I hate how many places don't allow for + aliases. I want to know who leaked my email.

Catch-all address 😎

I've started using {emailaddress}+{sitename}@gmail.com i.e. myemail+xyzCompany@gmail.com

That way I can at least see who sold my info. I wish I would have started doing this long ago though. Some sites dont let you use the plus symbol even though it's valid though

I've found that there are a handful of passwords that you need to remember, the rest can go in the password manager. This includes the password for the password manager, of course, but also passwords for your computer/phone (since you need to log in before you can access the password manager), and your email (to be able to recover your password for the password manager).

You are also correct that length is mostly what matters, but also throwing in a random capitalization, a number or two, and some special character will greatly increase the required search space. Also using uncommon words, or words in other languages than english can also greatly increase the resistance to dictionary attacks.

You are mostly correct it is length * (possible char values).

See passphrase generator.

https://www.keepersecurity.com/features/passphrase-generator

As always, the most secure password is the least convenient and accessible. It's a trade off, but you want fewer dictionary words and patterns overall. Preferably with a physical component for the master password.

Longer is better...giggitty.

If someone can gain physical access to your PC you are done anyway, he van simply copy the file or do whatwver he want

Yes, it is better. The likelihood that someone will physically access your device is incredibly low, the likelihood that one of the services in your bucket gets leaked and jeopardizes your other accounts is way higher.

I set mine to require my password after a period of time on certain devices (the ones I'm likely to lose), and all of them require it when restarting the browser.

it just unlocks with a fingerprint, and I think law enforcement are allowed to force you to biometrically unlock stuff

True, but it's also highly unlikely that LE will steal your passwords.

My phone requires a PIN after X hours or after a few failed fingerprint attempts, and it's easy to fail without being sus. In my country, I cannot be forced to reveal a PIN. If I travel to a sketchy country or something, i switch it to a password unlock.

Bitwarden has been good for me, but I actually don't know about safari...

Keepass does a pretty decent job. I have keepassXC on my Windows, Debian and Android devices. On Android it's integrated into the phone(and the autofill service if actual 2fa isn't supported on the app) so it works on every application. With IOS though I know they can be a stickler on anything remotely technical so I'm not sure if something similar exists with it. I also use syncthing as the service to make sure the same copy of the database is on each device to prevent having to use a password manager that requires a subscription for a cloud service, this also minimizes my risk factor of a cloud service being compromised.

Heard great things about bitwarden. I’ve personally been using 1Password for over a decade.

For mobile safari Bitwarden (and I think a number of others, but Bitwarden's the only one I can speak to) ties into Apple's password management system for autofill and password generation. Still have to use the app or webpage (either Bitwarden's official site or self-hosted vaultwarden) for more in depth management.

For mobile Firefox, on iOS it's the same as Safari. On Android you can either use the Bitwarden add-on or use it with the app and Android's built-in password management system just like on iOS.

Since you mentioned "all browsers" for chrome/chromium based browsers there is also on add-on for both mobile and desktop. For Internet Explorer and pre-chrome Edge I don't believe there's an add-on but it can still work, it'll just be more of a pain since you autofill either won't work or will be spotty. You'll probably be relying on the standalone desktop app.

On MacOS it integrates with Apple's password management, so no need for an add-on on desktop safari.

For other browsers, you'll probably have to use the desktop app and manually copy/paste just like for IE.

I also remember seeing some third-party integration for the windows terminal app and various Linux terminals, but I can't really speak to their quality or functionality since I haven't used them. But that would probably cover your needs for terminal based browsers like Lynx.

Not an iOS user and it certainly seems like something they would be behind on, but with Android every password manager with a Android app will work since the hooks are built directly into Android. Other than websites and apps that don't implement passwords properly it works pretty well.

Bitwarden

I'm a big fan of the Keep It Simple (KISS) approach, and went with Password Safe. Works on Linux, Windows, MacOS, iOS, and Android. It's big thing is it just makes an encrypted password file which then you can sync between devices however you like (Box, Dropbox, etc)

Which one works on all browsers including mobile safari and mobile Firefox?

It has an auto-type and copy feature, so no need for browser support. Though, the main criticism of this offering is if you want a ton of features and don't care about KISS.

Keychain should work in both now. (iCloud passwords)

If there's one thing I've always been wary of, it's the password manager browser extensions. And I've been proven right. Don't be lazy, it takes 30 extra seconds to do it manually.

Pishing detection is nice though, I'll admit.

Got any examples? Because I have…some…examples of password reuse being a real-life problem.

I seem to remember that the passwords were encrypted so, all they got was the passwords people use for their password manager which because people were using the password manager and therefore had random passwords it didn't really matter hugely.

Just as an example, 1Password has a secondary encryption key that they can’t even recover. If you lose it, you’re fucked. I doubt the chances of that being cracked are any good at all.