Just got another breach email from LastPass, what is actually the most secure password manager right now?
just got the email from LastPass about the Klue breach. third time something like this has happened since I've been a user. I know the vaults weren't touched this time and it came through a third party, but at this point it's becoming a pattern that's hard to ignore.
what gets me is that I moved to LastPass years ago because it was supposed to be the safe choice. now every year or so there's another email in my inbox.
and it's not just LastPass.
Bitwarden had the CLI supply chain incident in April. Dashlane had a 2FA brute force attack recently. even tools people consider bulletproof have had close calls.
I'm not trying to be dramatic about it but when you're trusting something with every password you own, "the vaults were safe this time" stops being reassuring after a while.
genuinely asking, is there a password manager that has actually never had a meaningful security incident? and what criteria do people actually use when deciding one is secure enough to trust long term? open source, audits, jurisdiction, zero knowledge, all of it feels important but I can't figure out how to weigh them against each other.