It always bothers me how the focus is on making a robust password when the real world security risk is not brute force attack but rather phishing. It always has

It always bothers me how the focus is on making a robust password when the real world security risk is not brute force attack but rather phishing. It always has been (even in the days when hackers would call 'Jim' down at the control center for a reminder of the password).