I recently switched from 1Password to Vaultwarden and decided to manually migrate each of my entries rather than moving everything over with an export file. The primary motivation for this was to perform an audit of all of my accounts — ensuring I had a good baseline level of security for my logins.

I’m, by no means, an expert in security, but think I have a pretty decent understanding of how to secure my accounts. If you haven’t taken the time to improve this component of your digital life, here are some suggestions of what you could do on that front.

1. Use a Password Manager — This will have the biggest impact on the security of your accounts. And although it seems pretty obvious, it’s worth mentioning on the off-chance anyone reading this isn’t already using one. With a password manager, you’ll just have to remember your master password and then you can let it do most of the heavy lifting for you — it can generate randomized passwords, store credentials, automatically fill in login details using a browser extension or system-level integration on mobile, and more. You can use Bitwarden or Proton Pass which offer free plans, self-host with Vaultwarden, or go with something like 1Password. But you should at least be using something.
2. Consider Deleting Accounts — If you still have an account for a service that you no longer use and are unlikely to ever return to, it’s probably a good idea to just to delete the account. As long as you’re already using a password manager with randomized passwords — you’re not re-using passwords — you don’t have to worry about the service having a security incident that puts your other accounts at risk. That’s not what deleting the account is about. Instead, you’re reducing the exposure of your email address and any other personal details that the service may have about you.
3. Update Account Email Addresses — If you’ve switched email addresses over the years, you may have some old accounts that are associated with an email addresses that you no longer have access to or simply don’t want to use anymore. In my case, I used to use Gmail and eventually migrated to using an email address with my own domain through Fastmail. Even though I have Gmail setup to forward messages to my current email address, I’d prefer to no longer use Gmail at all. So for any account that still uses Gmail, I’m slowly switching the associated email address to my current one.
4. Enable Two Factor Authentication for Accounts — If you’re using a password manager, it may very well offer a reports-type feature that will list all of the accounts you have that support two factor authentication where it doesn’t appear to be enabled. Vaultwarden and 1Password both offer this, for sure. Two factor adds an additional layer of security to each of your accounts, which will help prevent malicious actors from gaining access, even if your password becomes compromised.
5. Improve Weak Passwords — Another item that your password manager should be able to help with. Ensure you’re using sufficiently strong passwords to prevent brute force attacks.
6. Check for Missing Backup Codes — If you have an account with two factor authentication enabled, the service most likely offers backup codes that can be used in case you lose access to your authentication app. If you don’t have these backup codes saved, you risk getting locked out of your account.
7. Store Backup Codes Outside of Your Password Manager — It’s easy to drop these codes into the notes section of your password manager, but it’s much better to store them in a separate location. You could save them on a thumb drive and/or print a physical copy and keep those items in a fireproof safe. Perhaps even in a safe at a close friend or family member’s house. Just make sure they aren’t exclusively stored in the same place as where you’re generating two factor authentication codes, which would give you a single point of failure.
8. Move Two Factor Authentication to a Separate App — I recently polled my followers on Mastodon and the plurality of respondents just use their password manager to generate two factor codes. It is much more convenient and most password managers offer the feature. But it does come at the cost of some security. If you want to go above and beyond in securing your accounts, you can generate your two factor authentication codes using a separate app. I’ve heard good things about Ente Auth and 2FAS — if you wanted to go down this route, I’d start with one of those.
9. Setup an Emergency Plan — How could you ensure that someone else had access to your accounts if something happened to you? It’s not pleasant to think about, but it’s something that has to be considered at some point. Bitwarden offers an Emergency Access feature for just these circumstances, but another option would be to share the login credentials of your password manager with your spouse or a family member that you can trust.
10. Consider a Backup Solution — This is more applicable for those that are self-hosting their passwords and less relevant for cloud-based solutions. But may be worth the trouble if you wanted to prepare for the unknown. I don’t have any specific recommendations for how to store those backups, but taking into consideration the 3-2-1 backup guidelines — three copies, two different storage media, one being offsite — is a good start. And given how sensitive the data is, be sure the backups are encrypted. Your password may offer the option to encrypt an export file or you could encrypt it yourself with another tool — Bitwarden has some information about this that may be useful.

