Sure if you are in a position that your threat model includes actual targeted attacks then you need to reconsider things. But then software password managers might not be the way to go regardless.
A lot of security advice needs to be taken in the context it was given - that context is always a specific threat model(s).
Writing down passwords in an office is a terrible idea, keeping a small book with passwords in a drawer in your study is quite fine for most people.
Security is always a trade off between different threat models, anything you do reduces the likelihood of ones and increase the likelihood of others.
Encrypting the laptop reduces the chance of some random person extracting data if the device is lost or stolen, also to some extent reduces the chances of it being successfully searched by law enforcement. It does however increases the chances of a threat agent torturing you or your loved ones for access.
Now this isn’t an argument to not use device encryption, unless ofc the threat of violence is actually real at that point neither option might actually be viable and you would look for other means to store and transport data other than an encrypted device.
If they were as easy targets as you imply, then they’d already be exploited.
The fact they’re not demonstrates that’s reused passwords is lower hanging fruit.
1) not use any manager => bad
2) use a 3rd party => pretty crap as the article says
3) use a built-in => great
Why would you ever use 2? This is almost as bad as Bitcoin, which not only solves nothing but also destroys a ton of energy.
I have never used a manager except for the builtins. And I would have never expected them (prior to reading this article) to be such utterly junk solutions to just inject additional code into the website itself. I thought there's a dedicated browser API or something.
- portability, if I use chrome on my desktop, firefox at work, and safari on mobile I'm out of luck.
- built-in password managers only work for websites - I store many non-website security credentials in my password manager
- extra details - I often add the security questions for a site into my password manager
- compromised password warnings (maybe some of the built in password systems do this now?)
The one integrated with Firefox supports integration with an Android stored password entry tool. As a manager it's of very poor quality - better to do all your actual management from desktop Firefox - but as a tool to enter a stored password into an app, or to save the password you just entered, it works quite nicely.
> - compromised password warnings (maybe some of the built in password systems do this now?)
Firefox does have that service
1 obviously isn't.
