Roboform, crippling the export function and Bits Du Jour censorship

[Steven Avery]

Hi Folks,

Siber Systems from Roboform has done some things that made former customers a bit unhappy, where they felt that the terms of the purchase and licensing was unilaterally changed.  We have discussed that here on some threads. This is not directly about any of that.

====================

With two recent Bits specials, I read up on Roboform issues and found out that, at a time that people were concerned about licensing changes, Siber changed the export function in 6.10 and 7.  Apparently their export function is "Print-to-HTML" and they shortened the url. Which would be fine as an "option" but since the "Print-to-HTML" is their export facility it acts to cripple the export.  ie. If another password program imports the HTML, you then have to change all the urls by hand. For this reason, you will find lots of discussion of Roboform customers actually trying to reload earlier versions of Roboform in order to have a proper export function.

And I asked about this on Bits and got a developer response that was unacceptable, and from that point on, Bits threw out two of my comments and placed my posts on moderation.  (I have purchased in the past many items with them and made many comments.) It really seems like Bits, which used to have a reputation of allowing tuff questions, is now going milquetoast "protectia" for clients.

Note also that there has been an increase of what seem to be shill and social media type "rah-rah" posts from a number of vendors. (I don't blame that on Bits directly but it has weakened the whole concept.)

On the Siber issue, I managed to place a post in the little-read Bits forum (if you can see it):

Bits Du Jour
Siber-Roboform and the ethics of crippling an export function.
http://www.bitsdujour.com/view/id=18437/

From this experience, my former enthusiasm for Bits has been greatly dampened.  Little reason to get involved in discussion (except for maybe the rare situation such as helping with Linkman discussion) and purchases now considered largely done.

Steven

[Steven Avery]

Hi,

To show you the changes in Bits, this is the post on the current thread that was censored:

RoboForm2Go v7
http://www.bitsdujour.com/software/roboform2go-v7/

=====================================================

Hi,

Danny -  Top Ten Reviews is not considered reliable, since their operation is based on trying to make commissions on sales. Free software and services are ignored.  As an example, LastPass is listed as at a minimum of $12 per year, but that is only the Premium service, many use the free service.

Siber - does this Roboform have a complete export facility of all the password data, including the full url ?

Steven

=====================================================

UPDATE:  After a long wait, possibly just their sleeping, this was approved, so we can watch for the Siber response.

=====================================================

Based on such a post being censored, it is clear that Bits Du Jour will now suppress flaws and factual corrections and ethical concerns.  btw, Siber's other main program is GoodSync.

Caveat emptor.

=====================================================

NET HISTORY

The About.com article by  Sandra Grauschopf was very helpful.

Mixed Reactions to Roboform's Version 7 Upgrade
http://contests.about.com/b/2011/03/24/roboform-users-react-angrily-to-version-7-upgrade.htm

Comment
"Version 6.9 allowed you to export your logins, passwords and URLs for import into other password applications but version 6.10 will not let you export the URL any more "

Lastpass explaining work-around
http://helpdesk.lastpass.com/getting-started/importing-from-roboform/

"Siber Systems has changed the export process in the newest version of Roboform - version 7 does not include the option to export your logins with the full site URL. Although you will still be able to export your passcards, they will not be imported to LastPass correctly. Without the full URL of the site, LastPass doesn't know where the login fields are, and autofill will likely be dysfunctional. In order to export with the full URL, you'll have to downgrade to version six."

Since LastPass is a competitor, they are being cordial and explaining this in a matter-of-fact way.  It is the customers and potential customers that tell Siber that with these types of shenanigans they can not be considered an ethical company.

Oh, here is the main part of the "explanation" from Siber for crippling the export.  They mangle the concepts of a print function and an export function to make excuses.

"There was a print list function in 6.9 that printed the entire login URL. Some users used this function as a quasi export function. We received numerous complaints from our users that the Print List function needed to improve, because when users printed their list of Logins, they wasted a ton of paper, and the formatting wasn't great because the login URLs were too long. So we changed the function from printing the full URL to printing the base URL. That's the only change we made. ....We made a change that was based on user feedback. We understand that not all users use our software the same exact way. It's one of the challenges of creating software. What is good for most users may not be good for all users. In this case the majority of our users like the changes, but we have not yet been able to satisfy all users."

Of course, if they wanted an option to print with a shorter url, it would have been trivially easy to give that as a configuration or run-time option.  So the above is all smoke and mirrors.  

=====================================================

btw... currently I use LastPass for passwords, aware that they had security hits a while back and happy to change if seems appropriate (they are very good on ease of use, they seem so far to be simpler in real world usage than Keepass, a major alternative.). And I do not use a sync program, not even Dropbox, I simply occasionally copy to the cloud, since most of my work is on one puter.

