No I mean the password manager itself has no 2FA. It is impossible to implement 2FA on this kind of password manager. Almost all password managers like 1Password, Bitwarden, etc. implement 2FA so even if your master password is compromised (e.g. by a remote keylogger), an attacker can't get into your vault without physical access to one of your existing devices.
What makes you think that?
Because when a seed password is compromised it could mean all future accounts are compromised. So then you have to increment or supplement with some state, and change all past account passwords.
If a traditional master password is exposed its database/file may not have been. In that case only the master secret needs to change.
Edit: correction: seed not derived.
Uhm, no? There seems to be no direct relation between each passwords. So an attacker does not know by default that there is a masterpassword or what it is. For the real word there is no compromising if just login-data are randomly leaked.
A high level attacker who get's to know your used system could use it probably as an attack-vector, but again, that's not what normal people prepare for.
On a similar note, I also think it's bad security hygiene to have accounts on hundreds of services in the first place, if changing all of your passwords is an insurmountable task. Might I suggest deleting a few accounts a day for lent?
I don't understand this. In what case would there ever be "past" account passwords that I would have to change?
What do you mean? Does this tool prevent you from setting up 2FA on a service?
> and less convenient (changing a master password is a pain)
Changing passwords on many servieces is always as pain. But why should you change the masterpassword?
> than a password manager is getting so much attention (2000+ stars on Github, WTF!?).
Because it's pracmatic and secure enough. It's not secure enough if you are aome high value-target, but surprise, most people are just casual, which random malware and hackers being the worst level of attackers. Against thse this is plentiful, and better than what people use otherwise.
You don';t need to strive for perfection, when a 90%-solution works fast enough.