1Password vs. Bugcrowd vs. HackerOne

1Password is a great tool when it comes to data security and managing your passwords. It is perfect for daily work that requires accessing a lot of different login credentials to different softwares, servers etc., so it is a great tool for all web developers and programmers, but also to project managers and other employees that have to login to multiple different services regularly.

Incentivized

Bugcrowd is great for bug bounty programs and as a cheaper alternative to a full-blown penetration test. Small to medium-sized companies who are serious about security, but don't have the budget for a $40,000 penetration test, this is a great solution. Bugcrowd isn't going to be able to do much of the white-box penetration testing (code reviews), as they are more suited for grey-box and black-box. A program like this will need at least one dedicated person to work with the moderator, verify findings, and decide on the severity of the finding.

Incentivized

It is one of the good platforms for security researchers to submit bugs and other vulnerabilities, it however, has some challenges, in terms of un-verified and duplicate submissions.

Incentivized

• Convenient secure access to my passwords anywhere.
• Auto-generates secure long random passwords I would never be able to remember with so many I have to keep track of.
• It's a small thing, but the numbers and punctuation are shown in different colors so you never need to wonder if it's a zero or a capital O.
• Keywords let me organize my passwords however I want, by client, by function, whatever, the choice is up to me.
• A handy place to keep contacts and all kinds of other data besides just passwords. Can add any fields I want, even attach files in the secure vault.

Incentivized

• Having a pool of security researchers helps keep the penetration tests broad, getting the most bang for your buck.
• The integration with Slack makes it easy to keep tabs on the program and when new findings are submitted.
• The interface is pretty simple to use and fairly intuitive.

Incentivized

• Filter for spammy bug reports
• Nice central interface
• Payment/reward system is nice

Incentivized

• 1Password is so secure, that it lacks a self-managed "forget your password" functionality which means that as a manager, I have to approve password resets which may slow down some users.
• On Chrome, the extension sometimes stops working when the browser is updated.

Incentivized

• The success of your program highly depends on the moderator that is assigned to your project. A good moderator will continue to find researchers until the quota is full. Less than stellar moderators will send out one invite and sees what sticks.
• Not all researchers are as professional as one might hope. This can ruin the experience.

Incentivized

• A lot of duplicate bugs get reported, although it does offer automatic suggestion of previously reported bugs that may be duplicates, it is far from perfect.
• Anyone can report bugs, a lot of them are not verified before submission. This sometimes leads to a lot of time spent in verifying if the bug is really actionable.
• Each submission has to be treated with equal potential, a lot of time, some time gets invested in vulnerabilities that aren't as important as some others.

Incentivized

1Password is a great password manager and it helps us a lot in our every day duties at the company. Since implementing this solution we also feel way more secure when it comes to our own data or the data of our Clients.

Incentivized

The 1Password app design is top notch, much better than a couple other password managers I've looked at. The app and service are very flexible, allowing for many different types of data storage. The browser extensions generally work very well, allowing for easy access to login information while using pretty much any modern web browser.

Incentivized

I have never had any issues with 1Password and they have always been able to answer my questions adequately resolve my issues. Furthermore, they have a robust peer forum that can be accessed. They have helpful "Get to know Apps", videos and many articles to assist in the process of using the product.

Incentivized

1Password and LastPass are presently quite comparable in terms of the feature set they offer to their users. Unfortunately, it is their pricing models that differ, and is the only reason we felt the need to switch to LastPass from 1Password. LastPass simply offered better pricing for their business tier k(cheaper by $1/user/month.)

Incentivized

Budget was ultimately the reason we went with Bugcrowd initially. Bugcrowd allowed for us to come up with our own bounty scale to fit out budget. Most other companies had a fixed scale, or the scale was not as flexible as we wanted it. Traditional penetration testing companies were very expensive.

Incentivized

These were very close and we liked HackerOne better. For a time we did have both and we felt the need to consolidate the information into one platform and end of life our internal offering. Overall we've been fairly happy with HackerOne.

Incentivized

• It saves time, and time is a very expensive resource.
• The account details and the sensitive business information in safe behind the 1Password encoding, while staying accessible to stakeholders
• The password generation is a secure and quick way to help employees register new services on their own.

Incentivized

• We have received some great results for a great price. We've also received some poor results at the same price.
• Bugcrowd is not always recognized as a "real" penetration test, but for the most part, we have not had any problems with customer accepting our reports.
• Overall, Bugcrowd has been an overall good experience, but we have had a poor moderator from time-to-time that has resulted in less than ideal results.

Incentivized

• Bugs that can't be tracked internally are submitted by external researchers, which is an important factor for security vulnerabilities.
• Even if the bugs reported are duplicates, there still is provision to award reputation points, that keep the researchers engaged.
• It also requires a lot of verification and validation, as a lot of the submissions are unverified to begin with.

Incentivized