There's a fantastic paper from a while ago that did a great job of covering what you're getting at. It's one of the most cited papers in password security research. Basically, everything we've ever found sucks but passwords seem to suck the least. Great read if you have the time - https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-817.pdf