@killua99 : the least insecure solution is to use client certificates, because they make MitM attacks harder. That is an advantage and sometimes a disadvantage: a fake website with a fraudulent but correct cert will prevent authentication, but so will a virusscanner or network device that does "TLS inpection".

However, considering all the extra trouble and risks associated with hardware keys and passkeys, for average/ordinary users my advice is to use a password manager that checks the domain name (Autofill on Android and iOS do help a lot).

Essential is that the user does not make the same mistake as Troy Hunt did, from https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/:

❝
I went to the link which is on
mailchimp-sso·com
and entered my credentials which - crucially - did not auto-complete from 1Password. I then entered the OTP and the page hung.
❞

With Android screenshot: https://infosec.exchange/@ErikvanStraten/113549056619471557; all details in https://infosec.exchange/@ErikvanStraten/113022180851761038.

@pixeldorf Halt dich an das #KeePass-Format. Ein guter Client für Desktops ist #KeePassXC, für iOS #KeePassium, für Android #Keepass2Android. Der große Vorteil ist, dass du bei Bedarf jederzeit den Client wechseln kannst.

#Keepassium looks pretty good. Could sync to nextcloud or NAS via WebDAV

@tychotithonus : if anything, people should stop making up passwords themselves.

Here's what they should do (IMHO): https://infosec.exchange/@ErikvanStraten/113022180851761038; with Android screenshot: https://infosec.exchange/@ErikvanStraten/113549056619471557.