I'm a senior undergraduate majoring in computer science. I recently took a computer security class where instead of exams we had a final project that could be anything related to computer security. So for our project, we designed a cloud based password manager that works on almost every existing site with the key idea being that the credentials are never sent to/stored on the client computer that is trying to login to a website.
While I'd really appreciate feedback on our project, I have a feeling that's not really what Stack Exchange is for, so instead I wanted to ask about the vulnerabilities existing password managers still have.
While they encrypt data when it is stored, when trying to log in to a website, what are the safeguards in place that would stop a malicious extension from just doing something like: document.getElementById("pass").value right after the extension is used? What about key loggers recording the master password for the password manager?
Additionally, I've read a couple of academic papers exploiting bugs in password managers where for example the master password is left in unprotected memory.
The biggest question I have is if these are all really problems that have been exploited in the real world, or if these vulnerabilities take too much finesse to implement/scale up.
