I guess I don't understand your statement as an actual real-world vector would look quite different than that. I may not understand what you're suggesting. Vis

I guess I don't understand your statement as an actual real-world vector would look quite different than that. I may not understand what you're suggesting. Visiting a webpage and copy-pasting a string off of it is not a very good practice for security because you're adding on a lot of parties to trust with that secret! Effectively you want to minimize ANY place that your secret exist in plaintext, and trusting a webpage with this is just not a good idea.