&gt; By that logic all cloud synced password managers are insecure. They could, after all, just update the software and steal your password(s).<p>That&#x27;s not really true: I can verify that a piece of software works and does not expose my information, and I can rely on it forever. Someone else can verify it, and if I trust him once (to verify), then I can rely on the software, forever. I can&#x27;t do that with Mozilla&#x27;s JavaScript, because they can change it — or be forced to change it — at any time, for one individual or for everyone.<p>It&#x27;s a fundamentally different problem.