But the phishers could do a slight variation. They could create a website that looks very similar to the browser's Basic Auth popup, but implemented in HTML and Javascript. Most people won't notice the difference. Most people don't understand the line of death[1].

[1] https://textslashplain.com/2017/01/14/the-line-of-death/

In the context of the pop-up: a simple pop up can be faked. But what if the browser would flash all the borders (and other stuff outside the line of death) when the real popup is displayed?

I'm not saying any of this is 100% foolproof, just that we should be doing some UI experiments on real people to see what works better.

[1] https://en.wikipedia.org/wiki/EROS_(microkernel)

EROS used capabilities to enforce such rules. If you lack a capability to be a system window, you can't pretend to be one.

I can imagine keyboards having a special “password” key and trying to train people that all passwords start with the password key. I don’t know if this would work, but it can’t be worse than Ctrl-alt-delete.