[JohnFen]

I'm even stricter than you. I use a password manager, but on a separate device from where I use passwords and it does not talk over the network.

Wen I use a password, I look it up and type it in by hand. No autofill is possible, intentionally.

[LtdJorge]

That doesn't bypass keyloggers

[mcpackieh]

It would limit the scope of the damage. Instead of getting the entire password database, the keylogger would only get those passwords that were used while the system was compromised.

[JohnFen]

True, but keyloggers aren't one of the threat vectors I am most concerned about, and as mcpackieh said, it still limits the potential damage quite a lot.

We all have to gear our security mechanisms toward our particular threat assessments.

[seti0Cha]

What is your biggest concern? I would think key loggers are a more common threat than attacks on the password manager directly, especially if you're running something niche. What else do you gain from keeping it air gapped?

[JohnFen]

Keyloggers rank low for me because I'm only using my own devices that I have physical control over, so a dongle is unlikely. A keylogger would have to come in through malware.

That's certainly possible, but if malware were able to get installed despite my other protections, then I probably have much larger issues. And the keylogger would have to phone home with the data, which is unlikely (but not impossible) to happen without raising some alarms.

So I'm more worried about sharing data with the password management company systems themselves. If there's no real reason to send data over the net, then I don't want to send data over the net. The smaller the attack surface, the better.

It's just my personal policy. In reality, I don't consider either keyloggers or password management company computers to be huge enough risks that I lose sleep over them. Plus, I don't want to become reliant on a particular piece of software to do important things -- typing my password by hand means that I'll have the most common passwords memorized, so if something goes wrong that prevents the use of the password manager, I'm not locked out of anything.

[oneTbrain23]

Antivirus can detect keyloggers. So much less threat compare to losing entire key db.

[ibotty]

This is unfortunately not robust against phishing which is for most users the bigger risk IMO (not necessarily power users, but I'd argue that most power users are too sure about themselves in this regard). It's always a question about the threat vectors and this weight you give them.

[fsflover]

I do it similarly, except passwords are stored in an offline VM on Qubes OS and copied every time using Qubes' secure copy/paste.

Much more convenient and quick and still reasonably secure.