I'm surprised we don't have a standardized, cross-browser, simple, email-based authentication system. Basically something like this: 1. Website generates rand

I'm surprised we don't have a standardized, cross-browser, simple, email-based authentication system. Basically something like this: 1. Website generates random string as challenge, sends to Browser, invokes API via JS on the client side. 2. Browser asks user to select the email to use, allows adding a new one. 3. Browser sends its auth token and challenge string to Browser Maker, Browser Maker verifies that the auth string is valid, signs email address and challenge with its public key, transmits signature back to Browser. 4. Browser sends data back to Website, Website verifies that the signature matches and that Vendor is trusted, lets user in. As an extra precaution against Vendor being hacked, Email providers could implement support for the system. Compliant providers would handle the email verification flow themselves, informing Browser maker when done and sending an extra certificate. Websites would then refuse to accept any logins where Email Provider indicated support (via DNS records) but its certificate wasn't included. This would also make the system usable in small (and therefore untrusted) browsers, as long as the email provider implemented support. It would even improve privacy, Browser Maker and Email Provider would only ever see the random challenge string, which would make it impossible to track the websites you visit. THe idea isn't hard to implement, we've had the tech to do it since the 90's (US restrictions on crypto notwithstanding). What we have instead is a mess of passwords that nobody can remember and proprietary authentication flows with horrible developer experience, terrible privacy issues and spotty website support.