> If you're optimizing for UX you're not optimizing for security. It's just how it is. Security can never be perfect. It's a lesson in trade-offs. For exampl

> If you're optimizing for UX you're not optimizing for security. It's just how it is. Security can never be perfect. It's a lesson in trade-offs. For example, if you make security so hard or inconvenient that people won't engage in secure behaviors, then in the end you're worse off. This is the reason password rotation has fallen out of favor lately. If in general we did away with password managers and took your lead, I guarantee we would collectively be worse off because, for most folks, what you describe would be seen as way more trouble than it's worth. Your black-and-white take also fails to account for varied threat models. Remember, the most common threat model online today is service breaches leading to passwords being exposed, followed by credential stuffing. Password managers encourage practices that eliminate that threat model. If your threat model is centered on password manager service breaches like this one, then use a solution that doesn't require cloud hosting (e.g. keepass). So now we need to worry about device breaches, which requires hackers to go after individual users (either targeted or untargeted), which has a much higher cost/complexity. We've made the hackers job a lot harder, which is good. And if your model is centered on device breaches, well, bad news: your browser already sees your passwords go by (among many other things), so if the device is breached, you're hooped, password manager or no password manager.