You can only validate their file format, you can't validate, say, the quality of their implementation. For all you know they are intentionally generating files that are really easy to crack, or are using a custom rng implementation given to them by the NSA, or whatever. Super smart people might be able to reverse engineer such knowledge, but it would be better if they could look at the code.

One important thing is, my data directory is on my computer. It's not transmitted over any wire. Unless NSA comes knocking... Of course if you want to sync then it goes through dropbox then you have a problem. But they stated that the new version will be able to sync within a wireless LAN.

And If you don't really trust 1Password's encryption, it would be trivial to relocate data files within a trucrypt container or something. (I know this is somewhat ridiculous)

Oh for sure. My original point, way back up tree, still stands though. If you care about security, surely you should care about security. If the data is just on your computer and you're not worried about people getting access to the file why don't you just use a text file, or get the browser to save passwords, or a billion other possibilities that don't cost USD$50-70?

There is something to be said, I suppose, for "well if I sell my computer and forget to dd the drive / it gets stolen then it stops randoms from easily gaining access to my stuff". You then need to wonder if that's the only file you wouldn't want people being able to access. If it turns out that there is other stuff as well, perhaps encrypting your home directory is a smarter idea (I hear there isn't a massive performance hit these days)?

With LastPass, all data are encrypted locally on your machine so except if there is a backdoor in their extensions/desktop applications, you are normally pretty safe.

http://www.tobtu.com/lastpass.php why nobody should use lastpass

Thanks for the read, will probably switch to KeePass then.