Before last year I hate to say it I was a little slack with my password policy. Not rubbish mind, I tried to split things up into groups, so I'd have a password for random sites that insisted on me having a login and then a medium pass for things like online shopping sites and a super password group for financial stuff, but It's still pretty rubbish. I guess being involved with the crypto world was the awakening, since with all things crypto, security is your responsibility.

So I played with keypass1 and eventually signed up to Lasspass secured with a complex password and 2FA provided by google authenticator. I'm in a position now which is a million times better than before, or am I? Since lastpass is closed source, how am I to know that they technology listed on their site functions as desired? It's trust in a 3rd party.

The main alternative is keepass, since it's open source, however it's not cloud based so getting my passwords from multiple machines and my android device is harder, it's not as convenient. There is a solution, which is to use cloud storage for my database, but I'm not sure I trust Dropbox with my data. Spider Oak might be another contender since it's Zero Knowledge, but again it's trust in a third party. Paired with a keyfile required for opening the database and a strong, yet memorable password (looking at roughly 60bits in strength) I'm guessing this is plenty enough to leave the database lying around on a cloud service. This would be a really interesting use for decentralised storage like Storj

How do you manage your passwords?