It's a matter of trust and good faith. You could apply the same dichotomy to actual FOSS programs.
Meanwhile if I'm running Debian I trust the maintainers have built the source code to distribute to me, similarly with homebrew and chocolatey.
> Its a matter of trust and good faith
Indeed it is, and you have to trust 1password, and if you don't, it doesn't matter whether there's good faith or not.
Precisely. By not showing their source code, they implicitly state that they don't care about whether you trust them or not when it comes to source code. It is not a meaningless distinction. Bitwarden for example lists being open-source as a plus in security. You may not personally see it that way, but a big part of the industry does.
1Password has been in business for 17 years, longer that any other password manager. It is very difficult to have a long term business model built completely on open source.
As I said earlier I'm not going to complain that you won't use a free license such as MIT or AGPL or whatever else. The real issue is just the sources being publicly auditable. Are you worried about your competitors copying your non-copyrightable material? Ideas?
While there would still be an issue, I would be a bit less harsh on the policy if at least the clients were source-available. Transparency is security.
> It is hard to seriously compare the features, the security design, and the UX of Bitwarden to 1Password — it is not close.
How does Bitwarden not come close in security? All I can come up with is the secret key requirement. Is that all? If anything Bitwarden feels more secure because of its transparency. You can see the developers working live, each commit they make.
One of the issues with Bitwarden encryption is the fact that every field is encrypted separately and that could provide more info to the attacker. For example, you could tell how many URLs in a particular login or if there is note for an item and how long it is.