LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.
I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers.
My personal passwords are stored on my own personal devices. Syncing between them can be done using any number of methods without uploading to the cloud, but even if I wanted to use somebody else's servers to do that a properly encrypted file with a very strong password could be safely stored anywhere, so there's no need to limit myself to one company's servers. I can use whatever works best for my needs and won't have to worry about what I'd do if the one I was using goes under or becomes unavailable. In exchange for a little extra work you gain a ton of utility and resiliency
> I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers.
That doesn't work for mobile devices. Most people have a work mobile device.
> even if I wanted to use somebody else's servers to do that a properly encrypted file with a very strong password could be safely stored anywhere
This is literally how LastPass and 1Password handle it. If you lose your key, the file in the cloud becomes useless.
> In exchange for a little extra work...
"A little extra work" that is beyond the skills of the vast majority of users.
> ...you gain a ton of utility and resiliency
As someone who used KeePass for more than 10 years until recently, I can honestly say that it was a massive reduction of utility and had no resiliency benefits.
Not the person you responded to, but: I think that most people are savvy enough to know what a password manager is, and most people are not savvy enough to be interested in the work necessary to setup, personalize, and maintaining an offline password manager that functions well across multiple devices. That doesn't sound like a niche subset to me, but I could be way off.
Most of them can't and won't invest the time just to switch to 1Password. The average person isn't going to exceed that bar by a margin that even I, a software developer, wouldn't bother with.
When something is too technical for even an average developer to bother with (because it's unnecessary, not because it's hard), it is totally hopeless for the average user.
It's easy, unless you have actual data, what you have is an opinion.
for a large amount of people, tech and non-tech alike, LastPass and 1Pass are really really good.
I don't think your experience is representative. As I stated in my previous comment, I think the relative success of cloud-enabled password managers vs. more secure options like Keepass are a non-anecdotal form of support for this opinion. But I would be way off (which I also acknowledge).
It's already painful enough to use a cloud password manager; why would I burn hours more of time to maintain a worse experience?
I found vaultwarden to be a nice alternative. It runs on my server at home, to which I connect the relevant devices by VPN. It still requires the server to be online for modification (& the VPN connected), which I find to be a bit annoying, but it solves the concurrent modification issue. Plus, passwords are encrypted at rest and the browser extension verifies I'm using the password on a legitimate website (anti-phishing).
But if you're happy with your variant, I guess that's fine as well :)
This is a dangerous fallacy. Nothing fundamentally would prevent someone who attacked their infrastructure from pushing a malicious app update or a malicious extension update which exfiltrated the decrypted library from the client side.
Yes, if someone got into their supply chain, they could push a malicious update. That's also true of KeePass and every other password manager. There's no way to avoid that vector.
Simply secure the database with a password and keyfile then copy the key file manually to your mobile devices and workstation.
That way you can be certain that your cloud provider has zero knowledge of your key file and also doesn't control the application in which you enter the master password.
I'm gonna ride out LastPass until webauthn really takes off. Which could be soon based on what we're hearing from the mobile vendors.
I'd really like to see wider webauthn support, so I'm curious to know what you mean by what you're hearing from the mobile vendors please?