That is honestly embarrassing. I'm glad I don't use LastPass.

My girlfriend was wondering why programmers are so pedantic, and my primary response was "because they can never be wrong", and as a corollary it becomes important to always be right and develop a culture that points out every flaw in competence.

Its a pretty bad trait we should do something about that and just continue striving for peer reviewable code and implementations.

I know what you mean, but it's also despicable when companies which are based around security don't take the extra care they should to protect their users. I don't respect that, and I think they deserve every ounce of criticism.

With that said, I definitely agree on things that aren't security related.

I do. What else does auto form fills based on urls, client side encryption, and runs in chrome, IE and Safari?

1Password, and it's been awesome. If you use the non-hosted version you control the whole thing. LAN only sync, or Dropbox, Rsync, however you want to sync it if it matters. Otherwise they've got a hosted version which can also give you web access in a pinch and handle all the syncing for you. I have been with them for long enough that my only option was a non-hosted version and I keep in sync with Dropbox and it works wonderfully.

The Mac client is very nice to use. The Windows client works well but isn't as nice looking. The browser extension is awesome- AND you can put MFA keys in there as well.

EDIT: And I forgot to mention the main reason I chose 1Password so long ago. Their iOS app is awesome and their mobile Safari integration works quite well.

But no linux support.

No direct Linux support but you can absolutely run the windows version 4 in Wine. It's not without a few crashy glitches but for just using stored passwords it works fine.

It would be very nice if they did support Linux and people have been asking for it, but there is a passable workaround- and frankly one I'm willing to work with because it works so great everywhere else.

That only works if you store your vault yourself.

When I tried it out I wanted 1password family so I could share some accounts with my partner. 1password 4 doesn't support their cloud datastore; the version that does will not run on Wine.

However, I could use the webapp on linux. It was a bit annoying but I could have dealt with it. The other complaint I had was the UX for Android. Having to switch my keyboard every time I wanted to enter a password was very annoying. Hopefully that gets better with the recently announced Autofill API for Android O.

I would suggest not using the auto fill feature of password managers. I use 1Password and the mini UI that sits in the tray is super easy to copy a password from and paste in the browser.

Why not use auto fill? I consider that a decent defense against phishing attempts. Now I always think twice before entering my name and password.

Autofill requires a browser extension. There are at least three major risks associated with this:

1. Giving code running in your browser access to your password database carries some risks. Browsers have a massive attack surface. 2. Autofill extensions use heuristics to map secrets to forms, and sometimes put secrets into fields they shouldn't. 3. Autofill extensions cause your browser to prompt for your master passphrase. Other extensions may be able to emulate this behavior or otherwise intercept your passphrase.

Anyone who isn't using a password manager should do so. A password manager with autofill is a huge step forward from nothing. But disabling autofill offers some further benefit.

1Password does not have a list of "secrets" that it draws from for all forms, it only saves the information you provide per-site; anything it submits to a site is information you've already submitted to the site previously.

1Password's extension does not prompt for my master passphrase, I have to click on it to enter it (if I haven't already). It also to don't try to fill forms on page load, I have to instruct it to do so. By default it will usually submit a form upon fill but I often turn off that setting.

As for browser vulnerabilities, I'm not familiar with any information about extensions being particularly vulnerable to browser exploits, it seems like when browsers get "pwned," anything in userland (if not the whole system) is up for grabs so avoiding the password manager's browser extension doesn't gain you anything. I'm not saying there's no risk, just that trade-off is worth it. Agilebits argues that using the extension is safer because it avoids keystroke loggers and clipboard sniffers [0]

[0] https://blog.agilebits.com/2014/08/21/watch-what-you-type-1p...

I use LastPass, and features you mentioned also apply.

LastPass also unfortunately has in-pane banner pop-ups which I do not trust at all. Blind and automatic autofill is dangerous. I'm not sure if you can enable that.

Another feature I like is the detection of compromised sites and password rotation reminders.

I don't think this is true. Keepass can do autofill without a browser extension. Or are we talking about a different feature?

Keepass can't? It can fill upon request with Ctrl+V which does <username>[TAB]<password>[Enter], but to automatically fill passwords you need the http plugin for keepass and a browser extension.

Select view source on a page where credentials are auto populated. See your password.

Now imagine you stepped away from your machine while still logged in.

Autofill is convenient, but there are negative consequences.

Has anyone used hardware-based password manager like Trezor Password Manager? [1] [2] Initially Trezor was created as a bitcoin wallet but is much more these days.

The issue with 1Password is that it's not accessible in Linux and no U2F (yubikey etc) support AFAIK...

[1] https://trezor.io/passwords/ [2] https://blog.trezor.io/satoshilabs-launches-trezor-password-...

If you install 1Password 4 in Wine it works pretty well, I've even got browser extensions working with my Linux browser.

Its not great and it crashes some, but it does work.

I've wanted to use such a thing, but the requirement to use a specific browser is always a massive bother

same with things like yubikey

It seems like it would be better to just fake a keyboard output instead? then you could have something that could work on all platforms in all situations

KeePass does this. Autofill activates the last window, finds the "input control" on the window, then tries to type in the username, tab key, password. It breaks in all the expected ways, and sometimes new and exciting ways.

That is software emulation though, which is restricted by various things (can't type across users (so breaks on Run As, and elevated windows), if a window implements a custom control, it won't work with that either since that window likely reads from the keyboard in a weird or wonderful way, some windows also just avoid any windows messaging and read the keyboard directly)

Hardware faking of the keyboard would work fine though

I use pass ( http://passwordstore.org/ ). Uses gpg, has addons for all major browsers, works on Android, is completely transparent, supports segmenting your password "tree" to use different PGP keys depending on path (e.g. all passwords in www/ encrypted to both my safe GPG key and my less safe key unique to my phone). Highly recommended.

any iOS app for it?

There are a couple: https://github.com/davidjb/pass-ios https://github.com/mssun/passforios

Passforios is being actively developed and is shaping up well.

I use password safe: https://pwsafe.org/ with a strong central password and store the safe it in my Dropbox. Even if my cloud was compromised, the safe is highly encrypted.

PasswordSafe's safe is an open source file structure and thus there are many different ways to access it with different features for each. I have PasswordSafe on both my Windows PC and android phone and I'm using PasswordSafe professionally for my organization's passwords and found that there are reliable Mac options so those with Macs can access the safe.

Seconding 1Password. It also works on Firefox and can be used from Mobile Safari and apps that implement support specifically for it, if you have an iPhone.

Keepass, although to be fair I don't think all the plugins on this page have been properly reviewed: http://keepass.info/plugins.html

Have you tried Dashlane? I've been using it for over a year and it's been great. Their mobile app is really handy as well.

1Password

The killer android support is why I still use it. Auto fill in any app.

You can do that with keepass2android as well.

Made me laugh nervously and cancel my subscription...

ROFL. Seriously considering cancelling.