For those interested in 1password on other platforms, I also created a Chrome extension a while ago, primarily so I could use my 1password DB on Linux: https://github.com/robbiev/multipass-chrome
I don't make use of the project posted here though, I wrote my own 1password lib in Go. The extension uses Chrome's native messaging to talk to the native Go binary, so unlike some other projects this does not run a local HTTP server or something like that.
I've seen something similar like this for Keepass. They warned that it is not as secure as using Keepass directly (here is no warning) and I guess it is the same for 1Password. This gives more possibility for attack vectors is my guess.
It's a little excessive to say that closed source means it can't possibly be secure or trustworthy. It implies open source is a silver bullet for security, which just isn't true.
I use 1Password and love it. I can tell after using other products that they have put a tremendous attention to detail into it. It is really easy to use and thoughtful in its design compared to the alternatives.
I said nothing about open source being a silver bullet. I only implied that it is better than closed source. The consensus has been that open source is more secure, especially with the bad behavior of corporations and government agency strong arm techniques in mind.
It just makes no sense to centralize your most important secrets into a single attack point for which you have no idea about its inner workings.
What consensus? All I'm seeing are assumptions that being able to read code easily means it is more secure. Someone can easily write an open-source project that looks like it is a secure project but can easily be misused to do bad things without people catching it in the act.
Look at Heartbleed and how lack of funding led to a horrible bug being missed. There has been other open-source projects hit by similar issues. Just as there are closed-source projects being hit with their own issues.
The nature of the code license does not, and I stress this strongly, lead to anything being more secure than other solutions.
A properly funded and talented team of developers working on an open source project is just as secure as a properly funded and talented team of developers working on a closed source project.
I don't make use of the project posted here though, I wrote my own 1password lib in Go. The extension uses Chrome's native messaging to talk to the native Go binary, so unlike some other projects this does not run a local HTTP server or something like that.