Slashdot Mirror
Apple To Deploy 1Password To All 123,000 Employees; In Talks To Acquire Password Manager's Parent-Firm AgileBits: Report (bgr.com)
Jonathan S. Geller, reporting for BGR: Apple acquires an average of 15 to 20 companies a year, according to CEO Tim Cook. Of that number, we only hear about a couple, as most of these acquisitions or aqcui-hires are not consumer-facing, nor disclosed. However, we have exclusively learned that Apple is planning an interesting partnership and a potential acquisition of AgileBits, maker of the popular password manager 1Password.
According to our source, after many months of planning, Apple plans to deploy 1Password internally to all 123,000 employees. This includes not just employees in Cupertino, but extends all the way to retail, too. Furthermore, the company is said to have carved out a deal that includes family plans, giving up to 5 family members of each employee a free license for 1Password. With more and more emphasis on security in general, and especially at Apple, there are a number of reasons this deal makes sense. We're told that 100 Apple employees will start using 1Password through this initiative starting this week, with the full 123,000+ users expected to be activated within the next one to two months. Update: In a statement, 1Password said rumors of its acquisition were "completely false."
According to our source, after many months of planning, Apple plans to deploy 1Password internally to all 123,000 employees. This includes not just employees in Cupertino, but extends all the way to retail, too. Furthermore, the company is said to have carved out a deal that includes family plans, giving up to 5 family members of each employee a free license for 1Password. With more and more emphasis on security in general, and especially at Apple, there are a number of reasons this deal makes sense. We're told that 100 Apple employees will start using 1Password through this initiative starting this week, with the full 123,000+ users expected to be activated within the next one to two months. Update: In a statement, 1Password said rumors of its acquisition were "completely false."
Apple already has a password manager built into their products, what new functionality will 1password provide them? Is this just a patent play?
Why would anyone store their passwords in the cloud? Color me stupid, paranoid, whatever, I don't get it.
Keepass for the win,
I do use 1Password and I'm not terribly happy with this. 1P integrates well with OS X (and iOS and Windows). Agile bits is small, so far reasonably well behaved firm (not terribly happy with the attempt at subscription pricing but I think that ship sailed a while back).
I don't use iCloud. I use Dropbox.
I don't use Pages. I use Word.
I don't want Apple to swallow up everything, thankyouverymuch.
Faster! Faster! Faster would be better!
I don't use 1Password, but I do use Apple's iCloud key chain. I view this as potentially positive for me, since Apple's solution barely works and is not cross platform. A fun example, if you run out of space, macOS deletes your keychain. Even with iCloud enabled, it will never bring it back. Apple just can't do cloud services, so maybe buying something that works is a good idea.
I don't know, but it works for me.
Password managment is something apple computers already do and sync. Letting a third party like apple be the conduit for your password syncs isn't particularly unnerving. It's no more unnerving than letting 1-password do it.
Unless of course, apple is your employer and insists you use an iphone or a mac computer. In that case you want a different third party.
So it makes sense for apple employees not to be forced to eat their company dogfood in this case. But it probably doesn't mean apple is going away from it's own password management. That works just fine and it's interoperable with other browsers like chrome.
Some drink at the fountain of knowledge. Others just gargle.
I don't use 1Password but might if Apple bought it. As far as I have to trust third parties with my data I trust Apple, but 'Agile Bits'...? They may be extremely competent and morally beyond reproach but I have no way of knowing that.
Why would anyone store their passwords in the cloud? Color me stupid, paranoid, whatever, I don't get it.
Keepass for the win,
Just as relevant, why would anyone store their passwords on their computer? (Which could be compromised, malware could follow you unlocking your password vault and replay that action later.)
What we need is dedicated hardware, a password vault that we could take with us in the form factor of a small USB dongle, where the processing is done in the dongle and not on the computer. Inexpensive, with a way to make secure backups and reload our passwords to a newly purchased dongle when lost or stolen. The device needs a PIN that's entered on the device, and not on the computer.
(Or in the form of a credit card, a NFC or BLE device that you can just place near your computer. The form factor of a credit-card calculator would work - small solar panel for power, keypad for entering the PIN, and LCD display for feedback.)
Mooltipass comes close, it's got the right functionality but it's big and is an "add-on" to most software.
How I wish the whole universe would switch to 2-part ID. I would happily make my phone, or a USB key mandatory for every single sign on attempt.
I don't use iCloud. I use Dropbox.
You trust the company that has Condoleezza Rice on its board over the company that has pushed back against the FBI on privacy so much that their conflict has its own wikipedia page? Really?
