Time to implement Password Authenticated Key Exchange, e.g. Secure Remote Password, in the browser? Here is what I suggest. Let there be a field <input type=pa

Time to implement Password Authenticated Key Exchange, e.g. Secure Remote Password, in the browser? Here is what I suggest. Let there be a field <input type=pake challenge=blah />. Whatever is typed into that field is unavailable to the front-end code. Instead, the browser computes a one-way function of the password, challenge and origin, and makes that available to the front-end. The devil is in the details, but I'm pretty sure that a robust security analysis could eventually produce a solution that allows any user to type any password in a "super-password" field, and rest assured that the phishers are out. The next issues would be: - How to prevent "downgrade" attacks, i.e., the user should immediately notice if a legacy password field is used. - How to convince the Internet to adopt this.