1Password sends your password across the loopback interface in clear text
Ross Hosman
28127
The fact that you can run:
tcpdump -i lo0 -s 65535 -w info.pcap
Tells us that your system is misconfigured.
It probably happened when you installed WireShark and let it reconfigure your system. Is your current user in the "access_bpf" group?
If yes, your system is misconfigured.
Don't allow WireShark to do that.