While I agree with you that users should have a strong master password, the vendor is in a really privileged position and could do much more than just attemptin

While I agree with you that users should have a strong master password, the vendor is in a really privileged position and could do much more than just attempting to crack vaults offline. Why bother with cracking the vault when you can just modify the javascript sent to report back the master password? Especially if you only do targeted attacks, and/or heavily obfuscate the phoning home, the chances of getting away with it is probably pretty high.