lostpass

That's slightly different though, in order to do this you need to have shell access on the target's computer. TFA is about displaying a password dialog from an unprivileged app or website. The equivalent scenario with sudo would be to have a website display a mock terminal asking for sudo password, although that would be a lot harder to do inconspicuously because I don't expect terminal windows to pop out of the blue. It's also the reason why browser notify you when a page wants to go fullscreen. I think the right solution to this problem is simply not to have privileged system UI elements drawn in a way that can be mimicked by a regular app or website. LastPass made a similar mistake: https://github.com/cxxr/lostpass I don't have an iphone so I'm not sure what would be the right way to deal with that. AFAIK apps can draw to the entire sc

See 2FA proxying in LostPass https://github.com/cxxr/lostpass

What is your threat model? If this is the just the described hacking I propose -> https://www.troyhunt.com/going-dark-online-privacy-and-anony... https://vox.space/blog/89/being-privacy-aware-in-2016 Get anonymous identity and VPN. Using KeePassX/LastPass/1Password is a bit problematic. They become a single point of failure. Someone can get my master password (https://github.com/cxxr/lostpass) or can pwn LastPass. To improved that my passwords becomes <last_pass_gen_pass> + <random_nonce_that_i_know_how_to_generate_in_my_head> + <helper_password> I divided accounts into tiers: Tier0: The most important account: Macbook, Gmail, Github Tier1: Still important, but not as much as Tier0: Youtube Tier2: I don't really care. Tier3: Testing accounts for local dev server: Single simple password like qwerty1234. I just need to remember 5 passwords