Often the mentality you will find is "any hole is a hole that will be exploited", so they make these incredibly difficult systems with perfect security that nobody ever uses because they're so hard to use.

SSH is flawed in that you have to trust the host the first time you connect to it. For most people this is a reasonable tradeoff, but for security nerds it can be an impossible barrier to adoption. This is why some SSH servers spit out big long hexcodes or weird picture things, you are supposed to securely message the owner of the server to verify it before you accept it. Details are of course left up to the user because any default system you set up will of course be exploited. It's head of line security exploits all the way down.

A lot of folks here pretending that ssh implies ssh-keyex. There's also gssapi-keyex which has no such tofu issues.

Password managers have turned this into near-zero inconvenience: when I arrive at the login page my UID and PW are already filled in.

(I also have three hard tokens for from banks and investments, two ubikeys (both for LastPass, one in storage), and google authenticator on my iphone for anyone that offers it... so I've taken a step backward for added security.)

All that took very much more than zero effort to set up. More evidence than people will put up with inconvenience for security.

I think for most people, they're trading less convenience (manually dealing with passwords, and the randomly changing rules and resets different places use) for more convenience (autofill, managed & synced)

Which happens to also be more secure.

Sure, but people with PW managers are reducing their long-term inconvenience by paying a little bit up front. I don't use a PW manager for any security benefit but because it makes it easier to sign into things.

Hell, I store my 2FA keys in my pw manager and have it autofill those too -- a reduction in security! But there are some services that refuse to not spam your phone number if you don't set up some 2FA.

I keep my passwords in my head because I can't put up with managing a dozen different authentication schemes, any one of which could be compromised or lost at the worst possible time.

My interpretation of the parent post was not that there is no middle ground, but that if a user can use a service without engaging in an extra step to increase security, they will do so, no matter how easy the extra step is. Passwords are not an extra step - they are required.

Passwords are optional for some things (spreadsheets, SSL keys) - would be interesting to get the actual stats on how often they get used.