I use Bitwarden and there's simply no comparison between what Firefox/Chrome offer me and what Bitwarden offers; you can't even add an extra field to the browser password manager and Google helpfully "encrypts" your data with the password they're already receiving when you're setting up their browser. You can change that, of course, but like a router's default password, if you don't have to change it, people won't. There are also other UI/UX problems (had a side move TLDs, good luck fixing that in your browser!) that browsers don't seem to care about for the sake of "simplicity".
The dangers that come with external password managers are because of a lack of good password manager APIs in browsers, forcing them to break the security model. It's easy to say "don't use them, they break some design", especially if you work for a company that designs their own browser, but there are quite tangible benefits to taking the risks, the most important of which is probably "not handing over your data to some browser giant".
Re: this article: if the attacker has access to the browser password database, they have access to cookies and the ability to monitor key strokes. You can encrypt passwords all you want but the attacker can still move laterally between services by just copying your session cookie and hitting the next vulnerable target. Credentials will come next time the user logs in. Thinking about secure passwords is important, but there's a bigger picture that needs to be accounted for.
The writer of this article mostly seems interested in ticking boxes based on how much they hammer on writing policy and enacting policy and talking to people about policy. I'm not sure who the target audience for this blog is, I would guess managers who are looking to improve their company's security?
That is in contrast with this blog post author who fundamentally doesn't understand what he's talking about.
I use Password Safe. It doesn't integrate with my browser, and the database is stored locally. So I'm exposed to no threat from the subscription company; and there's no content script. It's easy to back-up the database. I can store the database and the Password Safe program on a memory stick. And I can use the password manager with any browser.
What do I lose? I lose auto-filling of login forms. That's it. Instead I have to copy-paste a password, something that happens 4-5 times a day.
I'm planning to switch to pass, for a few reasons (notably that Password Safe is Windows-only), but I'm dragging my feet.
It's a bit of a pain to set it all up on every OS. Especially on Windows it feels far from native. But it works well.
I use an integrated browser mostly so I don't need to go through my clipboard, even though Bitwarden has a setting to auto clear the clipboard after copying a password.
A nice feature that some local password managers like KeePass have is that you can auto type them, so the actual password doesn't end up in the clipboard.
Of course, personally I'm not a fan of the idea of the command being interpreted incorrectly or messing up window switching so that my password would be sent to the wrong application.
He specifically says:
> All online password managers work in a similar way, this isn’t specific to any one implementation.
And they do - because that's the integration point they have to use. It's just how the architecture of browsers works.
> And this is from security expert ? Bruh
Not sure what this is supposed to mean but I'll take it as dismissal. Assuming that is the case you should rethink how you assess information because Ormandy knows what he is talking about.
This is a shitty article from someone who doesn't really know what he's talking about. Here is a post from Tavis Ormandy, well-known security expert at Google Project Zero, advocating the exact opposite: https://lock.cmpxchg8b.com/passmgrs.html