Secret key in clear text in C:\Users\<username>\AppData\Local\1Password\1password.sqlite
1Password v8 seem to store its local data in C:\Users<user>\AppData\Local\1Password\1password.sqlite.
With any sqlite client, it's dead easy to extract the secret key(s) of your account(s) with an SQL command like this:
```
select substr(data, instr(data, 'secret'), 60) from accounts;
secret_key":"A3-xxxxxxx-yyyyy-zzzzz-aaaaaa-...."
```
Since this database is the first thing an attacker would check, I don't consider this good storage of the secret key. It's plain text in plain sight. The only thing that protects it are the ntfs file system permissions, which are void if you boot a live CD/DVD/Stick or if you have admin permissions.
It's clear text, not even obfuscated. I expect this key to be at least obfuscated, better encrypted with the master password.
In the sqlite database of the v7 client, the secret key isn't found that easy, if at all.
1Password Version: 8
Extension Version: Not Provided
OS Version: Windows
