I don’t really trust any of them fully, but I also don’t want to use the same password everywhere. So I use one.
I’m a 1Password user. Works on both Mac and Windows. Integrates well with browsers and doesn’t seem picky about which browser. They all work.
DEFINITELY had a major security problem a few years back. I liked their response to it and quickness of fix.
Here’s the deal on it though. I do NOT use their cloud based thing they came out with. Or their family thing. Or their team thing.
I use a single Dropbox account that’s dedicated to that job. That’s all it does is hold the encrypted files from 1Password. That’s it. It’s linked to all the machines that need to do 1Password stuff, and that means I don’t use Dropbox for other storage.
You could. I just don’t like to mix. No reasons other than my own. I use other things for cloud file storage.
That setup “feels” the best to me. I have a VERY small number of passwords that simply will never ever be in a password manager EVER and are only in my head. You have to choose if you need some of those or not on your own.
With two-factor being prevalent and available these days, tools like 1Password only handle one half of that. I like that for the sites that are important but not enough to memorize the password and never put it in the manager. And also for work stuff. We require it for the most part, across the board for things.
Downsides on TFA. If you’re using a number generator app on a mobile device, it’s a) A problem if your device battery dies. B) There’s way too many attack targets for a smartphone. But... it’s better than not doing it.
And the hardware based PIN generators in the past from some really big names in security, have had mathematical flaws that made them vulnerable. The biggest and most egregious was RSA’s keyfob tokens that were busted but they never recalled them, didn’t offer money back, nothing. Just “buy new ones” from them. Scum suckers.
At the end of the day, there’s going to be holes in all of these. Look at the patches and the quality of software now that we’re into the “daily patch” IT lifecycle and you’ll see it’s not getting better.
But that also means most of these websites also have awful code and are going to get hacked. So your password won’t even be needed. Hahahaha.
Perhaps a bit of a fatalistic view, but I see the sausage being made. It ain’t good. And we have a generation of “security” experts now who’ve never seen code. Let alone low level machine code. They don’t really understand what the machines are actually doing anymore. Which has made some of the hardware exploits that look at remnants of what’s in memory and what not, really impressive. The recent processor based exploits are brilliant. And still not properly fixed by Intel. Starting to doubt they’ll ever figure it out. They haven’t released working microcode that doesn’t screw up the hardware behavior yet. It’s been almost two months and they were notified long before this one went public.
