They have cryptographic proof of what types of devices you’re on. There’s a lot of metadata that they have access to because of their closed ecosystem.
They at least offer local network syncing, instead of requiring a cloud account (which is a deal breaker for me). This lets you keep your passwords in sync between your Computer (master) and mobile devices without them ever leaving your home.
All that does of course still require trust in the company, but at least not in their cloud infrastructure and, well, the internet...
..and it is the best solution for guaranteeing confidentiality and the encryption need/problem - not to need it, since there isn't a server to eavesdrop on
Nothing is entirely secure. We're two guys with no ulterior motives that take all reasonable precautions to keep the data safe. For most people that's not only enough, it's much better than having their passwords stored in their email archives and chat logs.
Even if you trust the company, you also have to trust that they have no logs that can be subpoenaed and that they cannot be compelled or hacked to wiretap you.
There's a distinction between trusting a company not to look at your data when you hand it to them in plaintext, (Skype) and trusting them to have completely flawless, bugfree code that the NSA hasn't backdoored. (Dual_EC_DRBG)
The convenience outweighs the risks for the vast majority of users. My parents need something that is available on all devices, syncs automatically, and requires no maintenance.
You get a master encryption key that never leaves your device when setting up the account. Anything that touches their servers is encrypted with that key. You need that key to setup a new device (in addition to your username and master password).
You're right. I'm sure their security design is 100% bulletproof and none of my sensitive data will ever be leaked. And even if it were somehow possible for it to be leaked, I'm also sure the company would be completely forthcoming as quickly as possible.
That is true. But then many people put a lot of trust in the major providers in many other areas too, such as hosting their private files and email, holding card payment information, and so on.
1) I trust them ever so slightly more than your average off-shored telco rep.
2) AFAIK, they do not hold the credentials in unencrypted form, they're only decrypted on the device with the backup password.
reply