Add a way to limit vault exposure. Assume two devices, one is unstrusted (not logged in), the other is trusted (logged in). The unstrusted device could be placed in a limited access mode that initially presents a QR-code to the user to be scanned with the trusted device for linking. Once the devices have been linked, the unstrusted device shows a temporary vault to be populated. Finally, the trusted device could send select entries manually to the untrusted device when needed.
Example:
I wish to login to Spotify on an untrusted device, but I do not wish to login to my vault with my master password nor e-mail. I add the unstrusted device as a limited access device with the trusted device. I then find the Spotify entry on my trusted device and manually push it to the untrusted device. This entry is then stored on the untrusted device for X minutes before it expires, never exposing the rest of the vault to the unstrusted device.
Why?:
- It never exposes more than necessary on untrusted devices, giving the user full control of what is exposed.
- It allows users to only ever authenticate on a singular device, for instance a phone, potentially reducing the attack surface into the vault.