> they test to see if your database is decryptable with the password you entered (after it is hashed). At which point they have full access to your database, d

> they test to see if your database is decryptable with the password you entered (after it is hashed). At which point they have full access to your database, don't they? > And you can already read the Lastpass browser extension's source code Of course, it's a bit more difficult, I'm betting it's minified. High profile open source encourages people to read the source code, if nothing else. It's possible someone would've noticed that nasty cross-domain autofill bug from a while back (https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/ https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi...). It's also possible that the community would hold the codebase to a higher quality standard, and a lot of issues would go away (only a rumor, but I've heard that parts of the LastPass codebase are a mess).