jeffp17

If someone gains access to your password manager, it is likely because you gave them access. If this was done under duress, there are bigger problems in the realm of physical security that are outside the scope of cybersecurity.

The assumption is that your password manager is only accessible on physical devices that you have authorized. The stored data is encrypted and will only decrypt upon being authenticated by whatever means you have setup (i.e. password, fingerprint, face id, etc.). The only way for a potential attacker to utilize an OTP generated by your password manager would be to somehow gain control of the physical devices where the password manager is installed and authenticate themselves as you.

As I understand, preventing such a scenario is not the purpose of MFA. Rather, it is to prevent the scenario where an attacker either attempts to brute-force guess your password to a particular application (or figures it out in some other way) and now is blocked by the inability to get passed the "enter the OTP code from your authenticator app" question.

---

The scenario that you ask about is a valid concern. It is just not the same concern as what is solved by OTP/MFA.

One area where the notion of separation of keys makes more sense is cryptocurrency, where if you have any serious investment in it, it is advised to set up a multi-key scheme. In such a case, even if somebody were to be forcefully required to allow a physical attacker to gain access to their password manager, there would still not be enough information there for the attacker to steal anything.

That is, 90s style hoax websites

The internet needs more of this. Bring back bonsai kittens!

The problem is not the change, but that it is not backwards-compatible with the way that the "tech savvy folks" have been doing it for years.

There is no way to opt-out of this change, essentially forcing everybody into entering text this way.