Dusting off my usual response: mutual TLS (aka client side certs) could practically eliminate phishing. It would be simply impossible to give your credentials to a phishing site as they never leave your device. There's 2 things missing that browser / device vendors need to do:
1. Improve the UI of client certs.
2. Figure out a way to manage credentials across multiple devices.
1. Improve the UI of client certs. 2. Figure out a way to manage credentials across multiple devices.