Passkeys. That has both and it can’t be set insecurely, written on paper or given to an Indian call centre who assures you they are from the finance department.

How do you identify whose passkey it is without an identity? They're a decent defensive auth method for people who can't use a password manager but they can't replace username/password.

username/passkey works just fine. No password needed. Nobody said drop usernames, the idea is drop passwords.

> the idea is drop passwords

and replace them with passwords (passkeys). Very clever.

Passkeys as they are currently-marketed are resident credentials. This means a passkey stored on your Yubikey (or smartphone, or Windows account, or...) is not only a private key, but also contains a UID to identify it. A website doing authentication can trivially use this to look up which user it is associated with. Very convenient for single-press login, but it requires a decent bunch of per-website storage on the hardware token. Which is of course a net positive for the big tech companies, because it forced you into using smartphones as the token, and doing silly things like cloud sync with them.

The original FIDO U2F credentials were not resident. You'd enter your username, and the website would sent over a bunch of opaque blobs representing the associated hardware tokens. The hardware token would decrypt their blob using a key derived from a combination of the website's domain name and the hardware token's single stored secret, and then do the whole auth shenanigans using the data retrieved from the blob.

Making it phishing-resistant, for starters. And having a built-in way to prevent people from reusing their password across multiple websites, so that any single compromise doesn't instantly turns into having all of their accounts pwned.

> And having a built-in way to prevent people from reusing their password across multiple websites

"Sign in with Google/Facebook/etc" - epic fail. /s