A well designed browser stores the cookies with similar security to the built in password manager anyway
Cookies can also be queried programmatically, whereas passwords need to have the users auto fill active and interact with the input element
Most extensions have effectively full access to your cookies, not to your passwords - which is a real attack vector (session exfiltration) which is actively being used by had acteues
There are ofc server set cookies which are not programmatically queryable, but that's not the norm (and they're still visible via the developer tools, so the core statement remains untrue)
Misleading statement, essentially untrue.
> Most extensions have effectively full access to your cookies
False.
> There are ofc server set cookies which are not programmatically queryable, but that's not the norm
That is the norm for login cookies.
> and they're still visible via the developer tools,
This is irrelevant to the argument.
That’s still more frequent per customer than signing up.
It only makes sense when prioritizing growth over your long-term customers.
I always assumed that was because it's the least common flow. Once you've signed up, you're logged in, so the only time you should ever need the "login" button is on a new computer, or after logging out to switch accounts, or if the service offers a "remember me" checkbox (don't do that) and doesn't check it by default (definitely don't do that), or if the user genuinely wants to not be remembered (e.g. they used private browsing).
If you're having to use "login" on any regular basis, something in the overall flow needs improving.