Why the Password Isn't Dead Yet

The technology for affordable passwordless devices is ready. 

But it requires a relatively advanced smartphone - and if something goes wrong: leave it in a cab, leave it in a pocket while jumping in a pool or other common mishaps - recovery options are far more challenging than for passwords. JL

Lily Newman reports in Wired:

The infrastructure—across all the major operating systems and browsers—is largely in place to support passwordless login. (But) many passwordless schemes work only on newer devices and necessitate the ownership of a smartphone along with at least one other device. In practice, that's a fairly narrow use case. Many people around the world share devices and can't upgrade them frequently, or they use feature phones, if anything. And while passwordless implementations are increasingly standardized, account-recovery options are not.

There are certain sci-fi promises the future is supposed to hold: jetpacks, flying cars, a Mars colony. But there are also some seemingly more attainable goals that somehow also always feel just on the horizon. And one of the most tantalizing is the end of passwords. The good news is that the infrastructure—across all the major operating systems and browsers—is largely in place to support passwordless login. The less-good news? You're still plugging passwords into multiple sites and services every day, and you will be for a while.

There's no doubt that passwords are an absolute security nightmare. Creating and managing them is annoying, so people often reuse them or choose easily guessable logins—or both. Hackers are more than happy to take advantage. By contrast, passwordless logins authenticate with attributes that are innate and harder to steal, like biometrics. No one's going to guess your thumbprint.

You likely already use some version of this when you unlock your phone, say, with a scan of your face or your finger rather than a passcode. Those mechanisms work locally on your phone and don't require that companies store a big trove of user passwords—or your sensitive biometric details—on a server to check logins. You can also now use stand-alone physical tokens in certain cases to log in wirelessly and without a password. The idea is that, eventually, you'll be able to do that for pretty much everything.

“All the building blocks have reached a level of maturity where they can cross from early adopter technophiles to the mainstream,” says Mark Risher, Google's senior director of product management for identity and security platforms. “They have strong platform support, they work across all the different major providers, and they're becoming familiar to users. Before, we as an industry didn't even know how to get rid of passwords. Now it'll take some time, but we know how we're doing it.”

Advertisement

At the end of June, Microsoft's Windows 11 announcement included deeper integration of passwordless sign-ins, particularly for logging in to devices, using biometrics or a PIN. Similarly, Apple announced a few weeks earlier that its new iOS 15 and macOS Monterey operating systems will start to incorporate a new option called Passkeys in iCloud Keychain, a step toward using biometrics or device PINs to log in to more services. And in May, Google discussed its efforts to promote secure password management at the same time that it works to move customers away from passwords.

Despite these and other industry efforts to get both developers and users on board with a passwordless world, though, two main challenges remain. One is that while passwords are universally despised, they're also deeply familiar and absurdly ubiquitous. It's not easy to break habits developed over decades.

“It's a learned behavior—the first thing you do is set up a password,” says Andrew Shikiar, executive director of the FIDO Alliance, a longtime industry association that specifically works on secure authentication. “So then the problem is we have a dependance on a really poor foundation. What we need to do is to break that dependance.”

It's been a painful detox. A FIDO task force has been studying user experience over the past year to make recommendations not just about passwordless technology itself but also about how to present it to regular people and provide them with a better understanding of the security benefits. FIDO says that organizations implementing its passwordless standards are having trouble getting users to actually adopt the feature, so the alliance has released user-experience guidelines that it thinks will help with framing and presentation. “‘If you build it they will come’ isn’t always sufficient,” Shikiar wrote last month.

The second hurdle is even trickier. Even with all of those pieces in place, many passwordless schemes work only on newer devices and necessitate the ownership of a smartphone along with at least one other device. In practice, that's a fairly narrow use case. Many people around the world share devices and can't upgrade them frequently, or they use feature phones, if anything.

And while passwordless implementations are increasingly standardized, account-recovery options are not. When security questions or a PIN serve as backup options, you're essentially still using passwords, just in a different format. So passwordless schemes are moving toward systems where one device you've previously authenticated can anoint a new one as trustworthy.

“Let's say you leave your phone in a taxi, but you still have your laptop at home,” Google's Risher says. “You get a new phone and use the laptop to bless the phone and can kind of build yourself back up. And then when somebody finds your lost phone, it's still protected by the local device lock. We don't want to just shift the password problem onto account recovery.”

It's certainly easier than keeping track of backup recovery codes on a slip of paper, but it again raises the issue of creating options for people who don't or can't maintain multiple personal devices.

As passwordless adoption proliferates, these practical questions about the transition remain. The password manager 1Password, which naturally has a business interest in the continued reign of passwords, says it is happy to embrace passwordless authentication everywhere that it makes sense. On Apple's iOS and macOS, for example, you can unlock your 1Password vault with TouchID or FaceID instead of typing in your master password.

There are some nuanced distinctions, though, between the master password that locks a password manager and the passwords stored inside of it. The trove of passwords in the vault are all used to authenticate to servers that also store a copy of the password. The master password that locks your vault is your secret alone; 1Password itself never knows it.

This distinction makes passwordless login, at least in its current form, a better fit for some scenarios than others, says 1Password chief product officer Akshay Bhargava. He notes, too, that some long-standing concerns about password alternatives remain. For example, biometrics are ideal for authentication in many ways, because they literally convey your unique physical presence. But using biometrics widely opens up the question of what happens if data about, say, your fingerprints or face is stolen and can be manipulated by attackers to impersonate you. And while you can change your password on a whim—their single best quality as authenticators—your face, finger, voice, or heartbeat are immutable.

It will take time and more experimentation to create a passwordless ecosystem that can replace all the functionality of passwords, especially one that doesn't leave behind the billions of people who don't own a smartphone or multiple devices. It's harder to share accounts with trusted people in a passwordless world, and tying everything to one device like your phone creates even more incentive for hackers to compromise that device.

Until  passwords are totally gone, you should still follow the advice WIRED has pushed for years about using strong, unique passwords, a password manager (there are lots of good options), and two-factor authentication wherever you can. But as you see opportunities to go passwordless on some of your most sensitive accounts, like when setting up Windows 11, give it a shot. You may feel a weight lifting that you didn't even know was there.