[SV_BubbleTime]

How is this different from “enter your password and we’ll deliver your blob” and “enter your password and we’ll deliver you a login cookie”?

Neither way “must” they have stored your master password.