I’ve been on a bit of a tear recently, switching to new apps and services. What triggered this recent stint was the upcoming renewal of my Cloudron subscription. I was on their Premium plan, which costs $180 per year. If I was running a business or had more demanding needs, I suppose I could justify the expense. But with how I use the server, it felt like it was a little much.

Cloudron does offer a free plan, but with some limitations ­— the only one that would impact me is that it’s limited to two apps installed at a time. When I started exploring alternatives, I only had five apps installed and I was pretty confident I could get it down to just two — Mastodon and Pixelfed — without much trouble.

With the help of my Umbrel Home, which is an excellent home server solution, and its integration with Cloudflare Tunnels, I was able to downgrade to Cloudron’s free tier fairly easily. The following are the migrations I made that allowed me to do so:

Homer to Heimdall

Homer is handsome selfhosted dashboard. And it’s a great option if you want something that’s static, but it becomes tedious to manage if you’re adding or removing services on a regular basis.

Homer doesn’t offer a slick frontend for managing anything, it’s setup through configuration files. So if you want to add or remove a service, you have to grab your existing configuration file over FTP or the like, fire up a text editor, add or remove as necessary, and then upload the new configuration file.

Heimdall, on the other hand, can be configured right from your web browser and even offers support for a number of self-hosted services. No need to hunt down an image to use for each link’s icon, there’s a good chance Heimdall already includes one.

Heimdall also offers built-in authentication, which is nice for dashboards that are accessible on the open web.

The biggest downside with Heimdall is that the default design is a little rough. But luckily, it has support for custom CSS, which can be used to customize the design to your heart’s content.

Miniflux to FreshRSS

I’ve used FreshRSS in the past and actually migrated to Miniflux from it because I was experiencing some issues with feed refreshes. After spending a bit of time with both, I probably prefer Miniflux.

In order to downgrade my Cloudron subscription to free, though, I needed to get down to just two apps — I had to make some cuts. So I decided to simply move from Miniflux on my Cloudron to FreshRSS on my Umbrel.

Although I prefer Miniflux, I don’t actually spend much time in the web interface. Instead, I’m using it as a backend to sync RSS apps on my devices — Reeder Classic on iOS, NetNewsWire on macOS, and NewsFlash on Linux.

Wallabag to Linkwarden

Wallabag worked quite well for what it did — saving links for later. But the design feels incredibly dated, regardless of what theme you choose for it. In contrast, Linkwarden is a relatively new project and sports a refreshingly modern design.

Linkwarden also offers some features that Wallabag doesn’t, most notably the ability to save archived versions of webpages in a number of formats — screenshot, PDF, Archive.org snapshot, and more. I have mine setup to save an HTML copy of each webpage I save to it.

There is already a browser extension available for Linkwarden and the project’s developers are also working on a mobile app. For now I’m using a third-party client — My Links. The app has some occasional visual bugs that I’ve noticed, but it’s a fairly competent client and it’s better than the options available for Wallabag.

Non-Cloudron Migrations

Those three migrations got me down to just two apps on my Cloudron, which allowed me to cancel Cloudron Premium and downgrade to their free plan. That extra $180 each year would be better spent on additional payments toward our mortgage principal or something.

I will say, Cloudron is an excellent piece of software, though. And I would have continued paying for their Premium subscription if I had a need for more apps on a virtual private server. It does such a great job of simplifying the installation and management of selfhosted software.

While I was in the process of exploring alternatives to my Cloudron apps, I also found myself looking at other software I was using and whether I could make some switches there as well. I ended up making the following migrations:

iCloud to Dropbox for Ulysses

Every time I’ve tried to fully lean in to Linux and utilize apps and services that I could use seamlessly between my iPhone and Linux machine, Ulysses was a massive blocker. The app is just absolutely incredible to use and I’ve built my entire writing and publishing system around it.

I’ve tried dozens of other writing apps, but nothing was able to match the fit and finish of Ulysses.

The solution I came to is actually quite elegant, though. Rather than moving off of Ulysses entirely, I would simply swap out the backend service I was relying on for sync. For years I was just using iCloud — it’s the default for Ulysses and worked like a charm.

