For those who want to understand how this works:

1) They open a webview with the site they want you to login to
2) You login to that site, creating some cookies
3) They transfer those cookies to their agent’s computer
4) Now your agent can access that site

Surprised no one did this before them TBH.

It’s great because it still allows your password manager to work since the authentication happens on your device.

I wonder what the story around at rest and in transit encryption is.