> Bull. People need to stop repeating this.

Wow, you sound like you know what you're talking about.

> They have to be transmitted. They (or their hash) have to be stored. And so so many get that wrong.

Ok, you've stopped sounding like you know what you're talking about.

Passwords have to be transmitted or stored. They don't have to be transmitted and stored. As you note, we usually opt for transmission but not storage. You could do it the other way around.

> There is nothing to prevent you from entering your super secure unique password on the wrong site if you get phished.

> Passkeys can’t be entered on the wrong site, the sites they work on is an inherent property of the key.

They can still be entered. Not working isn't the same thing as not being sent. A cryptographic exchange should hopefully fail before anyone who's pretending to be the counterparty you want learns enough to impersonate you. But you can enter anything anywhere.

> Unique strong passwords, TOTP, 2FA, one time sign in emails, none of those offer this stuff.

Unique strong passwords offer the following:

1(a). They are never transmitted (well, once), and provide phishing resistance; or

1(b). They are never stored, and provide leak resistance.

2. In the event of compromise, no other credentials of yours are simultaneously compromised.

It's true that it would be nice to enjoy phishing resistance and leak resistance.

Here are some other things unique strong passwords offer:

3. You are free to establish any relationship you like, with anyone you like. You don't need permission from Yubico to create an account somewhere.

4. Yubico can't pretend to be you.

You might notice that passkeys don't offer any of those. Your comment appears to enthusiastically endorse the idea that passkeys are a trap.

> Passwords are fundamentally broken. They cannot be fixed.

This is the "PGP is fundamentally broken" argument again. It will never be valid.

If you ask any followup questions, the reason that "PGP is fundamentally broken" is that people use Outlook plugins, and those plugins mean that they're constantly sending email in plaintext when they should have sent it encrypted. There's a very, very simple solution to this.

Don't use Outlook plugins. Run PGP yourself.

Before you send your email, check whether it looks more like "OK, everyone's ready for the kidnapping on Thursday" or "Eb+h+Q1iDEYUgJlO5GTtmcibC+D1E9oJWvZeoy9I2tpqxe9j/iokAx0R". You will be able to tell the difference. Nobody has ever failed at telling these apart.

If you were about to send the email, but it's still in plaintext, don't send it.

Passwords are no more fundamentally broken than PGP is.