> You should have different passwords for every site, and you should use strong passwords and a manager, but you don't because you're a normal person.
I'm amazed that people favor remembering passwords over using a password manager. With Firefox Sync, or the Chrome equivalent, you have your browser remember the password, every other browser you use syncs with that so it has the password, and you never need to have it memorized. The only thing that's missing for better usability is a built-in "generate and use a random secure password" mechanism.
If it syncs, that means that all my passwords are out in "the cloud" somewhere, which means I would be vulnerable everywhere all at once should that one master list ever be compromised.
If it doesn't sync, that means I can only get in from one computer, which is occasionally inconvenient.
So I keep my passwords in my brain, which is always with me, or at least with me at all the times when I might need to use a password.
> If it syncs, that means that all my passwords are out in "the cloud" somewhere, which means I would be vulnerable everywhere all at once should that one master list ever be compromised.
For Firefox Sync, that entire list is encrypted using a client-side key in your browser, and the server has no access to the cleartext.
The problem I have with browser password managers is how simple they are to crack. Master passwords are disabled by default (if available at all), and even with a master password, many browsers still don't encrypt them in the password store.
I think mostly the industry is to blame here. We could have had a universal secure 2fa ages ago. I hope that with the advent of smart watches, 2fa could become more sexy, and hence could get more attention from the industry.
I'm amazed that people favor remembering passwords over using a password manager. With Firefox Sync, or the Chrome equivalent, you have your browser remember the password, every other browser you use syncs with that so it has the password, and you never need to have it memorized. The only thing that's missing for better usability is a built-in "generate and use a random secure password" mechanism.