[ilyt]

... actually that might be a "feature" for them, they do have duplicate password report, I had assumed that's just based off decrypted ones on client side but they might be just using ECB for that

[insanitybit]

That report requires you enter your master password, so I doubt it.