Ulysses offers native Dropbox support, though. What I’ve done is move all of my existing writing to Dropbox as markdown files. I can create new documents and edit them from Ulysses just as I’ve always done, but I can also access them from my Linux desktop using Dropbox’s desktop app.

This piece you’re reading right now was primarily written in Apostrophe on my Framework 13 and then edited on my iPad in Ulysses. The sync was just as smooth as it was when using iCloud, but I can access and edit from all of my devices now, not just those that were manufactured by Apple.

This will also, hopefully, make it easier to migrate away from Ulysses if the need were to ever arise. As long as the app I’m moving to supports syncing to Dropbox.

iCloud to Dropbox for File Storage

After migrating to Dropbox for my writing, I was pretty impressed with the service. I thought it was worth giving it a try as a cloud storage provider, in place of iCloud.

Dropbox offers 2GB of storage on their free plan, but I must have acquired some additional storage on my account back when you could do so through referrals. My account has 3GB of storage available on it, which is more than enough for my needs.

I migrated everything from my iCloud Drive’s Documents folder to Dropbox and haven’t looked back. What’s nice about using Dropbox is that it offers excellent integration on iOS and Linux. I can favorite a folder for quick access in the iOS Files app and bookmark that same folder in Gnome’s Files app on my Framework laptop.

There is a limitation of three devices connected to your Dropbox account, but that only applies to their application. The Ulysses integration I mentioned above and any other third-party integration does not count toward that limit.

Luckily, three devices is plenty for me — I can have my iPhone, iPad, and Framework laptop connected.

1Password to Vaultwarden

Switching password managers was, by far, the most daunting migration I made. Access to every account I have relies on a password manager. It needs to be secure while maintaining ease of use to ensure it gets utilized effectively.

I’ve tried Vaultwarden in the past, but ended up bailing on it because I wasn’t ready to tackle migrating myself and my wife, Becky, to a new password manager. We had a shared vault in 1Password with a bunch of passwords that we both need access to. Migrating myself is a big enough task, migrating both of us is even larger.

But this time, I decided to buckle down and just make it happen.

I could have exported my login credentials from 1Password and imported them into Vaultwarden, but instead, I chose to migrate each login individually. This gave me an opportunity to prune some accounts, update some account email addresses, and just generally audit the whole lot.

An unintended consequence of migrating my data in this way is that I became much more comfortable with the software. Something that wouldn’t have occurred if I just did a normal import from 1Password.

After the migration was complete, I ended up with about 12% less logins than I started out with — some of those were eliminated because the service had closed down and some of those were accounts I deleted myself.

I was able to cancel our 1Password subscription, saving us $60 each year, and I’m pretty happy with the whole setup. Since Vaultwarden is the selfhosted version of Bitwarden, we’re able to make use of their great suite of client applications. We have the Bitwarden browser extension and desktop app on all of our computers and the Bitwarden mobile app on our iPhones.

The design of Vaultwarden/Bitwarden overall isn’t quite as nice as 1Password, but it’s not that much of a dropoff. The overwhelming majority of the time we’re interacting with the software through AutoFill on our iOS or the Autofill feature of the browser extension. And those interactions don’t involve much user interface from the app/extension, so it doesn’t feel like much of a change at all — especially on iOS where we only see Bitwarden for a second or two while Face ID authenticates.

Overall I’m very happy we made the move and I’ve even considered opening up our server to close friends and family if they’d like to make use of it as well. Although, I’ll probably want to live with it for a while first, just in case there are any unexpected snags.

David Heinemeier Hansson:

The problem with passkeys is that they’re essentially a halfway house to a password manager, but tied to a specific platform in ways that aren’t obvious to a user at all, and liable to easily leave them unable to access of their accounts. Much the same way that two-factor authentication can do, but worse, since you’re not even aware of it.

Passkeys have become a requirement for logging in to one of our accounts at work and I’m not a fan at all. I have it saved in 1Password, so I can use it across all of my devices. But if there was ever a need for me to login on a device that doesn’t have 1Password installed, I’m not even sure how I would login at all.

I actively avoid enabling passkeys for any of my other accounts, instead opting for strong, randomly generated passwords combined with standard two-factor authentication when available.

