I don't understand how people could use LastPass or any company that provide cloud password manager.
Any password uploaded to a server you don't control should be considered disclosed.
They can say what ever they want about their encryption pipeline, even release it as open source software, you can't be 100% certain that they run it unmodified.
You simply can't trust a company (that want to make profit at any cost, like all companies) with profitable data (like your login/password). One day someone will sell them.
This is why I don't use CPUs that other companies have built, and solder my CPUs myself from transistors I bought in Shenzhen while wearing a ski mask and sunglasses. You never know if Intel is secretly copying your data.
Paranoia is good but do you also never go in any vehicle? Surely you know people die in them all the time!
Everyone takes some risks and the vast majority of people I trust to take the most calculated ones use a password manager. Incidentally I do too. However I do not upload my bank passwords, and my Gmail / Facebook passwords there, so I did account for the absolute faint possibility of LastPass being compromised. I guess I just don't care about my Reddit or HN account that much!
Any password uploaded to a server you don't control should be considered disclosed. They can say what ever they want about their encryption pipeline, even release it as open source software, you can't be 100% certain that they run it unmodified.
You simply can't trust a company (that want to make profit at any cost, like all companies) with profitable data (like your login/password). One day someone will sell them.