I think it's great that people are trying to tackle this, and I feel a little sorry for the creator for some of the rather-harsh criticism. That said, given the

I think it's great that people are trying to tackle this, and I feel a little sorry for the creator for some of the rather-harsh criticism. That said, given the nature and aim of the project, it really needs to live to very high standards to deliver on its promise. And some of those harsh-sounding words are to a large extent helpful. Putting things into perspective and helping identify the weak spots. To me this looks similar (at least on the surface) to clipperz[1], even though I believe clipperz does all crypto on the client-side. Of course, both suffer from similar attack vectors or trust issues either way. Client-side does not mean you don't have to trust the server. I hope for the sake of the project, that it gets more than just passing comments (however helpful), but rather serious engagement from people with experience in this field. [1] https://github.com/clipperz/password-manager https://github.com/clipperz/password-manager