all the speculation in that thread about how the password could have been leaked reminded me of a post earlier this year that drastically changed my view on password managers. (also generated a lot of discussion here)

https://news.ycombinator.com/item?id=27407603

Seems like the lesson there is to use a standalone password manager, rather than one that's a browser extension?

I'm not inclined to run anything that's remotely related to password security in a browser extension (I do use the Firefox built-in password manager to simplify logging in to sites like this one, where I have no money at stake and nothing much to lose but my pride).

For high-value logins, I use Passwordsafe. It's annoying; the scroll behaviour is annoying, and it's Windows-only, which is sad. But it's resolutely local and un-networked, and I'm confident that my secrets are well-protected by my (complex, long, memorized) master password.

Assuming you're talking about pwsafe 3, it's not Windows-only. I am actively using a Java implementation on MacOS and rely on my Android app for frequent use. Password file is synced across devices via a cloud drive provider. Works great, and I'm in control. (I also rotate my password file + master password every few months.)

Some guy did an long analysis and figured for most purposes you are as well to use the built in ones in Chrome or Firefox. Personally I kind of like Bitwarden.

Why not the one built in to the browser?

It doesn't compromise the master-password and is not wide-reaching as it requires the victim to be lured to a specific website.

Doesn't match what people claim here