They seem to be using TLS, but yeah the users have to trust Google (which hosts their jQuery js), Mozilla (which hosts their Persona js) and of course the admins of yithlibrary.herokuapp.com itself.

If any of these gets compromised, the crackers would be able to retrieve the master password of any user entering it afterwards.