> This ignores that most password managers check domains/origins the same way browsers do. No, it doesn’t. Most password managers allow you to fill passwords f

> This ignores that most password managers check domains/origins the same way browsers do. No, it doesn’t. Most password managers allow you to fill passwords for other domains and all of them allow copy-paste. The people who support those users know that phishers can convince people to do that which is why they’re encouraging adoption of WebAuthn.