> That's because you just fully authenticated it by providing your master password (which for the macOS local keychain is your local account's login password, which you had to present in order to unlock the FDE disk at startup.)

I booted my laptop maybe several months ago and unlocked the screen with TouchID at the moment.

> Interestingly, this also doesn't apply if you set your FDE unlock password to be different than your local account sign-in password. The FDE unlock password will do some magic that gets you logged into your account; but you will end up in your account with your local-account keychain still locked — which will cause a lot of annoying prompts on login.

Haha, I've been there by accident before. Or before FDE was a thing, having a different keychain vs login password because of some migration gone wrong.

> Again, that's because you signed into your phone with a password recently-enough to make it satisfied with you

Not sure about this. Usually I use FaceID. Does that ever expire and need the passcode? I don't think it does; the only times it asks iirc is when I fail the FaceID auth repeatedly (it doesn't like my second pair of glasses).

> This is true, and because of this, security people do not consider these browser "autofill" features to be "password managers." Don't use them!

Yeah, it's jank, but people do use them. Personally I use Safari for important stuff just because I want Keychain instead, but otherwise, your only option is dealing with a third-party password manager.