Instead of actually fixing authentication they are baking "have this password been exposed in plaintext" into the browsers.
What's the deal with WebAuthN? Such a basic functionality still not completed.
What's the deal with WebAuthN? Such a basic functionality still not completed.
“Perfect is the enemy of good” [1].
[1] https://en.m.wikipedia.org/wiki/Perfect_is_the_enemy_of_good
Now, I am all for actually secure auth, and support in browsers is the necessary first step; for "fixing auth", someone then needs to implement the other side of the equation, too (I do remember when OpenId+HW 2FA was supposed to have fixed this, a few years back).
As for "nothing new" - for the people of HN, perhaps. For the casual user, this is something radically new.
HW 2fa can never fix auth because it's hardware, and cannot scale. There are solutions out there, all what's left is to raise awareness to add it. Showing popular passwords will just move us to a new set of popular passwords and so on.