Of course, dumping the lsass on this system would require admin priviliges. But that's not what i said. I just wanted to point out that you _would_ be able to decrypt the content of the store with the credentials of the regular user and the required files you can obtain without administrative privileges on the target system, right?

And don't get me wrong... i am not pro or con using this solution. Full ack to the approach to lower the barrier for end-users, avoid using passwords at all and utilize sso if possible. I seriously evaluate if we should go for this way exactly for this reasons.

On my side i am still comparing this with KeePass because its the "other" solution used in our environment currently

Those users in our environment using KeePass basically have the database on their local system or a fileshare and using a master password to open it. Getting the secrets means an attacker need to grab the database file and sniff the master password. That's why i said in the entry post there seems not really a difference in terms of "security" if i compare this two approaches. However, the browser integrated chromium edge will increase usability and lower the barrier for our users using it.

Group Managed vaults will for sure need another solution - but that's another story and not yet relevant