I mean, if you are logged into your email that's pretty much game over for most sites including possibly your bank.

Just request a password reset and change it to whatever you'd like.

There's two didn't attack models, "steals permanently" and "runs code on and returns to you" (which includes both "steals from your hotel room and puts back" or "installs malware on"). Yes, for the first one it's hard to get to the bank account and I agree the comic is inaccurate. For the second, it's very easy to install a keylogger or a cookie-logger or a malicious browser extension or whatever.

Riot installing a kernel module is more like the latter.

I assume most people use the browser built in password manager with no master password. If you can launch chrome, you're in.

Safari’s password manager requires TouchID or entering your computer password on every password retrieval.

Chrome's as well.

title="Before you say anything, no, I know not to leave my computer sitting out logged in to all my accounts. I have it set up so after a few minutes of inactivity it automatically switches to my brother's."