ava on Nostr: If it's mission critical, I use Keepass since it's device only and not in the cloud. ...
If it's mission critical, I use Keepass since it's device only and not in the cloud. There is always a risk with cloud based anything, but I also use and recommend cloud based password managers like Bitwarden and Proton Pass.
It is the classic story of convenience vs privacy, so whether or not you decide to put credit card info in your PWM is dependent on your threat model and risk tolerance. If you use a strong master password with lots of entropy, you are likely going to be okay.
The risk for most people of hackers making off with an encrypted password database from the cloud and it later being cracked with something like a quantum computer is far less than them not using a password manager to create unique, high entropy passwords for every login.
Personally, I am ok with cloud-based PWMs for most things. Though, there are certain passwords and information that I only keep in an air-gapped qube on Qubes. I also keep my cloud based PWM recovery phrase and 2FA app recovery phrase in the air-gapped Keepass vault.
Just remember your OPSEC and keep at least 3 backups.
I also recommend encrypting the backups of the KeePass vault with a kind of multisig encryption where all pieces are required to unencrypt the database file, with the final piece being committed to memory. You can hide these pieces in images or something similar or give them to trusted people. I will not share my method.
This way even if my distributed pieces are somehow compromised, the final piece required to gain access to my already encrypted password database (with master password) is safe with me.
It is similar to the method Snowden used to secure the files he gained access to before sharing them with the world.
In the event of a kidnapping or torture of you, or your loved ones, you could be forced to give up your password, so I also have a contingency plan for that, but that is a secret, and I will keep that to myself.
It is the classic story of convenience vs privacy, so whether or not you decide to put credit card info in your PWM is dependent on your threat model and risk tolerance. If you use a strong master password with lots of entropy, you are likely going to be okay.
The risk for most people of hackers making off with an encrypted password database from the cloud and it later being cracked with something like a quantum computer is far less than them not using a password manager to create unique, high entropy passwords for every login.
Personally, I am ok with cloud-based PWMs for most things. Though, there are certain passwords and information that I only keep in an air-gapped qube on Qubes. I also keep my cloud based PWM recovery phrase and 2FA app recovery phrase in the air-gapped Keepass vault.
Just remember your OPSEC and keep at least 3 backups.
I also recommend encrypting the backups of the KeePass vault with a kind of multisig encryption where all pieces are required to unencrypt the database file, with the final piece being committed to memory. You can hide these pieces in images or something similar or give them to trusted people. I will not share my method.
This way even if my distributed pieces are somehow compromised, the final piece required to gain access to my already encrypted password database (with master password) is safe with me.
It is similar to the method Snowden used to secure the files he gained access to before sharing them with the world.
In the event of a kidnapping or torture of you, or your loved ones, you could be forced to give up your password, so I also have a contingency plan for that, but that is a secret, and I will keep that to myself.