➝ Source: world.hey.com

With the introduction of 1Password’s Safari extension, they’ve also discontinued their share sheet extension. This has managed to irritate quite a few users, including myself.

While the Safari extension is great, it doesn’t replace all of the functionality of the previous share sheet extension. Here are a handful of examples off the top of my head:

• No way to auto-fill non-login data in third-party browsers or within a Safari View Controller, such as credit/debit card information.
• Improperly designed login forms don’t work with the system-level auto-fill feature.
• Applications that implemented a 1Password-based auto-fill system using the share sheet, often times using the 1Password logo, display nothing in the share sheet.
• Users that still have iOS 14 installed don’t have access to the new Safari extension, leaving them out in the cold for a lot of auto-fill features, even in Safari.

It’s not great. And to make matters worse, there doesn’t seem to be a good reason for it’s retirement.

Dave Teare, writing about the decision in a comment on Reddit:

Now I can definitely see how you could want us to continue postponing the share sheet’s retirement. We’ve postponed it for a few years already so why not another year or two? We could have done that but maintaining three different features that all serve the same purpose (Password AutoFill, share sheet, and now the new Safari web extension) is a big ask. Something had to give and since the share sheet offers the least functionality that isn’t covered by the other two it was time to bid it adieu.

Okay, fair. But in the previous paragraph he wrote the following:

We did however stop maintaining it as it was becoming quite long in the tooth.

So if they had already stopped maintaining it, the claim that it would require additional work to maintain doesn’t really hold water. The sensible solution would have been to keep the share sheet extension in the app for some period of time alongside the Safari extension and then notifying users of its imminent retirement.

What irritates me the most is the lack of messaging. I had no idea the share sheet extension was even in consideration for retirement. One day I just updated the app and it was gone — it wasn’t even mentioned in the 7.8 release notes. At first, I thought there was some bug in iOS 15 causing the issue because I had updated around the same time it disappeared.

I’ll get used to launching the app and copy and pasting into Firefox, Safari View Controllers, and so on. But if I knew that this was going to be the case before it happened, it would have softened the blow a bit. The takeaway to all developers, if you’re going to be taking functionality away from users, at least let them know in advance.

Jason Snell, writing on Six Colors:

What’s really causing all this consternation, I think, isn’t 1Password moving to Electron. Electron is a bit of a bogeyman. The root problem is this: 1Password, originally a Mac-forward software developer, has simply decided that the Mac isn’t important enough.

I know that those are harsh words, and that the people at AgileBits would argue with them. But in a blog post by Michael Fey, AgileBits’s VP of Engineering for Client Apps, the company laid out its entire development strategy. It’s a post meant to explain what the company is up to and tamp down a lot of angry hot takes (and probably should’ve been posted the moment it announced the Mac beta).

Fey’s post clearly spells out AgileBits’s priorities. Android and iOS apps are built with native platform frameworks in order to create the best app experience possible on mobile. For iOS, AgileBits decided to use Apple’s new SwiftUI framework rather than the venerable UIKit, in order to skate “to where the puck was going.” Their plan was to use SwiftUI on the Mac, too. In doing so, AgileBits was buying into the vision Apple has for SwiftUI as a tool to build interfaces across all of Apple’s platforms. Unfortunately, it seems that SwiftUI didn’t measure up on the Mac

It’s a shame that AgileBits is no longer going to be developing a native 1Password app for Mac. But given the state Apple’s relationship with developers and the rise of Electron usage, it sort of feels like moving to electron actually is “skating to where to puck is going”.

➝ Source: sixcolors.com

I’ve been using Chrome on my work laptop for the past few years. It’s what most of my colleagues use and a sizable portion of the customers I interact with use Chrome too. So I sort-of fell into it.

But I never really loved the idea of using Chrome as my default browser because I don’t like how much power and influence Google has over the web in general. Chrome perpetuates that. Ideally, I would be using something that was developed by anyone else.

Prior to joining Automattic, I was using Safari on macOS, but that’s not a viable option for my work laptop because of browser extension limitations. We have a browser extension that we develop internally that’s vital for my work and it can’t be built for Safari — it’s Chrome- and Firefox-only.

