Actually there&#x27;s not a lot of work for browsers to do. Polish UI, make &quot;logout&quot; button, provide JS API, allow apps to handle errors better. Actually they should provide JS API to work with standard security cards and that will help to extinguish Java Applets from a lot of places. Not a lot of work, but it might start new era of web security.<p>I always wondered, why password-bases authentication is so prevalent, when asymmetric cryptography is there and actually used under the hood. That&#x27;s a dream: one key to rule them all and no security problems with leaked accounts, unified UI to register, login, logout.