I'm really not sure what you are disputing here. PAKEs are for preventing man in the middle attacks, not for securing a local program or preventing malicious code from running in the browser. No one is advocating, use a PAKE and all your problems are gone - it's about addressing key exchange over the wire and eliminating an entire class of attack. Password managers are a tough subject - they are like coffee . Yes, there may be small amounts of toxic stuff in it, but that is offset by a factor of 10,000 by the number of people who do not get in a wreck on the way to work, thanks to being awake and aware form 70mg of caffeine.