so your reasoning for not using a password manager is because they may be tricked by defacing or sneaky scripts, and yet you don’t consider yourself vulnerable to phishing when entering your password manually?

Would be more relevant if you linked to something relevant to your argument not just the wiki on him.

Travis actually recommends several https://lock.cmpxchg8b.com/passmgrs.html

Good examples of simple and safe password managers are keepass and keepassx, or even pass if you’re a nerd.

He doesn’t like password managers that are hosted or integrate with apps via plugins.

Password managers are technically a convenience at the cost of security. At least compared to memorizing dozens of long unique passwords. I’d probably host my own if I were going to use one. For now I just memorize a ton of random characters and then reset my password when I fail to remember. 😅

I tried his “try this example if you have NordPass” page, and it didn’t do anything in Brave mobile other than load a blank new tab. Maybe they’ve changed their mechanism, or maybe I should be less lazy and try it in another browser. For me on NordPass and Android, though, the password selection is shown on the keyboard, not within the content area.

I also don’t know about his claim about the invalidity of any vendor’s “we can’t see your passwords” claims. If their software is audited (which is probably easiest with Bitwarden due to its open source–as long as you trust who distributed the built binary) to verify the code is encrypting your key/value store locally with your own passphrase prior to sending, they would have to crack the file to access its contents. But I take his point to be more about trusting their software to do what they claim, which, he points out, may even be out of their control if a malicious actor gets privileged access to modify their software. But, if I’ve understood that claim, then it is just as applicable for any centralized application; in other words, also don’t use web browsers in the first place.

He’s got other points about APIs I’m not familiar with, so I have to admit I’ve only focused on 2 of several points. But, for the 2 I thought I followed, I wasn’t seeing those arguments go down the same road he did. This has gotten me thinking though, and I still won’t dismiss the thought entirely. Interesting article.

deleted by creator

He does recommend using the built-in browser’s password managers; he just had beefs with how the extensions, which the non-browser password managers have to contend with, are implemented, and with the security of the vendor’s network and software. He himself uses Chrome password manager.