Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

1password had (maybe still has?) integrations with services like Dropbox where your vault would be stored on a 3rd party service like Dropbox to achieve the cross-device syncing your describing.

IMO this was the more secure implementation (assuming 1password was only storing fully encrypted files on your 3rd party cloud preference) - even if someone broke in your Dropbox, they can’t decrypt your passwords without your master pass.

An end-to-end cloud solution provided natively by 1pass is much more user friendly and easier, but requires putting an order of magnitude more trust in 1password’s security architecture (which of course is closed source).



The fundamentals are still the same, everything is encrypted with your master password before being sent to 1Password's cloud. So even if someone infiltrates 1Password's storage, all they get is encrypted files, same with Dropbox.


If that’s true, than the point I made about better security with Dropbox is moot.

As an end user, it’s abundantly clear that all encryption/decryption is done locally when using the Dropbox integration since you can see the files directly in your Dropbox. I guess I didn’t make the same assumption about the 1pass cloud service for some reason.


This option [1Pwd vault stored in Dropbox] is still available; I've been using it for years. Highly recommended!


Just adding to this accurate statement, you can also sync a vault in iCloud. So there are at least three syncing methods:

1. 1Password Cloud

2. iCloud

3. Dropbox

And at least 2 and 3 can be used simultaneously, which is what I do, with my main vault in iCloud, and temporary vaults, e.g., passwords for a particular job, in Dropbox.


There’s also still the WiFi sync method which you can use to sync between devices without that information ever leaving your local network.


I trust 1Password 100x more than I trust any individual to keep password information safe.


> 1password had (maybe still has?) integrations with services like Dropbox

It's not as seamless as having the functionality built-in. You have to deal with logins, authorizations, etc. I wish it could be as easy as "Do you allow 1Password to use Dropbox? (Y/N)".


It isn’t more secure, unless you’re asserting Dropbox cloud is more secure than 1Password. 1Password still encrypts it on the client side.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: