The best I've seen was yesterday where a website had the log-in button greyed out after the password manager filled my creds in. So I had to manually click both the email and password field. Just click them. Then it enabled the log-in button. So someone took their time to write a piece of JS that said "If the user hasn't focused both fields at least once, no login". Literally why? Extra code that does nothing useful. --- I was hoping passkeys would be the solution to this madness, but it seems to me the entire spec gives too much power to the OS Makers and too little to the users because "mUh AtTtEsTatIoN" so now I don't know anymore

It's not perfect but will break many bot logins and people trying different logins from data leaks.