The convenience outweighs the risks for the vast majority of users. My parents need something that is available on all devices, syncs automatically, and requires no maintenance.
You get a master encryption key that never leaves your device when setting up the account. Anything that touches their servers is encrypted with that key. You need that key to setup a new device (in addition to your username and master password).
They at least offer local network syncing, instead of requiring a cloud account (which is a deal breaker for me). This lets you keep your passwords in sync between your Computer (master) and mobile devices without them ever leaving your home.
All that does of course still require trust in the company, but at least not in their cloud infrastructure and, well, the internet...
The flip side is that it’s incredibly easy to use, faster, and means you don’t have to worry about forgotten passwords or phishing. It’s like an order of magnitude faster than less secure MFA options, too.
..and it is the best solution for guaranteeing confidentiality and the encryption need/problem - not to need it, since there isn't a server to eavesdrop on
It also has other merits. It is stateless (so all you need is to save the master key offline). And it doesn't rely on a third party (so no one else that you and the website you log in to knows about your relationship).
Nothing is entirely secure. We're two guys with no ulterior motives that take all reasonable precautions to keep the data safe. For most people that's not only enough, it's much better than having their passwords stored in their email archives and chat logs.
> it is also nice knowing that I never have to worry about losing my device since all of my actual work is on a server I can login to using just about any other device including my phone.
Because they're good enough. Also they're potential keyloggers and have access to all your passwords, conversations, and searches. You already trust the OS with those; much harder for some random third party startup to do.
They are very clear and upfront about it and there are many cases where their simplest offering (the one with no encryption behind edge server) is good enough.
At first, they're not a monopoly, people who worry about that could easily use other open-source and probably less convenient solution.
Secondly, after the subscription ends the apps simply go into read-only mode. You still have access and can export all of your passwords.
We may argue about it but the most expensive solutions are still the most consumer-friendly.
Ben from 1Password here. This is absolutely the most important reason why it was done. There are of course business considerations as well, but cutting down on potential data loss scenarios is key.
You get a master encryption key that never leaves your device when setting up the account. Anything that touches their servers is encrypted with that key. You need that key to setup a new device (in addition to your username and master password).
reply