Making it phishing-resistant, for starters. And having a built-in way to prevent people from reusing their password across multiple websites, so that any single compromise doesn't instantly turns into having all of their accounts pwned.