[kevincox]

I think we need to simplify for broad audiences (I realized this post is aimed at technical people). The beginning and end of the list should be "use a password manager". Other things are also great, but this first step is huge and I wouldn't even try mentioning the later steps to most people.

[7373737373]

There should have been a standard to let browsers handle this automatically, with secure keys long ago.

[kevincox]

I would love to see some sort of PAKE integrated into browsers and regular form input fields. Browsers would very strongly encourage randomly generating passwords on signup and not allow the site access to them. Users would also be discouraged from exporting the generated password from the browser (but if needed to to log into a different computer or back them up could see the password). Seems to give 99% of something like WebAuthn but way more understandable to the average user.