Steven

[cyberdiva]

Hi, Steven.  Thanks for posting this frustrating exchange between you and Roboform.  It makes me glad that I switched to LastPass some time ago, even though I already had a license for RF's desktop version 7.  I have one question about what you said re security hits on LastPass.  I only recall one, and if I remember correctly (always a question  ), no info was compromised, but LastPass nonetheless immediately notified users about the hit and advised changing the master password.  I remember doing so then.  Have there been more hits? 

[edbro]

I own a worthless "lifetime license" for Roboform. Of course they reneged on that promise. I would never give them a cent of my money in the future. I welcome opportunities like this to point out that they are liars.

[Steven Avery]

Hi cyberdiva,

I was not sure if there was one hit or two over the years, so probably one.  However, you are right that it seems they handled it pretty well, and there were no known heavy-duty repercussions.  Plus, I would expect they tightened their insides since then.  I started using them later.

Like you, I am using LastPass.  I find their interface and information very intuitive, helpful and unobstrusive, all at the same time. Conceptually I was ready to put them up against Keepass, but Keepass seems to make you do much more to actually place in, use and remember the pages properly.

Steven

[40hz]

@Steven - not so much "seems" as does make you do a lot more.  I use Keypass and it's Linux cousin. And you are absolutely correct. Getting auto entry to work is a fiddly exercise at best. And occasionally it's also study in frustration since it sometimes "just won't work" with some websites, no matter what you do.

That said, I still prefer it I over anything that stores passwords to somebody else's servers. But I'm the " wears suspenders AND a belt" type when it comes to passwords.

[Steven Avery]

Hi,

yes, I understand 40hz.  For that reason, I may try Keepass again, I load it up all the time but with blank data !

===============

Here is my current post on Bits ! I do not know if it will get posted or not, due to the activation of the moderation queue.

====================

Bits Du Jour - Roboform 2Go
http://www.bitsdujour.com/software/roboform2go-v7/

====================
Hi,

Michelle, your answer is puzzling.

Basically,  I really do not think you understand the difference between a print function (designed to show you what data you have in a visual fashion on the screen or on a printed page) and a data export-->import function. 

There is simply no concern on a data export-->import function as to print formatting or being too long on a page, since it is raw data (cvs .html .txt .sql etc).  In many cases, the data is never viewed at all, it is simply used directly for import.

And many people using the export function ended up trying to reload earlier versions of Roboform in order to have the real function needed.

So, I put more information on this on a Donationcoder thread as well as in a post on the lightly-used Bits forum.  (Suggestion: highlight the fact of the forum far more clearly on the front Bits pages... bold, color etc.)

Michelle, it is true that you already gave me an answer of sorts from your tech support people.  So there is no need for me to ask them again, unless they plan to put in a proper export function.  From what you say, it is clear that Siber-Roboform simply has no plans to restore the full export function, which they had for many years.  And that was my question here.

Personally, without a full export function, the program is not of interest to me. Since I may end up with 100 or 200 entries. In which every single one needs modification if I try to use my data anywhere but Roboform. This goes against all philosophies of system and data openness and transparency, and my control of the data I generate.  (Understanding that you need your master password to do any export anyway.)

Thanks for trying, Michelle, anyway.  I realize that software companies often put their public-front PR people in a difficult position, so there is no antagonism meant towards you at all.  

Steven

====================

Since it is on a queue, I can not add a note saying that she (as PR-customer service) may not understand how trivial it is to have two alternate print-display outputs.

====================

[rjbull]

I upgraded to RoboForm 7 for its convenience, but, like others on DC, I always start from KeePass.  That way I always have a free, portable system that I can export from if necessary.  Quite a few plugins are available for extra convenience and form-filling with KeePass.

Is KeYpass a typo for KeePass, or a different program?

[Steven Avery]

typo

[Curt]

regarding the censo... ehh moderation on Bits, please always check who is answering the questions > The one answering is usually the one moderating. Today the censor is Siber, not Bits. There is only little reason to accuse Bits du Jour in this case; it is theoretical always better for the customers, to have the author commenting (and therefor also moderating) than the seller (Bits). Bits' own censorship is still quite moderate.

[40hz]

Here is my current post on Bits ! I do not know if it will get posted or not, due to the activation of the moderation queue

@Steve - I'm betting that post is not going to run 'as is' - assuming it runs at all.

-------

FWIW Amazon allows something similar. I posted a detailed and (in places) negative review of a popular tech book, which was later taken down at the request of the author. Had the same thing happen to my somewhat critical review of the book The 30$ Film School.

I gather this sort of thing happens more often than we'd expect.

