so your reasoning for not using a password manager is because they may be tricked by defacing or sneaky scripts, and yet you don’t consider yourself vulnerable to phishing when entering your password manually?

I refuse to use my brain to remember things and thus Bitwarden it is

Would be more relevant if you linked to something relevant to your argument not just the wiki on him.

Travis actually recommends several https://lock.cmpxchg8b.com/passmgrs.html

Good examples of simple and safe password managers are keepass and keepassx, or even pass if you’re a nerd.

He doesn’t like password managers that are hosted or integrate with apps via plugins.

Using browser’s built-in password manager means you’re locking yourself permanently in that browser, or in case of Safari, locking yourself to Apple ecosystem. I refuse to do that. Beside, I’m sure you already heard about horror stories where Google suddenly ban their accounts. Imagine if you store your passwords in chrome and your account somehow mistakenly banned by Google. What a nightmare!

His arguments have merits though. Whenever I install my password manager extension in a new system, the first thing I do is to disable browser autofill in the password manager settings, which reduces possible exploits surface.

I tried his “try this example if you have NordPass” page, and it didn’t do anything in Brave mobile other than load a blank new tab. Maybe they’ve changed their mechanism, or maybe I should be less lazy and try it in another browser. For me on NordPass and Android, though, the password selection is shown on the keyboard, not within the content area.

I also don’t know about his claim about the invalidity of any vendor’s “we can’t see your passwords” claims. If their software is audited (which is probably easiest with Bitwarden due to its open source–as long as you trust who distributed the built binary) to verify the code is encrypting your key/value store locally with your own passphrase prior to sending, they would have to crack the file to access its contents. But I take his point to be more about trusting their software to do what they claim, which, he points out, may even be out of their control if a malicious actor gets privileged access to modify their software. But, if I’ve understood that claim, then it is just as applicable for any centralized application; in other words, also don’t use web browsers in the first place.

He’s got other points about APIs I’m not familiar with, so I have to admit I’ve only focused on 2 of several points. But, for the 2 I thought I followed, I wasn’t seeing those arguments go down the same road he did. This has gotten me thinking though, and I still won’t dismiss the thought entirely. Interesting article.

He does recommend using the built-in browser’s password managers; he just had beefs with how the extensions, which the non-browser password managers have to contend with, are implemented, and with the security of the vendor’s network and software. He himself uses Chrome password manager.

Password managers are technically a convenience at the cost of security. At least compared to memorizing dozens of long unique passwords. I’d probably host my own if I were going to use one. For now I just memorize a ton of random characters and then reset my password when I fail to remember. 😅