On Password Managers
The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has <i>not</i> in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so).<p>There are four issues that I'm currently aware of with 1Password:<p>1. They've converted from flat to subscription pricing.<p>2. They're pushing people to a 1Password-managed cloud sync system instead of the a la carte sync they were doing before.<p>3. They're promoting cloud vaults and hiding local vaults, and the Windows version of 1Password has apparently never used local vaults.<p>4. Now that they have 1Password.com, first-time enrollment in 1Password requires you to interact, once, with 1Password.com.<p>Of these, only (4) is a serious security concern. Their last release further eliminated the native app's dependency on 1Password.com. I'm confident they'll get all the way towards decoupling them, but I'm not them, so grain of salt.<p>I have no relationship with 1Password other than as a happy customer and as someone who does research in the field they work in. Having said that: I strongly recommend that you be <i>very</i> careful about what password manager you choose to use. The wrong password manager can be drastically less secure than no password manager. I recommend 1Password, and there's currently no other commercial password manager that I recommend. I'm sorry I can't go into more detail than that. :(