[lisper]

Because in order to prove that you know the secret you have to reveal the secret. That makes it unavoidably vulnerable to phishing.

[nine_k]

Not necessarily.

To prove that I have a secret key, I encrypt something of your choosing, and you decrypt it with a public key. This is enough proof, and private parts remain unexposed.

[lisper]

Re-read the question to which I was responding: "what's wrong with username and password?"