All it would take for 1Password to decrypt our entire vault is for 1Password to push out a software update that simply made it so that the client app uploaded the keys to 1Password's servers after the user typed it in. Without 1Password releasing their source code, end users would have no idea if such an update ever took place. We just have to trust 1Password as a company. Well, if we already trust 1Password as a company, what's the point of even using encryption? Might as well just store it in plain text in a database on your servers and trust that your employees won't look at them!
Without open source auditing of all clients and md5 checksums of compiled binaries, security is nothing more than an illusion.
Without open source auditing of all clients and md5 checksums of compiled binaries, security is nothing more than an illusion.