ava on Nostr: 1Password is not open source, so I'm not a fan. I find Proton Pass has better ...

1Password is not open source, so I'm not a fan. I find Proton Pass has better integration and UX than Bitwarden, though I also recommend Bitwarden.

Both Proton Pass and Bitwarden are great for syncing to cloud-based password managers (PWMs) and are awesome for people whose threat model allows for more convenience.

The reality is, most people will not sacrifice much convenience for privacy. They would rather use (and reuse) easily crackable passwords that they can remember than deal with a PWM that does not sync on all their devices.

For many, if not most threat models, using a PWM is a huge step forward for their OPSEC (Operational Security). It is scary how many people still don't use password managers. Using and reusing easy-to-remember (and crack) passwords is far riskier than the potential threat of a PWM hack.

Okay, that said, KeePassXC is awesome! It's a great PWM to install in an air-gapped VM on QubesOS, for example, for more sensitive "mission-critical" passwords and even seed phrases that you don't want syncing anywhere.

KeePassDX is also great on mobile for more sensitive passwords. One can even use SyncThing with end-to-end encryption (E2EE) to sync its database to other devices, should they choose to do so.

I recommend storing any mission-critical recovery phrases for other password managers, wallets, 2FAs, etc., in KeePass since it does not sync with any cloud.

For convenience with less sensitive or frequently used passwords (know your threat model), both Proton Pass and Bitwarden are great options. Bitwarden can even be self-hosted, and that's pretty cool.

I gave Proton Pass a test spin about a year ago and still haven't returned to Bitwarden as my daily driver.

If anyone is concerned about Proton being an all-in-one service, they can sign up for another free Proton Pass or Proton VPN or Proton Mail account over Tor, then upgrade using BTC or cash. These accounts would be completely separate from the user's main identity account and used for purposes one does not want associated with their identity at all.

If you sign up for a paid plan, you will have to use a credit card. If you sign up for free and then upgrade, you can use BTC, cash, etc.

Do not provide a recovery email or phone number; they are not required and are metadata that could be used to identify users. Instead, use their recommended recovery phrase.

This way, one can manage their business, get away from Google, use it for all the front-facing tasks, then sign up for a separate Proton VPN and Proton Pass account not associated with their front-facing Proton account for other purposes they do not want associated with their identity.

Privacy and security through isolation and compartmentalization.