IMHO passwords always had been broken from the get to go for general purpose usage. This doesn't mean bad password rules haven't made it worse. Neither doesn'

IMHO passwords always had been broken from the get to go for general purpose usage. This doesn't mean bad password rules haven't made it worse. Neither doesn't it mean there are special purpose use-case where passwords can make sense, like for a a way to unlock whatever you use to eliminate passwords. But even then there are always better alternatives, like word pins. In my opinion there are a few services which should have a high level of security, like e.g. email. In which case I would argue a password is not enough and should be complemented with a hardware token or similar which prevents certain kinds of fishing attacks passwords (or word pins) are prone too. Some have a security level where a password, word pin or HST+PIN would be ok. But many more are partially irrelevant logins which are best of with a password manager, HST without PIN, SSO, or similar which all can (but often/mostly isn't) done in a reasonable privacy aware way. > Passwords Put You In Control How, do you have more control? Any data sharing can be done and promoted even without SSO or similar. You still login with email or worse phone number, which (in general) gives much more information away then any HSK. And let's be honest I try to avoid making accounts if possible/reasonable but still accumulated ~70 logins. How am I supposed to remember more then a small number (let's say 10) secure passwords which must not have any pattern or there is a risk if a site is corrupted. That wasn't ever a option, never feasible and always broken. It doesn't put you into control, it forces you to use "something" to give control to (a notepad, password manager etc.). So IMHO if we want an improvement we need some form of privacy preserving, open anti-decentralizing "SSO"-like protocol/system which can be feed by HST, Secure Modules or simple Apps. Does it exists? Probably, somewhat? But making it widely used seems as unlikely as people (in general) choosing passwords if they have the choice to not have passwords.