I use both browserpass, and pass and consider the pass+dmenu model to be more secure. I keep auto-fill disabled on the browserpass extension, and recommend doin

I use both browserpass, and pass and consider the pass+dmenu model to be more secure. I keep auto-fill disabled on the browserpass extension, and recommend doing the same for any password manager. Mainly because bugs in browser extensions have led to easily exploitable bugs where the extension could be tricked into thinking it was filling the password for google.com, while the page wasn't actually google.com (dubbed Auto-fill sweep attacks on pg25 at https://aaltodoc.aalto.fi/bitstream/handle/123456789/27984/master_Manihatty_Bojan_Viswanathan_2017.pdf https://aaltodoc.aalto.fi/bitstream/handle/123456789/27984/m...)