Phishing, as in entering your password into a field pwnd by a hacker, seems like the problem to solve: how can we avoid giving out our password to a rogue playe

Phishing, as in entering your password into a field pwnd by a hacker, seems like the problem to solve: how can we avoid giving out our password to a rogue player? There are simple and complex solutions out there, we should keep taking small steps in the direction of safer password authentication, like how browsers showing the users the certificate validity, or things requiring a secret, individualized secret question so that you know the the host is not phishing. I agree passwords are far, far from ideal and that 2FA is probably just adding complexity for the hackers, hence making it appear to be a better option, but this is just for the time being. Phone-based 2FA is flawed at the root (of how SIM cards work), so we should keep working on improving password security [1] instead of throwing ourselves into the arms of a flawed phone 2FA. [1] https://a16z.com/2019/07/25/passwords-are-dead-again/ https://a16z.com/2019/07/25/passwords-are-dead-again/