Requesting a password would provide a false sense of security. The passwords are stored in an easily obtainable format. If you are leaving your laptop around untrusted people, you're going to have problems.
Trying to draw a line around the secure point (having a workstation totally unlocked) sounds incorrect.
The passwords are stored in an easily obtainable format.
If you are leaving your laptop around untrusted people, you're going to have problems.
Why is it only the browser developers who come up with that arguement? I've never read such a statement from any other team. And why aren't other software systems do it that way if it is so insecure and "falce-security" so encrypt user passwords in a local db? Couldn't even an OS use that argument and say "hey, you got physical access to the system, here are all the passwords in plain text, have fun!".
They are; it's called your user account password.
If you mean an extra password, the answer is that most people don't want to type in a password when they open their browser. And even if they did, then the argument would be "well they leave their browsers open, so it should ask for a password every time", which defeats the whole purpose of password saving.
Think it through and try to see the issue.
Or do you mean that it'll prompt people for a master password for uncommonly used sites? Because that's just going to lead to people forgetting the master password and having to do a password reset.
If you mean an extra password, the answer is that most people don't want to type in a password when they open their browser. Think it through and try to see the issue.
I like the way this is handled in Opera, where your passwords can never be accessed/viewed in plain text at any time. Once your login data are stored, you can simply use them via CTRL+ENTER on the login form and the data is pasted into it. If you want to you can use a master password to restrict access to that data. And you can even set a time after which the the browser will forget that password and then asks for it again after e.g. 15 minutes.
But seriously: Yes, of course you would. They have to be pasted in clear text. There is no other way to do this.
But that's not the point. The point is that you do not get to use CTRL+ENTER in the first place! Unless, of course, you type in the master password, which Opera will forget after x minutes (zero if you want it to be forgotten instantly). So you have a windows of x minutes after I've used the password manager for the last time to do your "DOM hack".