Password managers are necessary, but they're not enough. So long as there's an underlying password for every damn site you visit, then every damn site still has

Password managers are necessary, but they're not enough. So long as there's an underlying password for every damn site you visit, then every damn site still has to store passwords securely and you have to maintain things when that site gets breached. Not to mention the stability of that password. If it gets sniffed once, it's possibly game over for months. If a Persona assertion gets sniffed in transit, it's only good for a few minutes in time.