https://noncombatant.org/2014/03/11/privacy-and-security-set...
There are also people who use Chromium, or particular configurations of Chromium, instead of Chrome. That's fine. But don't use forks of Chromium, no matter who maintains them, even if it looks like a sizable effort. You don't want your browser to be any number of days behind the Chromium patch cycle.
I use the browser integration for 1Password on OS X (I might not if I was on Windows). I'm generally not that worried about localhost privilege escalation. I am very worried about how well I can reason about cloud-based storage of any sort, and how it will interact with things like my browser.
KISS: keep your secrets out of cloud systems and your backups offline.
If you're very sophisticated, I like Tarsnap for online backups. But you have to be very sophisticated to use it.
I think you're overstating this a bit. You have to be comfortable at a UNIX command line. Surely that alone doesn't qualify someone as "very sophisticated"?
Since Chromium does not upgrade itself, do you happen to have a suggestion on how to be arrange to be notified when a new patch is released?
In that case, why 1password over keepassx?
> 4. Switch to Google Chrome.
Can one configure Chrome to not be a data-sucking kraken?
> 7. Disable cloud-based keychain backups.
That backup is encrypted, I'd hope? So, is the problem that getting hold of a cloud-backup facilitates off-line attacks on the encryption key?
I remember Filippo (FiloSottile here) publishing his encrypted private PGP key [1] (back when he was still positive on PGP). If that's safe, how is this problematic?
> 10. Install a password management application that doesn't store your secrets in the cloud.
Same question as 7. My understanding was that most password manager vulnerabilities have been related to browser integration, so that is the first thing I'd switch off.
[1] https://blog.filippo.io/on-keybase-dot-io-and-encrypted-priv...