Re:Safari tries to fill username
by im3w1l on Friday May 28, 2021 @07:40AM
(#27314157)
The key thing is that an attacker wont be able to keylog the shared secret, or trick me into typing it on the wrong site.
[ Parent
| on HN ]
They will be able to trick you into typing it on the wrong site (more likely, wrong terminal) if they’ve compromised your machine. They just need to wait for you to log in.
Similarly, they can grab the shared secret from the server.
It’s marginally better than a password manager (though some of those support TOTP now), since they can’t pull all your credentials by keylogging your master password.