> The gist of the article was that adding iterations to the key derivation function doesn't actually increase the entropy of a password all that much.
I know your linked article talks about it a bit like this, but I think it's wrong to think about PBKDF2 as "increasing the entropy" of a password. The number of PBKDF2 rounds just increases the cost of each guess an attacker makes, but doesn't fundamentally change the number of guesses an attacker needs to make. To me it's basically the constant multiplier term with respect to Big-O notation - that is, while some process make take 1000N time or 10N, it's all still just O(n).
So, that said, I 100% agree that 1Password's approach of using a truly random 128 bit string as part of the key is fundamentally an uncrackable approach while LastPass's was not.