In the comments section of that link, I found interesting this thread that touches what I am suggesting: https://blog.cryptographyengineering.com/2018/10/19/let

In the comments section of that link, I found interesting this thread that touches what I am suggesting: https://blog.cryptographyengineering.com/2018/10/19/lets-talk-about-pake/#comment-3888 https://blog.cryptographyengineering.com/2018/10/19/lets-tal... Which ends up with one of the parties writing this: https://palant.de/2018/10/25/should-your-next-web-based-login-form-avoid-sending-passwords-in-clear-text/ https://palant.de/2018/10/25/should-your-next-web-based-logi... The blog in the last link argues against the usefulness with the built-in browser implementation. The arguments are pretty useful, even though I disagree with he's conclusions. I think the fact that if a compromised server has to revert from the secure browser-built-in password form, to a "regular login form" in order to learn your password, then that's a win for me