I was a die-hard Firefox user back during my Windows days in the mid-2000s. And truthfully, my heart has always been with Firefox. It’s neck-and-neck with Microsoft Edge for market share and is developed outside of the largest technology companies. It’s always been the underdog and I like rooting for the underdog.

They develop their own browser engine too. Even though I appreciate consistency in the rendering of HTML and CSS, I don’t like that practically every web browser is built on WebKit or Blink. I want a viable alternative. And a viable alternative developed by someone outside of The Big Five.

My setup is pretty customized with browser extensions, bookmarks, and whatnot. And just about my entire workday is in a web browser, so making the switch is pretty serious business. I need everything to be reliable and just work.

There were some quirks to start, but after some customizations, add-ons, settings changes, and hacks, I’m falling in love with Firefox all over again.

I’m using the MacOS – Safari (Big Sur) – Light theme, which gives the browser a delightfully light feel without sacrificing too much contrast in the tabs bar. Aside from the Automattic-developed internal tool, I also use the following browser extensions:

• 1Password: My current password manager of choice, which recently added support for Touch ID.
• Firefox Multi-Account Containers: This helps keep browsing of selected domains separate from the rest. I currently have containers for Facebook and Amazon, but plan to add one for Google as well.
• Load Progress Bar: Displays a progress bar along the top of the webpage when loading. I have it configured with a blue bar for normal windows and a purple one for private windows.
• RSSPreview: I wish every browser on the market offered RSS feed previews, but unfortunately that isn’t the case.
• Stylus: Allows me to add custom stylesheets for specific websites. At the moment it’s only used to make some adjustments to internal Automattic tools and communication channels.
• Tampermonkey: Let’s you run custom scripts for specific websites. Only currently used to customize the functionality of internal Automattic tools.
• Translate Web Pages: Chrome had this feature built-in, but on Firefox it requires an extension. I’ve tried a handful and this seems like the best one.
• Wallabagger: I recently switched to Wallabag, a read later service with a self-hosted option. This extension lets me quickly save links to it.

Firefox also offers some more obscure settings through the Configuration Editor, accessible with about:config in the address bar. I feel like I’ve made a handful of adjustments there, but the only one that jumps out to me as crucial is setting browser.urlbar.trimURLs to false. This prevents Firefox from hiding the protocol portion of the URL in the address bar.

But the customization doesn’t stop there, Firefox offers even more options through a custom stylesheet file named userChrome.css that you can add to a specific location within your profile folder.

I’m not too fond of the new design of tabs in Firefox, which was introduced in version 89. But userChrome.org has a tool that can generate a CSS snippet to add to userChrome.css and customize the look of tabs. I set mine to no tab corner rounding, connect the tabs to the toolbar, use compact height, and using a vertical bar.

Another annoyance was the lack of visual distinction between private browsing windows and regular browsing windows. But I was able to find a userChrome.css snippet on Reddit that changes the background color of the tab bar to purple in private browsing windows. I use private windows frequently for work-related tasks and this helps ensure I won’t get my windows mixed up.

And lastly, I added the following in userChrome.css to hide the action buttons that appear on the right-hand side of the browser address bar:

/* Hide page actions buttons in URL bar */
#page-action-buttons { display: none !important;}

I don’t find those buttons to be particularly useful. And the ones built-in to Firefox and added through my collection of extensions were accessible in other ways. I would rather just have the clean URL bar.

I’m so happy to be using a browser that offers a deep level of customizability again. And one that’s developed by a company that shares my enthusiasm for a free and open web. It’s far more important than most of us realize and I hope there’s a lot more effort aiming in that direction in the future. From more than just Mozilla.

I’d really like to continue using Firefox on iOS, even though the experience is far from perfect. But the existence of browser extensions in Safari is just too darn appealing. I’ll probably switch back to Safari once I’m running iOS/iPadOS 15.

In an ideal world, though, Apple would offer a level playing field to third-party developers, letting them offer extensions too.

➝ Source: macrumors.com

As I mentioned in my recent MacBook Air review, I’ve spent a lot more time on macOS over the past handful of months. I still use my iPad Air 2 as my primary machine for personal use, but I do just about all of my work as a Happiness Engineer on macOS.

