Re:1Password for Open Source Projects
by woolvalley on Wednesday April 11, 2018 @09:40PM
(#16817354)
Local vaults is completely client side encrypted, so you didn't have to trust dropbox or iCloud if you used that to sync.
The only major vuln are the updates, and that would have to be a backdoor delivered to everyone, otherwise the mismatched hashes would be noticeable. The surface area is smaller with the client side encrypted version.
Do you trust your client? Oh, you compiled it yourself. Do you trust your compiler? And so on and so forth.
Can you trust the manufacturer of your personal devices?
Sooner or later you're trusting somebody, unless you literally smelted your own machine starting from ore and a bucket of sand, and then wrote every line of code for it, including the compiler, yourself.
Maybe you should inventory all the entities you're trusting already.