I sense an overall push towards password safes (cloud/local). Now that people tend to use more and more those technologies I looked for best practices or formal advisories on password safes but did not find anything valuable.
Is there anything published about that? I mean more recommendations than "use a secure master password and do not lose it".
My password safe for instance allows me to use my windows logon as a means of authentication. It also can lock itself after a certain amount of inactivity or when you log-off from your machine, your screen-saver starts, etc. All those features trade security with comfort.
If I have a ~40 char password and decrypting the database takes 2 seconds I might get annoyed by doing this 10 times a day.
KeePass for instance suggest that you encrypt the password file multiple times to increase the work time, but a normal user switching to a password safe won't probably understand the impact of that. Even if such a user would google that he or she would still need to differentiate between hashing something multiple times and encrypting it, etc.