I can't speak on behalf of FileRock, but I suspect the following, based off of the blog post you linked: While the PBKDF2'd password CAN theoretically be snoop

I can't speak on behalf of FileRock, but I suspect the following, based off of the blog post you linked: While the PBKDF2'd password CAN theoretically be snooped (if this wasn't wrapped in TLS, it would be trivial), the actual password cannot be calculated from the derivation. So yes, an attacker who listened to your transmitted PBKDF2'd password can theoretically access your encrypted files from the server. However, if they could snoop, they could have just watched those encrypted files as they came across the wire. The client-side encryption is still just as effective. As far as I can tell, your data would still be safe.