I think this really highlights the difficulty of squaring software with a lot of configuration options and one-package-per-program binary package management. S

I think this really highlights the difficulty of squaring software with a lot of configuration options and one-package-per-program binary package management. Sometimes a pretty good compromise is found, like with PHP, where there's a core package, and additional packages for a common subset of extensions. Here, though, I both understand, and don't understand. It's one thing to disable the favicon downloading, and Have I been PWNed integration. That's a fairly obvious case where the security is improved. But browser integration, hardware key support, and TOTP integration are more nuanced cases. I know I would have a hard time using a password manager without browser integration...especially with increasing security friction adding up. Security is very important. But security is not the end goal, the goal is to provide the best *practical* defense possible. Browser integration, TOTP integration, passkey support, and hardware key integration all can add enough convenience to actually improve security.