It's hard to trust a cloud-based password manager.
Now, if they're doing the crypto all local and syncing between devices with a miniature version of SpiderOak that would be OK. This is basically what 1Password does -- local crypto and stored on Dropbox or iCloud. That's not worrying at all as long as the crypto -- completely managed locally -- is strong.
But if they're using, say, SSL and an API with your credentials to access the encrypted cloud storage and they have the key... this is bad.
That's a good model to adopt. It's also the "ubiquitous encryption" that has James Comey crying like a baby.
I encourage more apps and services to adopt this model. Just, be careful when you do. Definitely open source your code, and definitely get it audited by a qualified team (e.g. NCC Group's crypto services).
Now, if they're doing the crypto all local and syncing between devices with a miniature version of SpiderOak that would be OK. This is basically what 1Password does -- local crypto and stored on Dropbox or iCloud. That's not worrying at all as long as the crypto -- completely managed locally -- is strong.
But if they're using, say, SSL and an API with your credentials to access the encrypted cloud storage and they have the key... this is bad.