I'd love to see one where one has to tap a fingerprint-reader or a yubikey to allow applications to read secrets (or even just confirm in a pop-up that says "he

I'd love to see one where one has to tap a fingerprint-reader or a yubikey to allow applications to read secrets (or even just confirm in a pop-up that says "hey, firefox wants to read secret XYZ from the secret store". The big issue is that the protocol is synchronous (rather than async), so backends must reply immediately to the client, and can't wait too long for user input (otherwise the D-Bus request times out). The protocol seems to have been designed with a bit of an "everyone can ready everything" model. It would also be great to see some browser integration with this protocol too -- so website passwords can also be saved in a `org.freedesktop.secrets.service` backend. The big difference with current browser password managers being, rather than the DB exist INSIDE the browser's sandbox, it exist in another service, and only passwords which one explicitly authorises are shared with the browser. I believe the spec allows for this last item, but if there's no way to authorise individual items, I wouldn't be comfortable using it, since any browser security issue would allow access to ALL passwords in the system DB.