SoylentNews is people
SoylentNews
A security consulting firm released a report on the safety of password managers. A non-geek, summarized version is also available at the Washington Post. (Summarized graphic of results.)
The password managers included in the study were 1Password 4, 1Password 7, Dashlane, KeePass, LastPass. Unfortunately, the testing was limited to Win10 even if the password managers were available on other platforms. They all had some flaws, but as reported, you should still use one. They were all tested for encryption method on the database, accessibility of the master password and keys in memory while unlocked, and the master password and keys in memory while locked.
All were evaluated to have adequate encryption on the file. 1Password 4 (which actually had better memory security than 1Password 7,) was best at keeping individual passwords safe in memory; while KeePass was best at keeping the Master Password safe in the memory tests (although Dashlane did the same while it while in a locked state.)
(Score: 2) by The Shire on Thursday February 21 2019, @11:25AM
It really is a difficult problem. I suppose what I would do is generate a temporary key when the manager is unlocked which can be used by the app to retrieve a requested entry on demand. And if you lock the manager, you de-auth and destroy the key. Unlocking would then require reauthorization and the generation of a new temporary internal key. This way, even if the key in memory is retrieved it would no longer be valid by the time a bad guy tried to use it unless they had realtime access to your system, and in such a case you're already fully comprimised.
Certainly at no time should you keep an entry in memory when the manager is locked.