If you go along with the all-or-nothing mentality, then local file system access is pretty much game over anyway.
If you want to take the security-in-depth approach, you have to first apply it to these password managers and take an honest look at the problems they solve. And it turns out they’re amazing from a cost:benefit benefit perspective.
Put differently: go read the spectre/meltdown papers. Imagine if _those_ were written in the same tone this is. That’s the problem.
If passwords stored in plaintext is a problem, don’t just use slightly harder to access storage. Use SSO so there are not credentials to steal.
If the article gave a complete picture of what to do to mitigate the damage of endpoint compromise or was less alarmist in its assessment of risk, I would have liked it better.
Most of the criticism I've read here seems to be dismissing the threat entirely, using the weak "if that happened you've got bigger problems" argument.
> So this article is bringing attention to a weakness in the browser’s built-in password managers, and suggesting a very viable and easy-to-adopt solution.
Because many actual experts disagree it is a weakness
> Why the strong criticism of this article?
The advice tries to make it out like browser suppliers are doing this to lower security for some unknown reason, whereas actually their model is safer than what is recommended.
It is possible to argue against browser suppliers here, but you need to look at their arguments for doing it that way. This article doesn't do that.
These articles always assume everyone has the same threat model: you are head of the NSA's IT department, and hostile nation-states are spending billions to attack your security with everything from 1024-qubit computers to $5 pipe wrenches.
Forcing users to employ the same security tools and practices that would be appropriate for dealing with far more serious threats is just annoying, and likely to result in passive-aggressive resistance.
What about defence in depth?
This article is suggesting an alternative, which are password managers such as 1Password. These Password managers do not suffer from the same weak key storage as the browser’s build-in password managers.
So this article is bringing attention to a weakness in the browser’s built-in password managers, and suggesting a very viable and easy-to-adopt solution.
Why the strong criticism of this article?