Hacker News Reader

I'm still waiting for NIST to deprecate plain-text* passwords in favor of PAKE, and W3C to come up with a mechanism for that.

*) plain-text here means any and all methods that give the attacker access to the original password, including modifying client-side JS.

They've been working on just this bit for the better part of a decade. It'll happen (passkeys I imagine), just slower than most of us would like.

Adoption of PAKE was hampered by patents. Password managers solve the problem anyway.