Comment by lukeschlather

Most people don't use password managers. I am not even sure that password managers really qualify as a reasonable amount of complexity for the average person. There's a cost/benefit and I think passwords + SMS 2-step-auth is a reasonable balance between usability and security for most people.

Obviously, I use a password manager and I use MFA where possible, but even that I find to be a little questionable from an availability standpoint because I have a hard time ensuring that I have multiple MFA devices located in different buildings, so a fire or a flood or something could totally lock me out of all my accounts, some of them possibly permanently, which is the thing that scares me more than getting hacked.

Passkeys (combined with full-disk-encryption by default) scare me because they make the assumption that most people would prefer to lose access to their photo library than risk someone breaking in and getting them, and I actually think most people would prefer the converse. If a burglar breaks into my house they can steal my TV, I can live without it, but please don't steal my photo albums (problem is they're the same thing.)