I still don’t understand what makes these password managers more secure like … if you know the master password, you have access to EVERY password instead of maybe the password of one site
Perhaps, but is that
worse, and less secure than what people normally do, like:
- reuse passwords across sites? (which in itself ends up essentially recreating the "one password" problem)
- save a file with all their passwords in it?
- write their passwords down physically?
I have nearly 3,000 logins saved with a password manager. Each with their own separate, unique password. My "master" password is very long and randomly generated. Not written or saved anywhere other than my memory.
Now, if I could remember 3,000 unique logins, then there wouldn't be a problem...but I can't. So, on balance, I find it less likely that someone would breach and/or brute force my master password from a company who's
whole business is password protection.
In my own calculus, I find it that more secure than it would be for me to keep a limited number of password variations like "Upperlowercase1!" "upperlowercase1" and "upper.lowercasE", and potentially use one of those at a company who stupidly stores them in plain text instead of a hash and is then breached.
Is that 100% fool-proof? Of course not, nothing is 100% secure, every decision is a tradeoff. I'm simply
betting that the risk of using different passwords everywhere provides more security than the alternative, because protecting that information is more central to the password companies core business than some random Shopify store or a Home Depot or whatever.