Ok, just to make things clear, and to make sure I understand, an attack could look like this;<p>1. I trick you into using my GitEvil Repository Service (GERS™).<p>2. After you upload your data, I swap target site information (in this case name) with the name for GERS™.<p>3. Next time you log in to GERS™, you accidentally send the login information for target site instead.<p>4. Profit<p>In that case, keeping with the wish to keep the manager searchable without the master password, would it be possible to mitigate this by HMAC&#x27;ing the encrypted password with, for instance, the site name?<p>As should be obvious from the above, I&#x27;m no crypto expert.