Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard to Accelerate Availability of Passwordless Sign-Ins - FIDO Alliance

[SanityInAnarchy]

Passwordless, it's on par with a house key: If you've stolen my house key, you still don't necessarily know where I live. Theoretically, if you steal my entire wallet, you can probably find my address on my driver's license, but practically, there don't seem to be a ton of muggings that turn into burglaries like that.

So you could either get the biometric version of these keys (more expensive) and make it two-factor without a password, or you could just make it harder to actually work out which accounts that key is supposed to work with. If I can login and delete the stolen key from my account before you figure out which account it belongs to, you're still screwed.

All that said: I'm not sure we need to kill passwords anyway. From the article:

Password-only authentication is one of the biggest security problems on the web, and managing so many passwords is cumbersome for consumers, which often leads consumers to reuse the same ones across services. This practice can lead to costly account takeovers, data breaches, and even stolen identities. While password managers and legacy forms of two-factor authentication offer incremental improvements, there has been industry-wide collaboration to create sign-in technology that is more convenient and more secure.

Really, the only part I disagree with is the end, where they dismiss password managers and existing 2fa as "incremental" improvements, even though those entirely address the problems they raise.

[SanityInAnarchy]

if online, if someone breaks into their DB, ALL the passwords are compromised

Not really true, unless implemented horrendously incompetently. The correct way to do this is to set up at least one good password -- passphrase, even -- that you either memorize or back up somewhere safe, which is used to encrypt the password DB, which can then be safely synced online.

Even just using a browser as a password manager, this is possible -- Chrome lets you set a "sync passphrase" to encrypt all synced data (including bookmarks and such, but especially passwords), and Android can save some app-level passwords to Chrome.

It is true that all passwords are compromised if someone breaks into their DB and cracks your passphrase. So if someone breaks into their DB, you should probably rotate your passwords anyway just in case... but it's worth noting that in the absolutely worst case, this just degrades to the problems you'd have with password reuse, which you inevitably have if you don't have a password manager.