[40hz]

always check who is answering the questions > The one answering is usually the one moderating. Today the censor is Siber, not Bits. There is only little reason to accuse Bits du Jour in this case

Very true. But in all fairness to Steve, when somebody posts on a website, there is a presumption they either are the site owners; or are being allowed to speak on behalf of the site owners.

So unless a conspicuous disclaimer is posted, it would be easy for somebody not to know that. Or to realize that the "moderating" was being performed by anyone other than the site ownership.

[tomos]

FWIW Amazon allows something similar. I posted a detailed and (in places) negative review of a popular tech book, which was later taken down at the request of the author. Had the same thing happen to my somewhat critical review of the book The 30$ Film School.

I gather this sort of thing happens more often than we'd expect.

I'm a bit gobsmacked about that - that's worthy of it's own thread imo...

[TaoPhoenix]

FWIW Amazon allows something similar. I posted a detailed and (in places) negative review of a popular tech book, which was later taken down at the request of the author. Had the same thing happen to my somewhat critical review of the book The 30$ Film School.

I gather this sort of thing happens more often than we'd expect.

I'm a bit gobsmacked about that - that's worthy of it's own thread imo...

It already has a thread - the one about the meaning of User reviews. If all the bad ones get taken down...

[tomos]

FWIW Amazon allows something similar. I posted a detailed and (in places) negative review of a popular tech book, which was later taken down at the request of the author. Had the same thing happen to my somewhat critical review of the book The 30$ Film School.

I gather this sort of thing happens more often than we'd expect.

I'm a bit gobsmacked about that - that's worthy of it's own thread imo...

It already has a thread - the one about the meaning of User reviews. If all the bad ones get taken down...

well, there would suit too - there's two amazon comments threads AFAIK, but both those threads are about reviews being paid for. I havent heard of reviews being censored...

[cyberdiva]

there's two amazon comments threads AFAIK, but both those threads are about reviews being paid for. I havent heard of reviews being censored...

I too am astonished to hear that a negative review by 40hz was taken down on Amazon at the request of the book's author.  What possible justification could there be?  Yes, I'm aware that some positive reviews are paid for, and some negative reviews are concocted by competitors, but Amazon's agreeing to remove a presumably knowledgeable review boggles what's left of my mind.

[40hz]

there's two amazon comments threads AFAIK, but both those threads are about reviews being paid for. I havent heard of reviews being censored...

I too am astonished to hear that a negative review by 40hz was taken down on Amazon at the request of the book's author.  What possible justification could there be?  Yes, I'm aware that some positive reviews are paid for, and some negative reviews are concocted by competitors, but Amazon's agreeing to remove a presumably knowledgeable review boggles what's left of my mind.

(Correction: it was the film school book rather than the tech book review that was taken down by request.)

I had strongly suggested that the author might have spent less time being so self-righteous and spent more time focused on his main topic. I'm guessing that that part was protested as a personal attack of some sort - which is something I later learned (from an acquaintance who sells through Amazon) could get a review taken down. I tried to get it clarified what had happened. But all I got back from Amazon was that it was removed by request. [Note: If I still have a copy of that e-mail (extremely doubtful since it was around 2004/5) I'll post it.]

As to why the tech book review disappeared, I have no idea. It was a critical review, but no more strongly worded than anything else I've seen up  there. However, one day it was there. Then, a few weeks later, it wasn't.

Note too that this all happened some years ago, before any of this user review stuff was taken that seriously. So there may have been other policies or practices in effect at the time. I think you now need to actually buy the product from Amazon before you're allowed to review it. There was a time when you didn't. All they did back then was include an indicator as to whether or not you were a 'confirmed' (i.e. you bought it from Amazon) owner of the product.

Either way, I haven't written an Amazon review or given a rating on anything I've bought from them since. Nowadays, I just shop there because I like their service and selection.

[TaoPhoenix]

"There was a time when you didn't."

I think that's correct. I reviewed an item on Amazon years ago before I had worked out my web strategy of staying mostly below the radar while learning the ropes.

[cyberdiva]

I think you now need to actually buy the product from Amazon before you're allowed to review it. There was a time when you didn't.

Hmmm....I'm under the impression that you still do not have to have bought the product from Amazon to post a review.  I've looked at a number of different products on Amazon lately, and I recall seeing reviews that specified other places where the writer bought the product he or she was reviewing.

[40hz]

I became curious enough that I decided to Google using "Amazon remove negative reviews" and found some discussions over at Amazon about events similar to what I experienced.

One post from 2008 described an experience virtually identical to mine where another reviewer ran afoul of the same unpublished review guideline:

It's a little long...

