I want to recommend a password manager to my non-tech friends and family and help them set it up and use it. One of the decisions I have to make is whether I recommend one that works on laptops or one that works on smartphones.
- Have much better application isolation. This is by far the biggest plus.
- Are carried around everywhere, eliminating the need to even consider an online password manager since people always have access to their password manager already.
- Are a pain to disassemble. Where cold boot attacks against desktops and laptops are extremely rare, I'd consider them even rarer against smartphones.
- Are a pain to type on, limiting how long a master password can be. On the other hand, most non-techies probably don't type very fast on computers either.
- Not a single smartphone password manager allows generating passphrases, which are much easier to type over into a computer than a random password, while being equally secure. (5 random words (43k-words dictionary) contain 75 bits of entropy, 12 characters (alphanumeric, mixed-case) contain 70 bits).
- Are easier to reliably script on, to make backups of the password database. In my experience, mobile operating systems kill things left and right to save battery.
- Might be compromised by clicking the wrong thing when browsing. I feel like smartphones don't have this issue as much, and even if someone installs a bad app from the store, it should be isolated.
- Allow for copying the password rather than typing it over from a smartphone, allowing for stronger passwords. (99% of the time, people will log into an account on their laptop, not on their smartphone.)
- Have more password managers available. For smartphones, there is exactly one proper open source password manager whereas for laptops I know several.
I conclude that smartphones have a slight advantage, but I have to find a solution to generate passphrases, ideally by using a custom keyboard so they don't have to be passed through the clipboard.
Did I miss any (important) considerations?