A lot of things should be better in theory, like adopting PAKE schemes (like "OPAQUE") that could perform a two-way authentication and key negociation over an i

A lot of things should be better in theory, like adopting PAKE schemes (like "OPAQUE") that could perform a two-way authentication and key negociation over an insecure connection by just displaying a login prompt. As always, the issue is adoption. What good is a solution if no browsers implement it? Catch-22, which is usually broken when a giant (google nowadays) decides to break it. And they need incentives to do so. Which is why we need the non-profit Mozilla giant. badly. https://en.wikipedia.org/wiki/Password-authenticated_key_agreement https://en.wikipedia.org/wiki/Password-authenticated_key_agr... https://news.ycombinator.com/item?id=18259393 https://news.ycombinator.com/item?id=18259393 https://tools.ietf.org/html/draft-krawczyk-cfrg-opaque-06 https://tools.ietf.org/html/draft-krawczyk-cfrg-opaque-06