CRAZY HEADLINE! [unnecessary words omitted] Update: it's all bullshit so disregard everything.
My question then becomes, why the hell even have the story on the front page if it's immediately going to be repudiated? This seems like a perfect example of "Fake News".
Nope. Don't trust nobody. Dropbox, Apple, Google. Anything remotely interesting is encrypted before it hits Dropbox.
If Condoleezza really wants my scheduling matrices, draft reports and the other impedimenta of my life, they're welcome to it.
I just want the same files on all my machines. Without hassles.
Faster! Faster! Faster would be better!
I do not use 1Password but only One Password "BluePotato#8" so it will not affect me or the "security" of my Data.
That statement above is of course false.
The real problem is how bad Passwords are in general.
We need to trust the people who is asking for the password to the system to have it stored in a way that it isn't accessible by a data breach, Often Secured Hashed with Salt and Pepper but that is with vendors who care about security. Often there are Startups with Programmers who are just out of 2 year school, who are happy that they their code can read the database and match a password in plain text. Then get deployed and used without ever fixing the security.
Then we have the fact we need multiple of them to counteract not trusting sources for your password. Making it harder to keep track of and forget, often making your own insecure database on a computer that you may bring to the local coffee shop.
Then your password needs to be complex enough not to be guessed or brute forced, however you need to remember it.
If you actually feel safe about the security of your data, you are probably already compromised. Password Managers are not the end all bee all for security, but what they do is fix some problems with passwords, if 1Password is a reputable and secure solution you are probably better off then without it. However you are still not secure.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Companies actually can't legally comment either way on M&A activity, simply because lack of denial signifies something if previously there has been a denial.
Also, PR people are not in the loop on any M&A discussions, so any comment is either actionable if from an officer in the know, or BS if from others.
Keychain much better then 1password as is EOM
I purchased 1Password several years ago and use it on both my Mac and Windows laptops as well as my phone. The level of support AgileBits gives to the product is one of those big companies that feels like a small bunch of friends who helps you out type of thing. I hope if Apple acquires them they don't lose that. 1Password is an excellent product.
It was probably cheaper to buy the company than buy 123,000 family plan accounts.
Why not give them each their own password instead?
"That's the way to do it" - Punch
Why would Apple bother buying 1Password when iCloud already does the same thing and is integrated into all their platforms? Do people making shit up just use MadLibs and go with whatever? Are the clicks really worth that much?
I'm a loner Dottie, a Rebel.
This. Since there is no vetting or third party certification, all their password data could be sitting on a public S3 bucket, with the password used for authentication and all zeroes used for AES "encryption". At least LastPass documents what they do, and their security is proven.
What would be ideal is that each endpoint generates and stores their own private key, and is "introduced" to each other via another device. That way, the cloud provider doesn't even have password hashes that can be brute forced... just public keys, so a compromise of the cloud provider means an attacker has to deal with all 256+ bits of AES [1], rather than a password that can be brute forced.
[1]: The ideal might be a triple cascade cipher similar to what VeraCrypt does, so if AES is broken, Serpent or Threefish would still hold up.
pfft that went down the memory hole for apple users just like the whole certificate authority and forged google certs that apple decided to keep trusting for several months after it was discovered, the only reason being to fuck with google services on their devices. I mean, I can boot up any flavor of linux and I'm not getting into a root shell without a password. I can boot up ANY version of windows past 3.11, and likely including it, and not be able to get into admin without a password. I have to jump through insane hoops to get root on my phone. But on an apple device on the right version, i just need to knock on the door twice and I get in. Yup, trust them with all your data and passwords because they certainly have not become the behemoth they set out to destroy. They'll debut another expensive piece of crap that finally provides features their competition has been providing since 2014, then "innovate" a few more dongles on us and the cult members will cheer it on. For fucks sake apple can't even follow 802.1x properly.
1Password is actually fine as far as 3rd party concerns go. You can use their internal cloud to store your password archive, or one of many other cloud services, or even keep the archive in local storage and NOT in the cloud. The password archive is a file. You can put it anywhere you put any other file. The trust for this location is entirely up to you. If you trust Apple, put the archive into iCloud and you're solid.
I've been using the program for several years. I'm quite happy to see Apple using it. They could choose from any password tool on the market. I'm sure they extensively vetted the alternatives before picking 1Password. If it's secure enough for Apple, I feel safe trusting it as well.
Find a flaw in 1Password, and compromise Apple. They just made it a high value target.
Bet they are MUCH more interested in an IPO payout, actually.
I think you are making the old 'nothing to hide' pro surveillance argument. A very dangerous position to take.