Trevor posed a question about the nature and validity of using a password manager, given the current prevailing model of authentication on most web resources.
- Caveat: this is not the naive question about whether password managers are insecure in general, Trevor knows that question has been asked and answered many times over (it's all about relative risk).
- Caveat: this is also not the routine question of the relative risk profile between password managers and memorization and manual entry alone. Trevor is familiar with that discussion as well.
Trevor asked a question which calls into dispute whether password managers are obsolete on the basis of functionality.
If a user can reliably select "I forgot my password" on most web sites, and have a password-reset initiated and a link sent to their e-mail inbox, then isn't their e-mail inbox serving the same functionality of a password manager?
What is the benefit of trying to remember a password, or storing a password in a manager if a user can reliably get a password reset link every time they wish to login to the site ?
This question is not identical to If I include a Forgot Password service, then what's the point of using a password?.
Although similar, this question is intended to uncover what relative advantage (or disadvantage) exists when the use-case is compared to a password manager.
In the other question, the use-case is compared to rote memorization, and does not identify the fact that a password manager may very well be equivalent to simply forgetting passwords and using a one-time login.