Which one is safer - Google Password Manager vs LastPass?

 Justin's point was the same as your observation that even LastPass passwords would be 100% vulnerable to malware present on your machine. Your machine is where the ultimate security lies.

The Elliot Kember post claims that your overall safety of the password is increased if you require a master password to view other passwords. And he has a valid point. There is definitely an advantage to reducing your attack surface, and his claim is that Google's not even trying in that regard. Elliot also claims that Justin's "false sense of security" ignores the human element, which is that 95% of the people you might loan your machine to are incapable of exploiting it. However, if you loan your machine to your worthless brother-in-law, he might do something foolish that exposes you to a virus -- your brother-in-law isn't deliberately exploiting you, but he's a potential vector for infection. All in all Justin's argument also exploits human behavior. If Chrome lets other people easily see your passwords, you'd be stupid to let someone else use it without close supervision. Both sides have valid points.

The problem with Chrome is that unless you click an obscure advanced sync option, your sync password is the same as your Google password. When we compare google password manager vs Lastpass, by default Google has the ability to decrypt your sync file and access your passwords. You've now spread your attack surface to include completely trusting Google to protect all your passwords. Is Google trustworthy? The simple answer is to ask why Google would ever snoop on your passwords and risk damaging the trust people have for them anyway. But do they turn them over to the authorities when presented with a warrant and a National Security Letter? Those questions have unknowable answers, yet they're dealing with your personal security.

You can go one step further, though, and actually improve your security through trusted hardware. You can link your LastPass account to use a YubiKey for dual-factor authentication. It's basically a USB key that acts like a keyboard, but you keep it on your keyring next to your house key. It provides a seemingly random string to Lastpass that Lastpass can then use an algorithm to verify, granting you access to your account. Even on a totally pwned machine where malware can intercept the passwords in active use, as long as it doesn't have clipboard access or you're using the Lastpass browser plugin, your passwords are safe.

Another perspective when comparing Google password manager vs Lastpass is, Google stores your passwords in your account, and that is basically cloud storage. So if your Gmail or Google account was compromised in some way, the attcker would have access to everything you have stored in your chrome password manager.Ergo, to safely use this service, you will need to create a highly-secure password for your Google account and preferably turn on two-factor authentication for added protection.This platform is integrated with the Chrome browser on both PC as well as with mobile, allowing users to generate passwords when registering and storing them in an encrypted locker for access across devices.