text: @notauser: Thanks for clarifying. Indeed. 1Password's security is built on encryption though rather than authentication, and authentication would not be involved when we're talking about a local attack on memory.
  In order to make sure we can answer your security questions, please reply here: https://discussions.agilebits.com/discussion/101551/article-just-published-in-washington-post-is-saying-1password-and-others-have-security-flaws#latest
  instead of authenticating to the 1password application via a master password locally on the device, such could ... maybe should be offloaded to a dedicated hardware solution that does nothing but authentication.
  1Password doesn't do authentication, it does decryption; you can't unlock 1Password without a key. If the hardware authenticates you, the hardware still has to give 1Password a key to decrypt with.
  This was what Intel's SGX was supposed to help with but it had some technical restrictions and complexity that it was not sustainable. Not to mention, 99% of our users didn't have SGX capable hardware that'd help. This is a chicken and egg situation.