However without knowing Master password it is not possible to see the list of
URLs and saved passwords, the URLs list is just empty.
Yes, but they can guess that maybe I have a Nationwide bank account, visit
www.nationwide.co.uk
and QTweb will fill in the login details without asking for the master password.
Then they could change my password at Nationwide!
It should be possible to make QTweb ask for the master password only once, the
first time it fills in a form. That won't be too annoying.