Google Password Manager

John_Gray

I'm afraid I would have come to the exact opposite conclusion to you...

TMSG

As others have said, I would only trust a password manager if it is completely open-sourced. I also do not store any passwords in web browsers as anyone with access to the browser can read the passwords. (Yes, I know that Firefox and related browsers like LibreWolf can safely encrypt the password database but once decrypted they face the same problem until all browser windows are closed.)

I would also never, ever use a password manager that stores its files in the cloud.

This leaves not very many options and I have for many years now relied on KeePass2 and compatible apps, first under Windows (https://keepass.info/), then Linux (https://keepassxc.org/) and also Android (https://github.com/PhilippC/keepass2android ).

Using an offline password manager is certainly not as convenient as one of the online offers or the browsers but my whole digital life is stored there and the small added inconvenience (though it's repeated every time I use the password database) is for me well worth it.

Like using 2FA/MFA it's just one of the many convenience/security trade-offs we all face.

Exodi

TMSG said:

As others have said, I would only trust a password manager if it is completely open-sourced. I also do not store any passwords in web browsers as anyone with access to the browser can read the passwords. (Yes, I know that Firefox and related browsers like LibreWolf can safely encrypt the password database but once decrypted they face the same problem until all browser windows are closed.)

I would also never, ever use a password manager that stores its files in the cloud.

Can they?

I'm logged into my Google account on Chrome right now and I can't read my passwords without entering my Windows login info.

All of the suggestions have been dabbling so far into 'over the top' territory that I'm suprised a security purist hasn't trumped everyone yet by saying that 'if you're not storing your passwords on cold storage in a nuclear bunker guarded by lasers, you don't care about your security'.

MFA + any password manager is effectively impenetrable bar some intricate swim swap scheme or the victim willingly handing over the MFA codes (e.g. to a fraudster pretending to be from Google).

Data stored on the cloud is nearly always encrypted. As far as I'm aware, even the breach example on the first page of LastPass was just a breach of encrypted data - e.g. effectively useless to the hacker, but good for making headlines.

RG2015

Exodi said:

I don't know what the 'Chrome Browser Password store is', Chrome has featured the Google Password Manager for many years now (though recently they have been actively been pointing it out).

Just for clarification, the image below is an example of what caused me to think that previously there was a Chrome browser password store.

I have been using it for a few years but had not realised that it has always been the Google password manager.