Password Managers, is this the best option user’s have?

Before reading the following, ask yourself if you’d recommend to the average user that they store their passwords in a local password manager.

Today there are four primary ways users lose control over their web-based passwords. Phishing Scams (email or SEO), Malware (installing malware or drive-by-downloads), website break-ins (SQLi, RFI, misconfiguration, etc.), and website brute-force attacks. For a user to protect themselves I’ve outlined the client-side technologies they can deploy (reason MFA is left out) and possible changes in their online behavior.

Phishing Scams (user hands over their passwords)
Client-side technology solution(s): Web browser security add-ons and anti-email-spam tools.
Behavior: Tell the difference between real/fake and safe/dangerous websites & emails using available visual indicators.
Outcome: The technology is not consistently effective and users are unable to reliably make accurate real/fake or safe/dangerous decisions.

Malware (passwords stolen off the PC)
Client-side technology solution(s): Update Web browser, Web browser security add-ons, desktop anti-malware, and scheduled patch management.
Behavior: Don’t install “bad” software off the internet. Don’t use a local password managers.
Outcome: The technology is not consistently effective. Users WANT to install software and by extension WILL install “bad” stuff. Users are unable to remember multiple hard-to-guess passwords so they’ll either write them down, have the same password across multiple websites, or use a password manager anyway.

Website Break-ins
Client-side technology solution(s): nothing
Behavior: Use different hard-to-guess passwords across websites.
Outcome: Users are unable to remember multiple hard-to-guess words so they’ll either write them down, use a password manager, or have the same password across multiple websites anyway.

Website Brute-Force Attacks
Client-side technology solution(s): nothing
Behavior: Use different hard-to-guess passwords across websites.
Outcome: Users are unable to remember multiple hard-to-guess words so they’ll either write them down, use a password manager, or use the same password across multiple websites anyway.

Now, consider the options users have for personal password handling:

1. Mentally remember different passwords
   
2. Write password down
3. Use a password manager
4. Use the same password across multiple websites.

Which should the experts recommend to the average user?

By enlarge users are unable to remember multiple hard-to-guess words so let's cross #1 off the list. From a security perspective the prevalence of malware has made written passwords easier for a user to keep safe than storing them on a PC. But, from a user perspective, this approach is terribly inconvenient and makes password managers or using the same password across websites more attractive.

If we consider the threat landscape, massive numbers of websites compromises who don’t encrypt their password, a password manager is preferable to having the same password across many websites. If a users account is compromised via website hack, ideally it should not impact the security of the rest of their online accounts.

On the other hand a PC getting infected with malware is a very common problem and could lead to every record in the password manage being lost. However when this happens the user has worse problems than a compromised password manager, i.e. Man-in-the-Browser attacks makes a password-only theft highly unlikely.

When you boil everything down, if a user can mentally remember multiple hard-to-guess passwords across various websites, this is their best option. If they can’t and don’t mind the inconvenience, write the passwords down and keep in a safe place. If they do mind (the inconvenience) and feel their PC is reasonably safe, password managers are the next most secure option. Perhaps the browser vendors should provide a native hard-to-guess password generator in the browser to auto-populate login/registration fields. Better still if they store them in the password manager by default (opt-out rather than opt-in). Then again, unless truly fixed this would encourage using XSS to steal from password managers.

What we do know is left to their own devices, users will continue to the use the same (weak) passwords across multiple websites -- and we know where that leads.