What I've been trying out is having the UX strongly encourage a passwordless configuration, but with a password/TOTP escape hatch hidden away. The caveat is, th

What I've been trying out is having the UX strongly encourage a passwordless configuration, but with a password/TOTP escape hatch hidden away. The caveat is, the password must be 64 characters long and is tested for entropy. It also enforces additional security checks that the passwordless option doesn't, to reduce the chance of MITM (which TOTP doesn't protect against). I also don't implement any automatic password reset workflow, because if you're using a password manager then you shouldn't ever need to reset your password. If you do, it will involve manual verification and talking to your account manager.