One of their demos was showing how they could recover a username/password combination for a third-party site (Instagram), which was specifically possible becaus

One of their demos was showing how they could recover a username/password combination for a third-party site (Instagram), which was specifically possible because a password manager was in use that auto-filled those fields, putting them in memory. One possible reading of that is that you'd be immune if you didn't use a password manager, didn't let your browser remember the password, and just typed it in each time. There's a bunch of reasons that's a dumb objection: - Having a password manager is good for lots of other reasons, and at least means that only one website is compromised if the password is stolen - Their technique could probably also steal session tokens, which isn't quite as bad as stealing a password but is still bad. - Password managers can be configured to require a click to fill in the password, which also defeats this attack.