"It's so convenient!" "I don't like having to manually sync between devices with <100% local password manager>!"
Convenience addicts making excuses for their next hit of convenience... no matter how severely convenience harms them.
Convenience has long been an underrated aspect of security. If you make the secure option as convenient (or even more convenient) than the insecure option people will do it. Of course security is always in opposition to convenience to some degree (otherwise we wouldn't have passwords at all, just type in your username to log in, we trust you completely), but minimizing the inconvenience is key to making the system secure in practice. If you make the system too inconvenient people will just work around it no matter how secure it is in theory.
I think we are beginning to understand this and things are improving, but many legacy systems still suffer. For example NIST guidelines have accepted this and now recommend against time-base password rotation[1] but many organizations still enforce it.
If "convenient + good" isn't good enough and your credential is compromised, your solution fails completely, 0% score.
If "inconvenient + better" does prevent the compromise of your credential, then it is an absolute success, 100% score.
Prioritizing convenience over security while selecting your password manager is like prioritizing keyless entry over functioning brakes while shopping for a used car - it's clearly a stupid decision even from the perspective of a layperson.
I'll shed zero tears as I play the world's smallest violin when people who've made such decisions have their identity stolen, home forclosed, and savings drained because "muh convenience!"
But in practice, making people change their passwords regularly ends up with them inventing convenient workarounds to avoid the mental overhead of having to learn a new password constantly. “Last month I used `Passw0rd!23`. This month I’ll use `Passw0rd!24`.” And then when their password DB is inevitably breached, an attacker has a pretty great guess as to what their password will be next month.
In a perfect world where everyone perfectly followed perfect instructions to the letter, convenience isn’t critically important. In the one we actually live in it, is. And it’s not just me saying this.
Is this your polite, roundabout way of saying "A number of users are literally so stupid that they're incapable of making rational decisions in their own password management practices"?
I would tend to disagree. I think most people have the capability to follow instructions and act responsibily, when they want to. We really shouldn't be letting the general public drive 3-ton SUV's capable of rapidly accelerating to 120+ mph (200+ kmh) if that weren't true, right?
• Pros - actually secure
• Cons - takes about 18 seconds longer and teeny tiny bit of cognitive effort
Options 1 and 2
• Pros - Caters to NPCs and other entities incapable of thought, effortless
• Cons - horrific and lengthy track record of brutally failing to perform the SINGLE necessary function, keeping passwords secure.
I'm with GP. Something's are worth taking a modicum of effort and doing right. Especially for this, especially for this audience.