[Disclosure: I work for AgileBits, the makers of 1Password] We need to put the headline and some of the odd generalizations stated in the paper aside, and look

[Disclosure: I work for AgileBits, the makers of 1Password] We need to put the headline and some of the odd generalizations stated in the paper aside, and look at the specific security issues raised. When we do that, we find that 1Password matches or exceeds the "far more secure" built-in form fillers. If we ignore the title and some odd generalizations, this paper actually spells out how well 1Password avoids various risks when you look at the details. Readers need to go through section 2 of the paper carefully to see which studied systems do what. The most worrisome of the kinds of flaws that browser-based password managers face (filling things for https://foo.example https://foo.example into http://foo.example http://foo.example and filling for bar.example origin forms on foo.example pages) are things that 1Password handles correctly. The things that we don't do "right" in their eyes are things that their recommended alternative (built-in browser form fillers) also don't do "right". I'm not sure that the authors have fully thought through would it would even mean to do those "right". But I encourage people to read the paper and decide for themselves whether we've made the correct choices in our handling of subdomains, and whether filling should be tied to a specific page on a site. What of course does need to be considered are the risks of not using something in the browser. If you are copying and pasting from your password manager to your browser you are far more likely to be tricked by phishing, or cross origin forms than you would be with 1Password. 1Password tries to make it hard for you to fill in your credentials in the wrong place (you have to use copy/paste to manually do it where 1Password refuses to do it automatically), and to the extent that the concerns in the paper are legitimate, there are cases where browser-based fillers may fail to "make it hard" where the should. Contrast that with the alternative of using copy/paste. Copy/paste offers no protections whatsoever against you filling in credentials to the wrong web form. It would be foolish to claim that 1Password's phishing prevention mechanisms can't ever been defeated. But with respect to what was tested in this paper, they are the best out there.