Keeping my secrets store on someone else's computer is simply not compatible with my threat model.
Yes, they say it is encrypted, and I believe them and believe they're competent.
But competent people write vulnerable code all the time, disastrously bad hires happen (see Unifi), and companies go bad. You can't un-disclose information stored with them, only laboriously invalidate it.
The only thing I pay for is the managed hosting, but in theory it's not much different than anything else properly designed (e.g. bitwarden) aside from the obvious things, such as OSS-ness.
The only relevant CVEs are relatively mild compared to LastPass.
Give them some credit.
...and, those are the only things that really matter for an attacker. Encrypted data (assuming reasonably strong encryption) is useless without the key.
> The only thing I pay for is the managed hosting
Funny, I was happy to pay them until they removed my ability to store it myself.
edit:
> CVEs are relatively mild compared to LastPass
LP is not the relevant comparison. The relevant comparison is an encrypted store on my laptop.
Sometimes the devil you know, you know?
That said, if their closed-source browser extension is leaking my master password to random websites I'll cut them out of my life tomorrow.