I'm not sure your scenario actually makes sense, even beyond the trust destruction issues others have highlighted. >Let's say 1Password somehow got breached, a

I'm not sure your scenario actually makes sense, even beyond the trust destruction issues others have highlighted. >Let's say 1Password somehow got breached, and customer vault passwords exfiltrated and posted online. First, 1Pass is not LastPass. Even their cloud service is optional (I don't use it for one), and it still operates end-to-end encrypted through a native client doesn't it? At least for those clients AgileBits simply doesn't have this information at all so there's nothing to breach. Unless by "breached" you meant "hacked so badly that a copy of the client with malware got signed and made it through app store review." But an infected client is much more easily noticed by massive numbers of people, making secrecy even more pointless then it'd be otherwise (which would still be pointless because such a breach would be obvious instantly if it was put to use). Second and more importantly, one of the entire fundamental points of password managers isn't merely to not get breached, it's that if they do there's an orderly way to go through and change every single password to something new and random. Yes, it'd be an irritation for a whole vault, and if it happened repeatedly it'd be reason to move to something else, but the only possible way for it to escalate from a minor problem to a huge one would be for notification to be delayed. I don't see how it wouldn't be in AgileBit's direct financial interest to come clean as instantly and rapidly as possible, which would minimize both customer impact and liability. With word out operators of sensitive services could also know to be on higher alert and/or issue mandatorh resets. This last part would apply to LastPass or any other such service too fwiw. Granted I'd hope such a thing, or even the possibility, would motivate an industry push for standardized password/username interaction APIs. There's no technical reason that cycling every single password you've got shouldn't be at least a mostly automatable operation. It'd be better still if passwords were done away with entire in favor of certs but might as well keep improving the current pile of hacks if that's the best we can manage piecemeal I guess.