With the ever increasing risk of attackers compromising password based encryption by brute forcing or guessing passwords, are there alternatives to this traditional scheme of deriving encryption keys from passwords. I realize that there are memory hard hash functions like Argon2 that creates derived keys from passwords, and because of the memory hardness slows down brute forcing to some extent. But still, if the password is weak in the first place and if the salt is known to the attacker, then brute force becomes trivial, considering ever increasing rate of computational power, provided by GPUs, ASICs etc. Further more, when considering the problems associated with file encryption, where it is required to generate a key (256 bits) to use in a symmetric encryption algorithm like AES, there is not a better user friendly method than asking the user for a password or a passphrase. Also, if we consider biometric methods like fingerprint detection, it is almost impossible as of now, to derive the same encryption key from biometric data all the time.
But are there, other methods, most preferably software techniques that I'm not aware of?
