That's an implementation detail users should not care about. The bigger question is... why don't we replace the login/password combination with just a string o

That's an implementation detail users should not care about. The bigger question is... why don't we replace the login/password combination with just a string of randomly generated characters and call it a day? Why protect these strings of random characters from users, call them passkeys and advertise them on all street corners? Feels like a devil's plot to strip us from all the rights to our devices.