That's the intent of password managers, but there are all sorts of attacks/bugs/footguns that could still let the wrong thing happen. You could imagine scenario

That's the intent of password managers, but there are all sorts of attacks/bugs/footguns that could still let the wrong thing happen. You could imagine scenarios where you don't have time to investigate why your @#$(#! password manager isn't autofilling today, and you do it manually. The confused deputy problem is real. Contrast FIDO's design, in which it's actually not catastrophic to give the secret to the phishing site, because they can't do anything useful with it. There simply isn't a "hunter2" for them to obtain, even if the confused deputy wanted to give them one. (If you believe you personally are impervious to social engineering, imagine how many other people would respond in this situation: https://www.mercurynews.com/2023/04/27/larry-magid-how-i-nearly-fell-for-a-frightening-virtual-kidnapping-scam/ https://www.mercurynews.com/2023/04/27/larry-magid-how-i-nea....)