[lordofmoria]

Everything is a tradeoff - but the basic balance is very strongly in favor of password managers:

1. without a password manager that is shared on all your devices, you WILL re-use passwords out of frustration. 2. without a password manager, if you do any sort of regular sharing passwords with a engineering team, friends & family, you'll resort to pretty insecure channels. 3. true E2E encryption, while still providing some surface area, has proven in the field through multiple pretty bad breaches[1], that it's a security model that holds up under real-world circumstances.

On the flip side, you are right: you are one compromised browser extension / binary away from having your local vault decrypted, and ALL your passwords compromised. But think about this: if someone has this much local access, chances are they can install a keylogger anyway, or read your clipboard, so the real difference is you've conveniently pre-loaded all your sensitive information in one go for the bad actor.

[1]For example: https://blog.lastpass.com/2022/12/notice-of-recent-security-...

[WalterBright]

With a keylogger, you lose passwords you typed in since the keylogger was installed, but that is rarely all of your passwords.

[edrxty]

Most of these managers support some form of 2fa. I use a yubikey with mine such that if my master password is compromised someone would still need to obtain my security key. You can enroll multiple and keep one in a safe and one or more on your person. It's not perfect, but it prevents the vast majority of huge dragnet style malware attacks and a lot of the targeted ones until you get to the point where someone is trying to hunt you down on the street.

This still leaves a case where someone manages to get the final key out of memory but you're pretty hosed at that point anyway. I'd prefer a system where the yubikey itself is doing the final credential decryption instead of the CPU, unfortunately most people aren't that paranoid though.

[lordofmoria]

Absolutely agree - that's why I said "so the real difference is you've conveniently pre-loaded all your sensitive information in one go for the bad actor."

[kemotep]

The average person usually does the same but without encryption or strong passwords.

I’ll stick to passwords that are impossible to guess and an encrypted vault with multifactor authentication.