> They still don't have access to my raw passwords. > They however do control access to the account. From point 2, point 1 is trivial to change. All they would

> They still don't have access to my raw passwords. > They however do control access to the account. From point 2, point 1 is trivial to change. All they would need to do is update the extension or add some javascript (for the web login) to grab your master password in the clear. Sure, a local password manager like Keepass could provide a new version that posted my p/w, key file, and DB up to a server somewhere, but I would have to manually install it, and it would have to get around a local program executable-firewall. No such challenges with auto-updating extensions and/or JS served from their server (or MITM.) I don't know if the acquisition makes them more secure or less, but having worked at large companies, I tend to agree with: > I must admit I felt a bit safer when I thought it was a smaller, purpose-built company managing things.