[sneak]

This works until you get malware on your workstation.

[ics]

That’s why you assign all of them random names which are recorded in a separate BitWarden store. That one only opens with a password which is “YUBIKEY”.

[anotherhue]

One can use the TPM so at least the secrets can't be mass exported. Doesn't stop keylogging individual ones of course (but a browser extension might).