> By that logic all cloud synced password managers are insecure. They could, after all, just update the software and steal your password(s). That's not really

> By that logic all cloud synced password managers are insecure. They could, after all, just update the software and steal your password(s). That's not really true: I can verify that a piece of software works and does not expose my information, and I can rely on it forever. Someone else can verify it, and if I trust him once (to verify), then I can rely on the software, forever. I can't do that with Mozilla's JavaScript, because they can change it — or be forced to change it — at any time, for one individual or for everyone. It's a fundamentally different problem.