I have great hope that the upcoming Web Authn standard (https://webauthn.io https://webauthn.io) will greatly improve server-side security and make phishing a t

I have great hope that the upcoming Web Authn standard (https://webauthn.io https://webauthn.io) will greatly improve server-side security and make phishing a thing of the past but I worry about how the threat model will then turn towards securing access to the user's personal devices. Endpoint security is going to get even harder. People double-click and blindly run whatever on their devices all the time.