1password is considering a self-hosted option to store vaults

The above argument seems to turn out the same even for cloud-synced vaults.

If Dropbox suffered a massive hack, the malicious actor could take all the *.agilekeychain and *.opvault files stored there, brute force the master passwords locally, and have potentially complete control over some people's finances and online lives.

I have the advantage that I am a programmer, so I can deal with a bit of reading install guides and arcane configuration. I was surprised to learn just how reliable things can be. Open Source tends to move forwards, so I don't have features taken from me. In recent memory, both 1Password and Fantastical have taken my features in the name of subscriptions. I installed ZigBee home automation with a Hubitat. It has never failed me. Internet and Wi-Fi can be down and things still work. The unreliable part is Google Nest (invalidates tokens every now and then) and Apple Siri (randomly can't do things at times). In short, I can automatically scan and OCR documents, have file services, movie and music, and more, and it all just works.

/rant mode enabled

It has become obvious to me that the law is quickly becoming snitch based. With so much information being hosted online, it's just too tempting a target to not use it for other purposes. Google and Facebook are just the leaders in where this is going. There is just no reason for law enforcement to not scan for dissonant behavior at some point, just as they roam the roads looking for violators. As more jobs become remote, the argument will be "the roads of the 21st century are on the Internet." Difference before is if you get pulled over on the road, you can log it. You know when and where it happened. You have evidence of the encounter. You can see what was used against you and who.

The new system you requires you to try to prove your innocence. You won't know when or where you were targeted. You are not allowed to inspect the software or see the matching hash information. You must open your phone to prove the file is innocent, at which is is legal for the police to capture data. Finally, it is NOT against the law for law enforcement to lie to you [1]. This utterly stacks the deck against you.

All of this could be avoided if at the time of the event you could record what happened and challenge it, because ultimately law enforcement is a money making scheme. Cops are the largest thieving group in America, so treat them like it[2]: a car alarm doesn't stop them, it's just means most thieves will choose an easier target. So, private services doesn't stop a cop, but following cloud events is a lot easier than trying to get into my house.

My sincere hope is that the cloud keeps them busy enough to stay far away from me.

[1] https://www.youtube.com/watch?v=_IZlrf8CiM4 [2] https://www.washingtonpost.com/news/wonk/wp/2015/11/23/cops-...

    % tar ztf 1password-latest.tar.gz | grep "chrome"
    1password-8.1.1.x64/chrome-sandbox
    1password-8.1.1.x64/chrome_100_percent.pak
    1password-8.1.1.x64/chrome_200_percent.pak