I'd use `pass`, which I use personally, but it's a hard sell for people not as technically proficient. I've worked with all kinds of solutions both online and o

I'd use `pass`, which I use personally, but it's a hard sell for people not as technically proficient. I've worked with all kinds of solutions both online and on-premise such as 1pass and vault. Ideally a meticulous SSO setup would replace all passwords except for perhaps one; the user identifies to the IdP, which then relays enough information to dependent parties to determine what that user can do. The problem is that getting proper SSO, identity and permission support across all software in use in a company requires a level of effort that few are willing to pay for internally these days, though newer software is a lot more flexible and usually has proper OIDC support. On the other hand, external SaaS is still hard to integrate into your own IdP, so I guess we are stuck with some forms of passwords for some time to come.