1Password Has Raised $620M

• keepassxc

  512 19,176 8.7 C++

  KeePassXC is a cross-platform community-driven port of the Windows application “Keepass Password Safe”.

  

• Bitwarden

  1,055 14,286 9.8 C#

  The core infrastructure backend (API, database, Docker, etc). (by bitwarden)

  

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• vault-plugin-secrets-onepassword

  4 187 6.2 Go

  Hashicorp Vault plugin integrates with 1Password Connect to allow for the retrieval, creation, and deletion of items stored in 1Password.

  

People thinking this is an absurd amount of money are sleeping on how 1Password is quietly positioning itself to become the ground truth storage solution for corporate secret management, across devops and non-technical groups alike.

Given Hashicorp's market cap of 11B, and 1Password's narrative on how to become even more central to corporate use cases by being the storage layer for Vault deployments, it's a very reasonable leap for them to make!

https://1password.com/secrets/

https://1password.com/secrets/integrations/

https://1password.com/enterprise-password-manager/

• onepassword-operator

  4 504 6.2 Go

  The 1Password Connect Kubernetes Operator provides the ability to integrate Kubernetes Secrets with 1Password. The operator also handles autorestarting deployments when 1Password items are updated.

  

I think you are on the money here. I hadn’t spotted this but they have a k8s plugin for example:

https://github.com/1Password/onepassword-operator

This solves the “restart pods when my secret is updated” issue which suggests to me that they are not just paying lip service with these integrations.

• pass-import

  403 767 8.4 Python

  A pass extension for importing data from most existing password managers

Yeah, GP's acronym ain't great. But if you sub out "wife" for "significant other" or just "family" then you have to admit that this is a real phenomenon.

I use pass [0]. To me, it is the best password manager that I've ever used. Command-line-first, free & open source, built on git... it's great, and suits all my needs. From the perspective of someone who spends most of their day behind a CLI, it is "simple" and "just works" more than anything else.

But it's not going to work for my significant other, who is very intelligent but isn't a software engineer. They're not going to learn git so that they can manage passwords, and the app doesn't abstract away git enough for them to avoid needing learning it. Hence, despite its merits, it fails the "SO acceptance factor" or whatever you want to call it.

[0] https://www.passwordstore.org/

• 1password-linux-to-bitwarden

  5 36 0.0 Go

  Takes a 1Password 8 export (.1pux) & converts it to Bitwarden importable JSON. (Linux / macOS / Windows)

They have been doing some pretty unfriendly moves towards their long-term customers, like making sure the new 1Password cannot be used without 'the cloud' like the old one could be.

I have no doubt raising more VC money will only accelerate such trends.

In fact I've decided to move off of 1Password to BitWarden, since at least one can realistically self-host it. That being said, it's not exactly easy to migrate from the latest 1Password so I wrote my own little utility to do it[1].

I think we need more competition to VC backed products in general, just imagine what would happen if the building blocks of say a GNU/Linux system we take for granted today would've been built with the mindset that investors are going to want a return on their investment.

I am not saying there's anything wrong with that in principle, but am not sure I want to surrender my passwords to these kinds of incentives.

1 - https://github.com/MatejLach/1password-linux-to-bitwarden

• kubernetes-external-secrets

  26 2,584 7.7 JavaScript

  Discontinued Integrate external secret management systems with Kubernetes

  

They probably should merge with https://github.com/external-secrets/kubernetes-external-secr...

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• kubernetes-external-secr

  1 - -

They probably should merge with https://github.com/external-secrets/kubernetes-external-secr...

• MacPass

  4 6,696 4.6 Objective-C

  A native macOS KeePass client

  

Looking around, on macOS there’s also MacPass[0] which looks decent (good enough that I could see myself contributing for the last few % of polish), and gnome-passwordsafe[1] looks reasonable on Linux (if a bit too mobile-y for a desktop app). The only notable hole in the platforms I use is Windows… perhaps it’s time to spin up a WinUI Keepass project.

