3 ms·

Any algorithmic pw-manager can be attacked the same way: just record the keystrokes when the master pass phrase is entered. If the attacker has malware on your

• acdha 9y ago
  That was exactly my point – on something other than iOS/ChromeOS there might be a chance if the attacker manages only a partial compromise[1] but in general it's wise to assume that a compromise will get the master passphrase or could simply read the unencrypted data out of the process memory and take precautions based on that worst-case scenario (e.g. using U2F everywhere it's available). 1. e.g. if the compromised process is sandboxed enough that the secure keyboard input features work or something like the macOS securityd running as a separate user prevents unrestricted access.