The World Wide Web Consortium (W3C) announced that the Web Authentication API (WebAuthn) is an official web standard for password-free logins on the web.

A web-based attack called clickjacking can get information from password manager browser extensions using auto-fill settings.

The safest passwords are long, seemingly random strings of letters, numbers, and punctuation–and you need a different one for each Web site and application.

A good compromise is to manage security-critical passwords and credit card numbers with a dedicated password manager and only open access to simple web services such as newsletters, stock market ...