> But your apparent absolute confidence in the superior security of password managers, especially closed-source cloud-based password managers, seems to me to be

> But your apparent absolute confidence in the superior security of password managers, especially closed-source cloud-based password managers, seems to me to be overplaying your hand a little. The failure mode of a closed-source cloud-based password manager, even if very unlikely, is absolutely catastrophic. In fact it's you that's overplayed your hand. Open-source vs. closed-source is a red herring. Did you download compiled binaries published by the authors of an open source project? Would you be able to tell if they had published backdoored binaries that didn't match the source? Would you be able to tell if they cleverly added backdoors to the source code itself? You might argue that such deception would eventually be discovered. Maybe, but by then the "catastrophic" scenario has already unfolded. Similarly, if you're downloading and running a third-party deterministic password manager, open-source or not, you're giving the author of that project the ability to run arbitrary code on your machine. Unless you're running it in a container with no network access or access to storage, the failure case is identical — regardless of what the software claims to do on the label, it may do something wildly different (e.g., send all of your passwords to the author).