Salts are fixed - so if you salt with, i.e. the email address, any attacker will also do that. The key derivation strategy of password managers is already known. Especially in a browser, salting strategy cannot be hidden so it's a known factor. As sad as it is, for those without good hygiene, either they are at risk of compromise, or tie identity to a device and are at risk of losing access entirely. There is currently no magic solution.
