I use BitWarden, but I'm thinking of self-hosting BitWarden. BitWarden's commercial offering might be tempting to crack from a hacker's perspective, but I don't think they would go after a specific user's instance.
If you’re actively under attack no Password Manager, mental algorithm/ password pattern, Yubikey, or MFA will prevent someone from just using your authenticated session(s).
Does that mean we shouldn’t use these mechanisms? Of course not. When the risk is only realized with full compromise—saying XYZ could pose a threat is moot from a security perspective.
ok but that also is prone to a weakness in any part of that chain assuming you even set it up properly in the first place. each piece is another layer that can be hacked or improperly setup.