According to Microsoft's newest security report, the password length recommendation has been raised to a minimum of 12 characters. But strong passwords can be difficult to remember, and forcing users to frequently change their passwords will often lead to yellow sticky note problems. Also, users often reuse passwords. Passwords are sometimes shared among individuals. Server breaches can expose passwords, especially if they are stored in plain-text or hashed without a salt. Also, users can unintentionally expose their passwords due to phishing attacks.
So passwords are no longer sufficient because they are frequently weak, the same password is used in too many locations, and due to increased cloud calculation power they can easily be cracked by brute force attack or rainbow tables if too short. They can easily be stolen, breached, or...