In this case, I wasn't making any accusations about Backupify. I was merely pointing out how their external behavior is indistinguishable from phishers'. For all I know they're stand-up guys with the best of intentions, but I object to business models that are based on encouraging bad security practices. They could do everything they do by providing software that verifiably keeps passwords and keys on the user's computer, never storing anything unencrypted in Backupify's AWS cloud. That would be just as useful, and it would be the responsible thing to do, but offering a service instead of software is easier - no platform-support issues. If they're using GPL programs (probably) then they also get to take advantage of the "service provider" loophole to avoid distributing their modifications, and if Backupify ever becomes popular then a service model has better revenue-generating potential. All good for them, so apparently they don't care that it depends on users doing just about the dumbest possible thing security-wise. They might have no intention of abusing their access to users' data, but can they guarantee that every disgruntled employee or contractor will be so noble? Hardly. That's exactly why giving your password to anyone else is a Bad Idea. Business models based on encouraging users to do stupid things are IMO worthy of derision, so I gave them some.