As an older coder, I’ve spent time commercially programming in a lot of languages (C, C++, C#, Python, TransactSQL, Javascript, and a few more - with many years of experience in each. I even spent time squeezing some forth code into a small programmable chip.

My first comment on this « attitude » expressed above is that you need to pick the language (and its libraries) that is best for your problem space - each will have advantages, including constructs and libraries to suit whatever domain you are working in. Hence forth for a microchip, TransactSQL for DB stored procs, python for general purpose command line work etc.

Having said that I do want to present one viewpoint which could give rise to this above expressed opinion. It’s an area that C is considered pretty strong - specifically language complexity. When coding in C, I really felt like I knew every nook and cranny of the language, exactly how every structure would be packed, what the assembly would probably look like.

Python (and perhaps C#) are currently my favorite languages - python only has 36 keywords and while I don’t have the same solid grasp of what’s happening under the hood, I do feel like there are very few surprises and corner cases to the language, even while supporting some complex programming methodologies.

The opposite of this is (IMHO) swift. What started as a really nice language with a clean syntax and solid libraries has morphed into a monster with 232 keywords. Does any swift programmer have a solid grasp of it all?

I would say that C++ is at the complicated end of the spectrum - spend some time inside Boost and their extreme use of templates/meta-programming and it will make your head spin. The Boost developers are super smart people, but its non-trivial to understand what is going on. Having said that, C++ does make you feel that you can code close to the machine and have a good handle on what is happening under the hood.

This level of control is probably one place where this « only C and C++ code is any good » attitude came from. Its not an attitude I support.

Lastpass was hacked and might have lost control of some data https://blog.lastpass.com/posts/2022/12/notice-of-security-incident

1Pass hasn’t been hacked directly, but they were affected by the Okta https://blog.1password.com/okta-incident/

(One of the most common vectors for hacks is through your vendors - see Target https://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/)

Dropbox had an unauthorized access, but the seemed on top of it. https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign

Dropbox also has had a more significant data breech, but a while ago. https://www.twingate.com/blog/tips/dropbox-data-breach#

Overview of all password manager breeches! https://bestreviews.net/which-password-managers-have-been-hacked/

Storing Drivers Licence: Was answered elsewhere. Bottom line… Bitwarden seems like it can store other types of data. Note that I don’t use Bitwarden yet, but have experience with Enpass and 1Pass, both of which can store all sorts of data.

Why separate storage if Bitwarden is E2EE? You are placing all your trust in a single organization - Bitwarden. If they get hacked, then it is possible for the hackers to poison their software to deliver master passwords (hacks of s/w repositories has happened). I prefer to separate encryption from storage so a hack in both is required to get my data. Note that I do the same for offsite backups to Glacier/S3. I use Arq to do the backup and encrypt the files, then send them to S3 for storage.

The 2023 IBM Report on Cost of Data Breeches indicated that the average time for a company to discover a breech is about 200 days, and on average another 70 days to remediate. That keeps me up at night in my day job as security dude.

Good to know, thanks. I haven’t actually started looking for the Enpass replacement yet, but it sounds like Bitwarden will be a lead contender.

Fair comment, although due to the distributed nature of our implementation we are unlikely to lose services. All Vaults are stored locally on all devices.

Having said that - the copy of the vault on the Mac is backed up with TimeMachine.

[I’ve been a greybeard sysadmin and use 3,2,1 even at home]

My approach to this is as follows:

• the password manager is probably the most important and often used piece of software I own. We (wife and I share the vault) store everything important/private in there - bank details, hundreds of passwords, passport details, drivers licence etc. It is used many times a day by us both.
• Loss of control of this data would be catastrophic, so I took its security very seriously.
• No one company can be trusted with our data, because they all get hacked or make mistakes at some point.

I’m the security dude for a cloud service provider in my day job, so my goal was to use Separation of Concerns to manage my passwords. I therefore split the software from the storage, choosing software from one company, and storage from a second company. That way, it requires a failure on both parties at the same time for me to lose control of all the data.

I used to use OnePass for the software, storing the data in Dropbox. But then they removed that option, so I switched to Enpass. Data is stored in a vault on the local device and synced to a folder on Dropbox, which we both have access to from all our devices (Mac’s, iPads, iPhones). The vault is encrypted using our master password and Dropbox only sees an encrypted file. Enpass provides software that runs locally and doesn’t get a copy of my vault file.

If Dropbox has another failure and the vault gets out, then that is not a problem as long as Enpass have properly encrypted it. If Enpass has a bug making the vaults crackable - again it’s not a problem as long as Dropbox doesn’t lose control of my vault file. I update Enpass, the vault gets fixed and life goes on.

Enpass is very usable, but buggy. It crashes every night (requiring me to start it again and log in), and often loses connection to Safari and wont re-establish it. It got better with a previous update, but has got unreliable again. I’m about to look for another.

Cheers.