I was gonna ask about the biometrics part in a separate question, but its both about security, so might as well combine it in one post.
Okay so I don’t use password managers. I just try to make easy to remember passwords 3-4 random words + 3-4 random numbers. Online accounts can’t be brute forced anyways. Edit: I mean most websites have log in limits don’t they? Maybe I’ve been mistaken?
For offline accounts, I just increase the words and numbers. For mobile I don’t use biometrics, although I’ve been testing whether or not I want a pin + no biometrics or alphanumeric password + biometrics. I just can’t decide.
I use Bitwarden and I have 2FA where it’s implemented. Why do you say that online accounts cannot be brute forced?
Most online logins have limits. You can’t just try a million passwords in a second.
In theory that is correct. In practice, not always the case. Up until 8 years ago you could brute force iCloud passwords: https://www.intego.com/mac-security-blog/apple-patches-brute-force-password-cracking-security-hole-in-icloud
This is true, but if their password database gets compromised and they’re using insecure storage then they can brute force all day. There are server farms dedicated to doing just that and the vast majority of users are using simple, easy to guess passwords. The most common password? “password” [source: https://nordpass.com/most-common-passwords-list/]. Yes, we are a stupid species.
Nobody will try to brute force your account on a login form unless you are a high value target. Databases get leaked and password hashes with them. There are tools like haveibeenpwned which check your email against known database dumps that are available to everyone on the dark web.
I’m subscribed to haveibeenpwned but sometimes I read of breaches where password were plain text… a password manager is the best option, some of them also alert you of known breaches so you can change your password instantly