Since I’ve already shared my thoughts about the new hardware, I wanted to speak a bit about the software I’ve been using. I won’t be covering everything today, instead focusing on the Menu Bar apps that I have installed — whether they’re a crucial part of my workflow or something I’m currently testing.

Aside from the standard Wi-Fi, Sound, Battery, Time, Siri, Spotlight, Time Machine, and Bluetooth icons, I have the following applications in my Menu Bar:

• Alfred: I’m basically incapable of functioning on a Mac without this app installed. I think Merlin Mann is to blame for that. All of his coverage of Quicksilver after I first purchased a MacBook in 2006 has ingrained into my brain that ctrl+space is my go-to keyboard shortcut when I want to do, basically, anything on my Mac. I use it for launching applications, opening files, and searching the web. I have nearly two dozen custom web searches setup that allow me to quickly access Automattic’s internal tools and documentation while I work. It allows me to be productive and efficient in a way that no other application has.
• Droplr: I share a lot of screenshots and GIFs during my time working with WordPress.com users and Droplr is the best app I’ve found for sharing these files. I usually use macOS’ built-in keyboard shortcuts for taking the screenshots, then I can drop them on to Droplr’s icon in the Menu Bar to share them. The app uploads the file, opens it in my web browser, and automatically adds a URL I can share to my clipboard. If I need to markup or annotate a file, I can do so with its built-in tools and the app even has the ability to record a GIF of a specific portion of my screen, which I can use for illustrating more complicated, multi-step tasks.
• TextExpander: While, I’ve only just scratched the surface of the efficiency and productivity gains that this application allows for, this is another essential application for me. Since I do a lot of typing throughout the day, I use TextExpander to automatically expand small bits of text into larger snippets that I find myself typing frequently. I only have about three snippets that I use regularly, but I plan to grow that list over time as each one becomes fully integrated into my workflows — there’s no sense in adding a bunch of snippets only to realize that you don’t remember or use most of them.
• Hocus Focus: This application automatically hides other app windows after they’ve been inactive for a period of time. It helps keep my screen clear of clutter and allows me to focus on the task at hand. I’ve only used the app for a few weeks, but I like it quite a bit so far. I have non-active apps set to hide after two minutes and only disable the feature when I’m on video chats with other members of my team.
• Bartender: A simple little application that let’s me hide the majority of my Menu Bar apps behind an ellipses icon. This is especially useful when I’m working on my Air’s 13-inch display, since it keeps my menu bar icons from overtaking my screen. I have it setup to hide everything except the applications and system status indicators that I use most — Droplr, Wi-Fi, Sound, and Time.
• Moom: This is an app that I’m still testing at the moment. It allows you to reorganize, resize, and reposition your application windows with the ability to save these as presets that can trigger with a keyboard shortcut or when you connect or disconnect an external display. Since I often switch throughout the day between my external LG UltraFine 5K display and the MacBook Air’s built-in display, I suspect this will become an essential app for me once I have the time to configure it for all my apps.
• Backblaze: I started using Backblaze as one of my backup solutions a few months ago. I still use Time Machine with an external drive, but since I use my MacBook Air portably a lot, I don’t have it connected most of the time. Backblaze helps to fill in those gaps for me by continuously backing up my machine, as long as I have an internet connection.
• 1Password: This is my favorite password manager by far and I use it on all of my devices. It’s thoughtfully designed, incredibly powerful, easy to use, and let’s me share passwords with my wife through our family account. If you aren’t using a password manager, I highly recommend giving this one a try.
• Turbo Boost Switcher Pro: This little utility app allows me to enable and/or disable Turbo Boost on my MacBook Air, primarily as a way to increase battery life. This is another application that I haven’t spent much time actually testing, but I expect it will be invaluable when I’m traveling.

I have to say, I’ve had a lot of fun finding and testing applications for the Mac over the last handful of months. Although I never exactly “abandoned” the platform entirely, I certainly haven’t paid as much attention to the new software and tools that have been released over the last couple of years. So if there are better options to fill the roles of the apps listed above or you have a recommendation for an app I might be interested, don’t hesitate to reach out on Twitter. I’m always on the look out for the latest and greatest software.