We have no idea - yet.
Because passwords are insecure because of a combination of factors.
- People choose bad (with only X bits of entropy) passwords.
- Companies have bad password policy.
- Passwords are stored in plaintext.
- Password hashes are created with "bad" cryptographic hash functions.
All of these factors are theoretically "solvable".
- We could tell people to use stronger passwords.
- We could tell companies to have better password policies in place.
- We could theoretically fine companies that store passwords in plaintext or when they create "easy" to brute force password hashes.
We (and a lot of other people) have been doing this for a long time and nothing or maybe little has changed. So your question is absolutely valid and has been asked before many times. The problem is, nobody has a good solution yet.
Why is that?
There are several fundamental problems: creation, storage, recreation.
Every factor that is used for authentication a) has to be created by something or someone, b) has to be stored on the client side (to transmit it to the server) and server side (to prove that it is correct) and c) it has to be possible to recreate a new one if it is lost.
All "new" proposals have at least a weakness in one of these categories. Take biometrics for instance:
- creation: relatively easy, almost everybody has a fingerprint/veins/a face
- storage (client): easy, on your body
- storage (server): easy, either plaintext (several pictures are stored) or a hash is derived (both these solutions are suboptimal)
- recreation if lost on the server side: not possible
There are other fundamental problems like usability, factor reuse, privacy etc. You can take every new proposal that is in the following list and is the topic of authentication research today and it will fail to solve at least one of the named problems.
What other solutions are discussed?
These: More biometrics (heart rate, voice, walking pattern), n-factor authentication, OTP everywhere, web of trust-like schemes, trust score system (scary!) and others.
In conclusion: We do not know what will come next, but there is a lot of research going on, because not only scientists but also companies are getting tired with all the problems that good old passwords have.