1Password for Mac Gets Updated with 30 New Features, 1Password Mini Item Editing

Yeah, it sounds impressive, but then they told passengers the Titanic was unsinkable due to it's state of the art engineering.

So while "256 bit locker encryption" sounds great, I don't understand what it means, whether it's appropriate, nor do I have any way of verifying it really is secure.

So if you don't know what it means or don't understand, you just blow it off? You could, you know, read a little (http://blog.agilebits.com) and educate yourself (http://en.wikipedia.org/wiki/Encryption). If you're not going to do that, there's really no use proudly announcing you don't understand something so you're not going to use it. You basically have to trust a bunch of other people telling you a thing is real and good at what it claims, and 1Password is definitely the real thing and highly secure. Or you can just keep using the same weak/annoying password system you're using now.

This app has always been worth it. For a non-subscription fee, they have been great at updating both the OSX and the iOS versions of this application. Been a customer for nearly 4 years.

* It actually generates secure passwords for you!

So does Keychain

I don't have a problem remembering the few passwords I use on a daily basis even if they are over 8 or 9 characters long.

Quick question for you: Do you consider any of the following passwords secure?


* thereisnofatebutwhatwemake
* eastofthesunwestofthemoon
* !)@(#*$&%^Test123
* *tecno9654postgres
* !@#$%^&*()_+lisa
* Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn1


If your answer to just one of the above is "Yes": Think again real hard about using a good password manager!

Those passwords above were all guessed using "dictionary lookup" attacks within hours or days (not weeks or years)! Several hours to days!

(And please note: there are all considerably longer than your simple "8 or 9 character passwords"!)

Rule of thumb: if you try to come up with a password that is based on any (combination of) word(s) that can be found "on the Internet" (Twitter, Wikipedia, websites, news groups, the Bible, other book texts available in electronic form, ...), it is very likely that it will be guessed! Even 1f u d0!permutat1ons$and_try2bcl3v3r! ("rule-based substitution attacks").

For a detailed background why you should be very concerned:

http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/2/
"How the Bible and YouTube are fueling the next frontier of password cracking"

And considering that several major (commercial) sites were hacked and millions of encrypted passwords were stolen in the past few months, you should really have different passwords for each and every service!

(What people often forget: they might have a hugely "secure password" for e.g. their Apple ID, but they have a weak password for their email, so attackers can guess the email password, reset the Apple ID with a confirmation email sent to that email address, and *zonK*! There you go! Your Apple ID accessible now to them as well!)

I know the benefits off the app but I'm not a big fan of a program generating passwords for me even if they might be slightly more complex.

Well, as I said: reconsider of what you think is "secure"...

If I am not mistaken, both programs have 256 bit locker encryption. OneSafe has Tri-Pin protection for securing the vault. Makes it virtually impossible to crack.

Yeah, it sounds impressive, but then they told passengers the Titanic was unsinkable due to it's state of the art engineering.

So while "256 bit locker encryption" sounds great, I don't understand what it means, whether it's appropriate, nor do I have any way of verifying it really is secure.

For what it's worth, I've never seen ANYONE have anything bad to say about 1Password other than "I can't afford it".

For me, that's reason enough to buy it. They're the only product out there (AFAIK) that is actively writing about their security processes (including flaws). I wouldn't trust _any_ of the other applications.

I'm shocked, to be honest, by all of the people on this "tech" site that think that
1 - reusing passwords is okay
2 - they can remember all of the secure passwords that they need

For 1: you will be burned. it may not be today, it may not be tomorrow, but you will be burned. someone will spoof your name on a forum, or you'll forget that "hey, that pizza place actually has my credit card on file... oops"

For 2: it's either one or the other. they're either secure, or you can remember them. choose one. not both.