The sad part about all of this is the complexity of the new solutions. Webauthn is strong but fiendishly complex. How did we get here? Websites used weak hashe

The sad part about all of this is the complexity of the new solutions. Webauthn is strong but fiendishly complex. How did we get here? Websites used weak hashes (md5 and sha1... efficient to compute and attack) to store passwords and allowed users to set short, weak passwords (12345, letmein). Long passwords randomly generated by password managers and stored as strong hashes (Argon2id) by websites are secure, not guessable and even difficult/expensive to attack offline when the database is dumped. This approach is simple and easily understood by everyone involved (users and site admins) and would be suitable for the security of 99% of websites. Leaving 'Account Recovery' as the only remaining challenge.