Currently, I am a Windows 10 user who uses Chrome's default password manager and let it autofill in passwords for me.
Apparently, if I were to accidentally execute malware or give someone momentary access to my computer as a Windows user, they could not only scrape all of my Chrome autofill usernames, e-mails, and respective websites, but also easily decrypt all of my passwords to plaintext using the CryptUnprotectData function since all of the information is stored locally in a
.db file. Do all offline password managers have this problem?
I assume an online password manager such as LastPass would help prevent this since all of the passwords are stored on the cloud rather than locally, and even if the malware keylogged my master password, it'd still need to pass 2FA to get to my passwords.
Another concern I have is the integrity of the passwords. I am not practicing good security habits right now and tend to use the same few passwords across 30 websites only because I can remember all of them.
If I were to generate a random long-character password for each website using a password manager such as LastPass, how can I be confident that the application will safely store and remember my passwords for the foreseeable future? What is simply stopping the authors from say, randomly shutting down the app in 5 years and then I will have essentially lost all of the passwords to my accounts, having randomly generated them all? Is this an unlikely scenario? And is there a way to safely and securely export all of my passwords in the unlikely event that this happens?