> Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people.

Malware exfiltrating users' browser sessions and passwords is a "very arbitrary threat model" that "doesn't seem to affect people"???

Yes

> Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people.

Credential stealer malware is abundant, it's often enough how attackers gain initial access to a company's internal network - grab the credentials off of Chrome, Firefox or one of the other popular password manager apps, and you're bound to find a set of credentials there. Now all you need is some piece of software that's reachable from the Internet and lacks 2FA (which applies to a shocking lot of legacy software), and you got some sort of persistent access to the network.

And in ye early days of cryptocurrencies, before hardware vaults became the norm among crypto enthusiasts, a fair amount of people got their wallets drained by targeted cookie (=session) stealers.

> What about ads? Tracking? Apps sending fingerprinting home?

That is bad, but not "someone can drain your bank account or take over your social media accounts to spam" bad.

I disagree; i think the proliferation of ads is a type of malware that has far more detrimental effects on society than credit card theft (which, incidentally, wouldn't be a problem if the industry bothered to protect their cards with basic authentication on use, which they refuse to)