Seriously, use 1Password... it's great.
I use 1Password, and it sure beats my old strategy of using a text file for all my unimportant passwords.
Coincidentally, the 1Password plugin is helpful in preventing phishing, too. If you're at the wrong site, the 1Password autofill will not work.
After all, if 1 password gets hacked the passwords that are generated could be sent to two parties instead of just to you.
And if someone mounts a camera in the smoke detector in my apartment they could see me type in the double super secret password whose plaintext has never been stored by a computer.
So what's your point, exactly? Tools which generate good passwords and store them locally on your computer with decent-enough security are light-years ahead of what most people do, and their use should be encouraged.
But in my experience, too many people confuse "this is a possible threat" with "this is a threat it's reasonable for me worry/take action about", and that's what I was getting at.
1password is easier and a much juicier target, so compromised binaries are definitely a possible threat. How would you know it was compromised, unless you had a packet sniffer going on your network?
It's possible that a password manager could be completely open source, distributed with checksums and public key signatures, that my C compiler could be completely open source and distributed with checksums and public key signatures, and I could still end up with a backdoor in the final compiled result, detectable only by deciding to carefully examine the binary I just built.
This is a "possible threat". Should I use that possibility as a justification for never using a password manager? Or for never using a C compiler?
And it's not just a "possible threat" but a likely one, and it's happened multiple times in the past. Sites get hacked all the time, and trojans are standard practice these days (unlike compromised-binary-generating C compilers):
https://threatpost.com/en_us/blogs/savannah-gnu-site-comprom...
http://www.esecurityplanet.com/trends/article.php/2248811/GN...
https://threatpost.com/en_us/blogs/apache-site-hacked-throug...
What your suggesting is far less complex than the Stuxnet virus. You need to get binaries from reliable source and verify checksums whenever possible. You can't protect yourself a 100%, but that doesn't mean you should leave or your doors unlocked.