[michaelt]

I'm logging into websites using unique passwords with 44 bits of entropy, which they feed into a hash algorithm that takes 200ms to hash each attempt, then entering a TOTP code or touching my Yubikey, and they check against my geoip history and fingerprint my browser and they want me to complete a captcha and they e-mail/SMS a one-time code to me and they send me an e-mail telling me there's a new login to my account.

The security industry loves to use belt and belt and braces and braces and braces. If they add an extra belt or two, I doubt anyone will remark on it at all.

[XorNot]

The amount of time I spend per day waiting for my web browser to do about 10 redirects through Okta and touch a Yubikey is substantial.

[hujun]

The two key issues PQC try to address are key exchange and digital signature, which happen during TLS handshake, the mechanism you described happen after TLS is established; so if a quantum computer breaks TLS, then it effectively reduced HTTPS to HTTP