That is what I am using. I guess the Enpass attack would require either an attack on the client on my phone / pc or on the storage provider (if they are able to crack my passphrase). I had assumed lastpass and 1pssword were using the same approach