In my experience they are pretty awesome at customer service. I emailed them a few months ago after someone published a weakness during the BlackHat Conference

In my experience they are pretty awesome at customer service. I emailed them a few months ago after someone published a weakness during the BlackHat Conference (https://media.blackhat.com/bh-eu-12/Belenko/bh-eu-12-Belenko-Password_Encryption-WP.pdf https://media.blackhat.com/bh-eu-12/Belenko/bh-eu-12-Belenko...) Jeffrey got back to me with a way-more-reasonable-than-expected answer: --------------------------------------------- Hi Bernardo, I'm sorry for not getting back to you earlier. I think I answered your question elsewhere, and so failed to get to the email followup. The Belenko and Sklyorov analysis of a large number of password managers found that many of them (including 1Password) were vulnerable to a "padding oracle" attack. We discussed the problem the day that the report came out, and released an update to 1Password for iOS (Mac and Windows versions were not affected) within a few weeks. The specific vulnerability (that pretty much affected everyone who used the standard cryptographic libraries) is fascinating, and I'm hoping to write more about it some day. But for the moment, please see http://blog.agilebits.com/2012/11/08/dont-trust-a-password-management-system-you-design-yourself/ http://blog.agilebits.com/2012/11/08/dont-trust-a-password-m... which includes some links to the issue and what we did about it. The key paragraph is "The [New York Times] article cites some of the research behind Elcomsoft’s scathing review (PDF) of password managers on mobile devices, which we wrote about last March. That report did included some issues in 1Password on iOS (which we quickly addressed), but it also shows that there is enormous variation in the quality of password managers. 1Password is clearly among the best." It is hard to stay ahead of potential threats, and we slipped up in that case so had to play "catch up" instead. Although there was never a practical threat to people's data, as developing a practical tool to exploit the vulnerability would take some time. But the design flaw certainly opened the door for people to create such tools, so we did need to get this fixed quickly. Still we try to look toward the future in our design and defend against potential threats that don't yet exist. We should have defended against all potential chosen ciphertext attacks (CCAs) no matter how "theoretical" before the padding oracle (a type of CCA attack) was actually discovered. I hope that helps. Please let me know if you have further questions. Cheers, -j –- Jeffrey Goldberg Chief Defender Against the Dark Arts @ AgileBits ---------------------------------------------