🔐 Goodbye 1Password
Violet Blue at Threat Model:
Popular password manager 1Password has pledged $300,000 over three years in support of David Heinemeier Hansson's Linux distribution known as Omarchy, and is now a “distinguished corporate patron” of Omacom. What a nice brand partnership. As reported in Tuesday's Threat Model newsletter, DHH has called for the ethnic cleansing of Europe; he is also an antivaxer, a Covid "truther," a proponent of the "lab leak" conspiracy theory, an 'anti woke' weirdo, and is virulently anti-DEI on the grounds of diversity and equity initiatives being discriminatory against, well, you know.
In an internal Slack message leaked to press today 1Password’s Roustem Karimov defended DHH as being attacked for his views, while 1Password's CEO issued a blanket assurance to staff saying that the company doesn't "endorse hateful, dehumanizing, or exclusionary views, including those shared publicly by DHH.” Ah, okay. That makes it better.
It's a great time to migrate to a new password manager, such as Proton Pass, Bitwarden, Keeper, Nord Pass, or even Apple's Password[s]. It's not an overly technical process so the good news is that you'll be able to move your family members off the service as well 🙃
Violet provides links to various migration guides and additional details. Some things to note:
- 1Password doesn't support exporting or migrating passkeys yet, so if you have any you'll need to create new ones in your new password manager
- You can export your 1Password data to a 1PUX or CSV file, but there are significant differences:
- The 1PUX file contains pretty much all of your 1Password data except passkeys
- The CSV file contains only logins, so things like secure notes, file attachments, software licenses, and so on are not included (this includes custom fields, even ones belonging to logins!)
My original plan was to do a methodical export, but I realized there's no real need for that. Here's what I ended up doing:
- I checked my 1Password account and saw that it was paid for through June of next year, which seems like plenty of time for me to fall back to 1Password and retrieve any info if needed.
- I canceled by 1Password subscription.
- I exported a 1PUX file into an encrypted disk image as a just-in-case backup of everything that I don't actually plan to use unless I really need it.
- I exported a CSV file into the same encrypted disk image and imported that into Apple's Passwords.
- I uninstalled my 1Password browser extensions and removed the app from my dock and phone's home screen, but kept the app installed just in case.
Remember: the 1PUX and CSV exports aren't encrypted, so you'll need to be very careful with them. That's why I created an encrypted disk image for them.
My plan now is to go about my daily life and handle any issues that come up on an ad-hoc basis. Chances are most of what wasn't imported into Apple Passwords can be retrieved or reset via email-based recovery methods. If there is something that only exists in 1Password I can always yank it out using 1Password itself or by importing the 1PUX file into another app that supports what I need.