&gt; They still don&#x27;t have access to my raw passwords.
&gt; They however do control access to the account.<p>From point 2, point 1 is trivial to change. All they would need to do is update the extension or add some javascript (for the web login) to grab your master password in the clear.<p>Sure, a local password manager like Keepass could provide a new version that posted my p&#x2F;w, key file, and DB up to a server somewhere, but I would have to manually install it, and it would have to get around a local program executable-firewall. No such challenges with auto-updating extensions and&#x2F;or JS served from their server (or MITM.)<p>I don&#x27;t know if the acquisition makes them more secure or less, but having worked at large companies, I tend to agree with:<p>&gt; I must admit I felt a bit safer when I thought it was a smaller, purpose-built company managing things.