Comment by lxgr

Eh, it’s alright. The spec is quite overengineered, but practically it’s very possible to achieve a good user experience.

And conversely, there are also many ways to make legacy password based auth break password managers and annoy users even though there’s no specification for that at all.