FIDO is strictly better: with “password” you share your email + password with the server. If you use the same password on another site, the server knows your pa

FIDO is strictly better: with “password” you share your email + password with the server. If you use the same password on another site, the server knows your password. You may trust the server, but in case of a leak you’re doomed. With FIDO you share email + a signature that doesn’t reveal anything at all. Privacy aside, the FIDO signature also protects you against phishing as the (hostname of the) url that’s displayed in the browser is part of what it’s signed, so an attacker can’t reuse the signature to log you on a different domain — unlike the password (and other 2FA like otp codes) that can be phished.