirement on the site, generally recommendations have to be (1) privacy-respecting and (2) good, and 1Password appears to be both.

[ghost]

Just taking a look, it seems there is no free plan for 1password. That seems like a pretty big downside when bitwarden has such an attractive free option. But those features sound good if you are willing to pay

[matchboxbananasynergy]

If 1Password were to be added to the site, it would not replace Bitwarden, we would list both.

While having a free version is definitely appreciated, we already list services which are not free and have no free version (see most of the VPNs we list as well as some of the e-mail providers).

We would most likely make it clear that it's paid and outline the pricing somewhere in the card.

[Mohamad20ZX]

I think it well be better for new users and for family its a great password manager that's need's to be including

[jonaharagon]

Based on the feedback here this has been added in #1666.

[jonaharagon]

We try to avoid single-platform solutions whenever possible to avoid vendor lock-in, which is one reason we don't recommend using any native browser password managers.