> You shouldn't enter your username and password for one website into another. You shouldn't train users to do so either. I'd even argue that this is the much

> You shouldn't enter your username and password for one website into another. You shouldn't train users to do so either. I'd even argue that this is the much bigger point. The only practical way we have to avoid phishing (and its cousins) with password-only auth is teaching users to look at the domain-part of the URL. It's the only thing I can currently teach my non-technical friends & family. Human assumptions are basically software that takes years or decades to upgrade, among other problems. Can't really stress enough how important it is to foster and teach best practices in this space. It's a giant shitshow to reverse these things. Fortunately, Matrix is still nothing my grandmother would use, but it would really suck for Matrix if they have yet-another hurdle to overcome in reaching the mainstream. If I were Matrix, I'd be extremely concerned with this.