> Is that not a significant issue? One would of course check the certificate to see that you're actually on the correct login page before entering credentials.

> Is that not a significant issue? One would of course check the certificate to see that you're actually on the correct login page before entering credentials... A more user-friendly approach could be if one could register a keyword with your IdP, or even a reverse TOTP for added protection. The IdP login screen would then contain the keyword/reverse-TOTP, and you could verify it before entering your credentials (using your authenticator app to validate the reverse-TOTP). That said, I do like your suggestion about the browser recalling which IdP you've used for a given site. But it wouldn't be bullet proof as people sign in from fresh browser instances all the time, be it an internet cafe or just a new laptop.