In reply to an earlier post on Jul 15, 2008 4:15:36 PM PDT
Last edited by the author on Jul 15, 2008 4:18:12 PM PDT

gentle as a daisy says:

No one should doubt by now that Amazon won't hesitate to remove a negative review, but here's some more evidence (that has the kind of irrational quality that has characterized most of my dealings with Amazon):

- I posted a negative review that was removed, apparently upon complaint by the author of the book I reviewed

- Amazon's explanation was that:
"Our guidelines do not allow discussions that criticize authors or their intentions."

Wow! That knocked my socks off. Reviews shouldn't be permitted to criticize authors or their intentions? Really? I can't say, for example, that "Author X's historical fiction intended to depict 19th century marketing practices accurately, but the author failed in that intention as can be seen from the following examples"?

Worse yet, check out the Amazon reviewing guidelines: there *are* no injunctions against criticizing authors or their intentions.

The root problem as I see it is the lack of transparency in the removal-decision process. Customers (remember when Amazon was "consumer-centric"?) have access only to Customer Service, *not* to the mysterious "Review Team" that makes the editorial decisions concerning review removal. Customer Service mediates between the consumer and the Review Team. There is no direct channel of communication to the Review Team. The end result is the kind of message I've quoted above, which justifies the removal of a review on the basis of a violation of a guideline that doesn't exist.

The appropriate way to respond to a situation like this is to recognize that the entire review environment within Amazon is a farce, and the obligation of the reviewer is really to capitalize to one's best advantage on the opportunities for parody, satire, and the theater of the absurd. Under the circumstances, the only kind of review that should be considered offensive is one that presents itself seriously and straightforwardly as an objective review.

I also spotted many comments about how 1-star ratings seemed to mysteriously vanish. And reports of how many who questioned why were routinely told it was because of "server problems." This prompted one person to observe how curiously "selective" Amazon's server problems were, since it never seemed to happen to 5-star reviews.

Even more interesting were the allegations of self-censoring on the part of those who wanted to get (or maintain) "top reviewer" status. From some of what I read, I gathered that posting negative reviews could jeopardize your "top" rating if enough people voted your reviews "unhelpful." Apparently some authors mobilized their fans (or had a boatload of phony IDs) in order to carpet bomb negative reviewers and damage their credibility. As one guy said, there seems to be some books and authors you just don't give a bad review to on Amazon.

If true, it shouldn't surprise. There's no system so bulletproof that somebody won't eventually discover a way to game it. Especially if there's money to be made by doing so.

However, while all this was interesting to read, it mainly seemed to be happening between 2007 and 2009. I didn't see anything recent about this sort of thing.

Hmm...I wonder if Amazon eventually got more consistent and transparent; - or if 'the word' got out and people mostly gave up on posting negative reviews and comments over at Amazon...

[40hz]

Hmmm....I'm under the impression that you still do not have to have bought the product from Amazon to post a review.

Diva is correct. I just tried it and you can as long as you're signed in to your account. Maybe I was confusing that with how you're no longer allowed to publish anonymous reviews. Which makes good sense IMO.

[tomos]

Back with the Roboform Bitsdujour thread (seeing as I took it off-topic):

I see (Siber Systems/)Michelle's last response to Steven says:

I feel like I've adequately answered your question multiple times. I would appreciate it if you could contact us directly if you have any additional questions.

My emphasis - I guess that translates to dont post here any more.


Also see that wraith continued with the topic. I was just wondering if the answers were satisfactory (she suggests using backup feature) ?

http://www.bitsdujour.com/software/roboform2go-v7/

[Steven Avery]

Hi,

A backup feature would only be relevant as an export-import option if it came with a restore feature that is available externally.  It would have to lack encryption (which goes against the expected internal encryption) and it would have to have the layout available, although that might be puzzled out, if there was not encryption.  Generally a backup is simply a mirror of the existing data file, which is useless for export-->import.

Sounds like simply another diversion, smoke and mirrors, from the Roboform crew.

Steven

[Carol Haynes]

It has to be a lock in mechanism - they took (and are still taking) enough shit about their license changes - now they want to make sure they don't lose any more customers by locking them into a proprietary format which effectively cannot be exported.

They are a bunch of "duckers and divers" out to screw money out of people for a now substandard service and product and their support attitude stinks. Basically whenever anyone criticizes their cashflow orientated decisions that rob their customers of choices they tell them to go away or censor their posts. They did exactly the smae when people like me with lifetime licenses were screwed - basically told me to bugger off and stop asking questions.

The fact that the only update they have made to version 6 since the license debacle is to stop people exporting sums up their attitude to their customers.

Best thing to do with RoboForm is to stop using it altogether and make sure none of your friends or colleagues do.

I moved to LastPass Pro and don't regret it at all. I happily pay my annual $12 and bought a UBIKEY to make my login more secure.

[Stoic Joker]

I'm sticking with f0dder's Fsekrit (small, fast, portable, done).