Troy Hunt's whole career is basically based on the brokenness of passwords, but now he's defending them here, and then touting his own services that claim to make passwords better. Something is fishy here.

It could be that passwords are terrible, but everything else is worse, but I'm not convinced. We have had a big push towards SSL (TLS, actually) everywhere lately. I don't have to ask Amazon for a password to verify that it's really Amazon that I'm transacting with. It really feels like we should be able to come up with a seamless way for that to work both ways in every web transaction.