[0]: https://github.com/MacPass/MacPass

• bitwarden

  103 3,829 9.7 TypeScript

  Discontinued Bitwarden client applications (web, browser extension, desktop, and cli) [Moved to: https://github.com/bitwarden/clients]

  

I wholeheartedly agree with the UX comment, and for the "leveling up security" part specifically, I'll point out that 1P 8 now has a "generate horse-battery-stable 'security question' answers" button, which is about as close to the intersection of good UX and good security as I can imagine

My experience with Bitwarden is that their browser extension is gravely broken, which is a subset of UX, but crosses over into "how is this not a 'stop all work and fix it' bug?": https://github.com/bitwarden/browser/issues/1620

I have a paid Bitwarden subscription, because I wanted to give it a fair shake, but based on my experience thus far it'll be years before they catch up to AgileBits

• infrastructure

  75 390 0.0 Jinja

  The infrastructure monorepo for the Rocky Linux project. This project will be archived/deprecated in the future.

  

> you always are depending on the "good will" of leadership

This isn't true if the product is FOSS. The Mozilla Company can be a disaster, but that's OK because Firefox is OSI-licensed. It will outlive Mozilla, and one or more community forks will appear to replace it, if needs be.

For example, observe how https://rockylinux.org/ rose from the ashes of RHEL/CentOS, after Red Hat were acquired by IBM.

The lesson is that as long as there's interest in an OSS product, there is money to be made servicing (hosting, bug-fixing, whatever) it. Where there is money to be made servicing it, a business will appear to soak up the demand.

> I'd argue this comes after the IPO.

I think it's purely a function of who your shareholders are, what your unit economics are, and how much money you have in the bank. It can happen to any stage of company. In general, contrary to popular HN belief (not saying it's yours), VCs prefer not to put good money after bad.

There are many public companies that are not relentlessly pursuing value optimization, because they have invested in attracting shareholders that are aligned with this idea.

> Without looking at 1Password finances though, even when it was a paid service, we don't know how profitable it was, if at all, and may be going after enterprise customers with this new funding is the only way to not only 'break even' and start making some good profits.

Like you say, we can't comment on 1P directly without knowing access to their Stripe account.

One might charitably say, their business hitherto was an experiment to see if one could build a VC-scale business around the problem of personal password management. The answer is no, but they can leverage their experience gaining that knowledge into solving a similar problem at an enterprise scale. That's probably how the execs & employees think, and it's a very reasonable take.

Unfortunately, while it's optimal for long-term viability of their business, it's not optimal for the consumer world writ large. While 1P has bootstrapped at the consumer's expense and benefit, building a consumer-facing brand for themselves along the way, it is now all downhill for the consumer from here, because they are no longer the focus of the company.

One can imagine a counterfactual, where they had developed their core applications as FOSS. 1P the business could continue to make money as 1P-enterprise, and "the people" could take over maintenance of 1P-consumer, if there was sufficient interest. The valuable experience they've accrued in building their product would continue to spin off value, instead of slowly grinding to a halt.

---

Don't get me wrong, if you put me in the shoes of some exec at 1P with a fiduciary responsibility, I would do the same thing they're doing. It's the only rational direction. Their decision space is/has been heavily constrained by their initial conditions (accepting VC money, not starting with a FOSS product, etc.).

I guess I'm hopeful that people will observe these outcomes, that it may influence their own decisions in choosing the initial conditions of their own projects. Sometimes fiduciary responsibilities contravene social responsibilities, and the superior cure for that circumstance, like with so many others, is prevention.

• vaultwarden

  489 32,770 8.9 Rust

  Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs

Bitwarden is a bit of a pain to self-host, it's built for a much bigger scale. Vaultwarden is a simpler solution, and is compatible with the Bitwarden apps. For a handful of users it is worth a look: https://github.com/dani-garcia/vaultwarden

Suggest a related project