1Password sends your password in clear text across the loopback interface
[Disclosure: I work for AgileBits, the makers of 1Password]<p>We've talked about this several times, most recently was in June. Please see <a href="https://blog.agilebits.com/2015/06/17/1password-inter-process-communication-discussion/" rel="nofollow">https://blog.agilebits.com/2015/06/17/1password-inter-proces...</a><p>This falls into the question of what can we do to prevent attacks from malicious processes running on the user's machine. For the most part, we do try to defend against something where we can. For example, we take steps to make key logging a little more difficult.<p>In this case, the steps (other than mere obfuscation) that would be necessary to properly encrypt that channel would require that the user be confronted with a "pairing" request and prompt almost every time they restart their browser.<p>Again, it would be easy to obfuscate this communication, say by using wss; but the private key for that server would still need to be stored en clare on the computer.<p>There are other approaches as well, but all have unpleasant side effects that risk user data in other ways.