I think you're missing the fundamental point here - users of this technology will never enter their password online again.

Instead, imagine new HTML elements and you could have

<form type="cbcrypt"> <input type="username" /> <input type="password" /> </form>

and the web browser would allow you to enter your credentials in a secure, NATIVE window. (At least secure from web stuff - keyloggers get a lot more powerful under this scheme.)

If it works as advertised, it's quite nice. Personally, I think this is very close to what we need.

I will note I still probably wouldn't use it because if your password is exposed, then you're screwed. It is very close though. A hardware element or something might mitigate this enough.