If they steal your password they still need your key. So if someone steals your extra key, they still need your password. The system over there caches it for you in the apps you use.

Difference is, if I have a high entropy blob on this platform I always have to enter it manually. No different than if I pad my own password with a high entropy blob. If you had to access it with something brand new then you have to provide it. The extra key is baked into the apps, you never see it. I'm still on Bitwarden and I'm not concerned for me, I'm concerned for, for example, my wife who I'm sure doesn't use a super strong password and that's not going to change. Here it is, wall of text as it is on their website:ĪgileBits Inc., its directors, employees, partners, agents, suppliers, or affiliates, shall not be liable for (A) any loss or damage, indirect, incidental, special, consequential or punitive damages, including without limitation, economic loss, loss or damage to electronic media or data, goodwill, or other intangible losses, or (B) for any amount in the aggregate in excess of the fees actually paid by you in the six (6) months preceding the event giving rise to your claim, resulting from (i) your access to or use of the Service (ii) your inability to access or use the Service (iii) any conduct or content of any third-party on or related to the Service (iv) any content obtained from or through the Service and (v) the unauthorized access to, use of or alteration of your transmissions or content, whether based on warranty, contract, tort (including negligence) or any other claim in law, whether or not we have been informed of the possibility of such damage, and even if a remedy set forth herein is found to have failed of its essential purpose.

They don't have any liability if their server gets breached, have you read their (or any other) terms of service?

1password vs bitwarden reddit