Won't using 1Password - as opposed to using a local credential store - also risk compromise of the enterprise?
My impression of 1Password is that it is centralised store of encrypted passwords - isn't that a hacker magnet? Hackers could obtain the encrypted store and attempt to decrypt at leisure. Or hack 1Password's communication interfaces and endpoints.
I'd be much more comfortable if all 1Password did was enable the syncing of credential stores directly between devices, never keeping a copy . That way I gain a distributed master record. Basically, a signal to say "hey, a credential has changed; sync up with such and such device". If my devices happen to sync directly, the vendor may never even see an encrypted copy of my passwords, much less store it.
If a centralized master copy is essential, 1password should deploy software that centralizes credentials at the organisation level... The software should be owned by the customer. instead, right now the 1Password architecture has them hosting hundreds of millions of credentials on their servers. While the data is encrypted from their eyes, doesn't centralization make them a hacker magnet? Hackers could obtain encrypted stores with hundreds of millions of credentials and attempt to decrypt them at leisure. Or they focus their hacking efforts on 1Password's communication interfaces and endpoints. That make me queasy.