In the end this always comes to trust: you must trust that the program is doing what it's saying, and you should pick a company you are willing to trust. Keep in mind that a password manager is not by all means the only software you trust nor the only software that could steal or leak your passwords. Or you could accidentally paste the password to a fake web site. Or something could be monitoring your keyboard or clipboard. This level of paranoia would require ruling all these possibilities out, too.
Just like Troy Hunt reasons in Password managers don't have to be perfect, they just have to be better than not having one. I also like how this article points out that a paper copy kept in a safe place has less possible attackers than anything saved on a computer.
Password managers are a good thing. Even when issues like the LastPass
one above are found, they're still far superior to our frail human
brains when it comes to your overall security posture. Until such time
as that changes and either they're worse due to a flaw that actually
causes some serious damage or we create something better again, this
is where the game is at. Less sensationalism, more pragmatism.
How to pick a password manager you could trust?
The most paranoid options:
Create one by yourself. It's a hard thing to code a password manager from scratch, but it could be combined from other tools. This has a limit that you must trust them all. To fulfill all the general functionality of a commercial password manager you need:
- A tool that creates (truly) random passwords.
- A tool for encryption: you could store them as files in a VeraCrypt disk.
- A tool that can be automated to securely sync the encrypted version between your devices, e.g. Rsync. The less you trust the encryption the more you need to secure the communication: you could e.g. do this only on your LAN.
Only use an offline password manager that doesn't communicate over the network at all. Update it manually and block its access to the Internet. If you need to have the passwords synced across multiple devices, see where the database is located and sync it with an external tool you can trust.
If you can loosen your tin foil hat a little, take a look at the described functionality of the password manager you are planning to buy. If it stores the passwords unencrypted on a cloud (or does the unencyption on server-side), forget it. If it doesn't encrypt the password (like the ones built in the browser), forget it.
If the password manager encrypts the password locally and synchronizes the encrypted version, that's a lot more secure architecture. This should be your minimum requirement. To a certain extent you can check whether the program seems to work at described. The rest comes back to trust.
Many antivirus vendors have expanded to password managers. If you already trust a company that much to give them ultimate power over your operating system, it is not very practical to avoid trusting them in this matter, is it? Aviva Zacks has compared Kaspersky, Bitdefender and Norton. I'd add F-Secure, as their TOTAL solution now comes with a license for a password manager, KEY.
What if someone finds a vulnerability in my password manager?
You can estimate your risks by reading about the vulnerability and how it can affect you. If you don't have the expertise to estimate your risks or if you find yourself at risk, wait for them to fix it, update your password manager and then change your possibly compromised passwords. Or switch to another password manager.
