> I've complained about this to Google's security folks, and basically the answer I got there was that they don't believe in password managers as a solution and

> I've complained about this to Google's security folks, and basically the answer I got there was that they don't believe in password managers as a solution and would rather have FIDO/U2F become a thing. They have a point. We've had the technology for improving authentication for literally decades - that's effectively what a SIM does. We've had these secure modules in our smartphones forever. The technology is dirt cheap, ubiquitous, and with the advent of these wireless transports the user interface problem is solved. The infuriating thing for me is we still don't use it. Google has succeeded in forcing the planet to move to https, so I guess they imagine they can do the same thing for authentication. If they succeed they will kill phishing. I wish them luck. If it were possible to have a NFC WebAuthn implanted in the back of my hand and I could invisibly control the userHandle it handed out by invisibly twitching a muscle or something, I'd be falling over myself to get the surgery done.