Other password managers don’t have Last Pass’ long history of security concerns. They also have hardening against this specific scenario. For example, 1Password assumes they could be breached and includes a strong random key which is unique per-user so in an event like this the attacker would have to do a lot more work to break vaults:
If one site is breached you have to go change your password everywhere. By using a password manager if one site is breached you just have to change that one password for that site. Using the same password everywhere is a real concern that should be avoided at all costs.
LastPass's breach is the exception to the rule. Generally speaking password managers have had a far better go of things than LastPass has.
By far, using a quality (LastPass is not one of them and frankly never has been) password manager is likely going to be the most secure thing that any average user uses every day.
This breach is much the same as the typical media stuff, hyperbole does no one any good. One bad thing happens and the sky is falling (hyperbole). No, the sky is falling for that app (LastPass) but not for every password manager. You have two really good options: Bitwarden and 1Password. I, personally, wouldn't touch any others that are cloud based. Local password managers are another matter, but they're simply a non-option for me and I'm not willing to give up the convenience, or the administration abilities that come with it in a business environment.
Or to just use the browser's saving functionality and never push your passwords online in the first place. They're probably only using one primary device like me; I generally don't log in to stuff on my phone, or personal stuff on my work laptop/work stuff on my personal laptop.
If their habits are like mine then these cloud password services are pretty pointless.
Also, with your setup, what happens if the computer with the browser containing all of the saved passwords is destroyed somehow?
I don't know if this has changed, but a few years ago the stored passwords in Chrome were stored unencrypted in a sqlite3 database. (on Linux, at least) I'd use an audited service such as Bitwarden or roll my own Keepass thing before using the browser's saved password feature. All it would take is one RCE exploit in a browser to expose your passwords.
This has already happened a few times over the past decade: I restore from local backups.
Also: https://ohyicong.medium.com/how-to-hack-chrome-password-with...
Passwords are still easy to obtain outside of Chrome, and apparently Firefox is just as easy.
By using the browser's saved password feature you are one RCE away from someone being able to automate the extraction of all of your passwords.
I'm pretty sure on Firefox if you have the master password set, they're actually encrypted, and has done that for a long time.
What's wrong with storing them locally on your laptop or on a piece of paper in your wallet?
Storing on a piece of paper is inconvenient because there are roughly 350 logins in my password manager.
My main gripe with LastPass is that they did not encrypt everything. Vast amounts of important information (email addresses, billing addresses, telephone numbers, IP addresses, website URLS [0]) were not encrypted on user's local machines with the master password, and subsequently have fallen into the hands of a malicious actor.
I would feel much better about LastPass if the security genuinely was safeguarded by a strong master password. But they've demonstrated that it's not.
Other password managers, as far as I can see, provide much greater protection in terms of encrypting everything. That's why I'd feel better about using them.
[0] https://blog.lastpass.com/2022/12/notice-of-recent-security-...