Local Vault

As always, I'd be happy to connect you with our specialist team if someone at your organization would like to discuss our security model, how things work, and ...

While I appreciate the offer, it is astounding how naive that statement is. There is no way - and I wouldn't even want to waste your time - that our company is ever going to change it's position on cloud-based password storage. And we're talking over 140K employees. While 1 password was on the approved list, it is no longer.

I'm going to guess that the companies that @benwade, hotoutside, @davido1138, @blaukraut, etc. work for are equally as unlikely to change their stance. This is just sad.

What ljohnston said is correct. While you may 100 percent believe in your security solution (and I believe in it as well), my employer will not change this stance. And with good reason - everything is secure - until someone finds that one thing and then it’s not.

Please consider providing a mechanism for creating a local storage vault.

Sounds like we're at an impasse, for now. Local vaults are not part of the plan for 1Password 8. The best I could suggest would be to fill out our survey on self-hosting of the 1Password service, if that would be a potential solution for your organization. These responses are reviewed by dteare directly.

https://survey.1password.com/self-host/

Ben

Vaults that are *exclusively* "local," and don't sync anywhere, are not part of our business model

I sync my local vaults myself or using the build-in sync-to-folder and WLAN sync to sync my iOS devices. But I don't think this counts under the above quote. I'd be fine running my own 1Password service, but that will be of no use if the apps stop working when the subscription ends (e.g., on an older machine that's no longer supported, or if the company gets purchased or goes out of business).

I have a number of older machines around, running various versions of MacOS, that I use because the software on them has no good replacement or none that maintains the data (e.g., Quicken 2007). I can do this because the software is licensed and will continue to run, and my data is local. With a subscription model, if the subscription expires, or the service is discontinued, or I need to stick with an old version on a particular machine, I'm sunk. It stops working if any of these happen. Or, if the company is purchased or goes out of business, the software will stop working and/or the data becomes inaccessible.

I need assurance that my software will continue to function and my data will remain accessible and under my control even if AgileBits is purchased or goes out of business. I'm happy to host a service on one of my own servers and do my own backups. I'm fine with paying for software but the software must continue to function even if I'm running an old, no longer supported version or the company is consumed by another.

I need assurance that my software will continue to function and my data will remain accessible and under my control even if AgileBits is purchased or goes out of business.

I don't think that is a promise any software vendor can make, @jetboy, and it certainly isn't one I'm able to make. The nature of software is that in order for it to be viable long term it needs to receive updates. For starters, you’d essentially have to be “frozen in time” and not update either your operating system or your web browsers. That isn’t a practical solution in most cases. It is also a really poor option in terms of security, which is one of the core reasons to use 1Password in the first place. Otherwise it is very possible that an update from a 3rd party would be incompatible with the existing version of 1Password.

The need to release frequent updates in order to maintain compatibility was one of the motivating factors behind moving to a subscription model. As an example, we just had to update 1Password 7 and 1Password 8 because Chrome changed their signing certificate, and so earlier version of 1Password can no longer connect to it.

That said, we intentionally offer exports with open formats to ensure your data remains yours. This article (from 2013) is a little dated at this point, but the principal still holds true:

You have secrets; we don’t, why our data format is public

You can read about the 1PUX open format in 1Password 8 here:

About the 1Password Unencrypted Export format

the software must continue to function even if I'm running an old, no longer supported version or the company is consumed by another.

I don't think that's feasible. It certainly isn't something I can promise with regards to 1Password, and frankly I wouldn't recommend trying to do so. In such a scenario the best course of action would be to export your data and migrate to an actively maintained solution.

Ben

I don't think that is a promise any software vendor can make, @jetboy, and it certainly isn't one I'm able to make. The nature of software is that in order for it to be viable long term it needs to receive updates. For starters, you’d essentially have to be “frozen in time” and not update either your operating system or your web browsers. That isn’t a practical solution in most cases. It is also a really poor option in terms of security, which is one of the core reasons to use 1Password in the first place. Otherwise it is very possible that an update from a 3rd party would be incompatible with the existing version of 1Password.

In my post, 1P_Ben, I was talking about the unusual scenario where a machine is deliberately "frozen in time" for specific reasons, with examples of where it's necessary. I thought it was clear that I was not talking about a current, updated system. Obviously, older software becomes obsolete on such machines. That's elementary. I'm sorry I did such a poor job of explaining my point that you think I'm demanding something unreasonable or impossible.

I understand. That's not something that we can support or encourage, either. There's a lot of alternatives out there to Quicken 2007 that don't require you to run an insecure operating system. I know that's not what you are hoping to hear, but that's our position. At the end of the day we're a company that is heavily invested in the security of our customers, and using legacy y maintained software is incongruent with that. If you are intent on doing so then I would highly recommend that you disconnect such a machine from the Internet and use it solely for the legacy software that you're keeping it for.

Ben

Sounds like we're at an impasse, for now. Local vaults are not part of the plan for 1Password 8. The best I could suggest would be to fill out our survey on self-hosting of the 1Password service, if that would be a potential solution for your organization. These responses are reviewed by dteare directly.

https://survey.1password.com/self-host/

Done. Thanks 1P_Ben

Thank you @davido1138. 👍️

Ben

That said, we intentionally offer exports with open formats to ensure your data remains yours.

I am generally pretty happy with 1P8, but am concerned about being locked in for ever, so the above quote is important to me. I have experimented with 1PUX exports from 1P8 and it was not a good experience (https://1password.community/discussion/126092/does-1password-8-change-local-backup-situation#latest).

Are you saying that 1PUX exports are usable as import options by other apps if I ever wanted to change?

Thanks