You are correct. This is the main reason 1Password X never uses a web page when it prompts for the master password -- the master password must be entered in the

You are correct. This is the main reason 1Password X never uses a web page when it prompts for the master password -- the master password must be entered in the popup that is only accessible to the extension itself. It is certainly tricky and there are many other concerns. We hope to have a white paper about the security decisions made in 1Password X design.