The Password Era is Ending: Microsoft’s Bold Move to a Passwordless Future

In a significant shift, Microsoft has announced a major update that will delete passwords for over 1 billion users, marking the end of an era. The company is urging users to abandon passwords and adopt passkeys, a more secure and convenient alternative. In this post, we’ll dive into the details of this update, its implications, and what it means for the future of online security.

The Problem with Passwords

Microsoft is right to highlight the vulnerabilities of passwords. With 7,000 password-related attacks blocked per second, it’s clear that the current system is no longer sustainable. Bad actors are exploiting weaknesses in password security, and it’s only a matter of time before they succeed. The company’s warning that “bad actors know it, which is why they’re desperately accelerating password-related attacks while they still can” is a stark reminder of the urgency of the situation.

Introducing Passkeys

Passkeys are a game-changer. By replacing passwords and two-factor authentication (2FA) codes with account authentication linked to your hardware devices or devices, passkeys offer unparalleled security. Unlike passwords, passkeys cannot be leaked or stolen, and unlike 2FA, they cannot be intercepted or bypassed. This means that even if an attacker gains access to your device, they won’t be able to use your passkey to log in.

The Update: What You Need to Know

The latest update from Microsoft will enable a passwordless and passkey-first experience for web and mobile apps. When signing up for a new account, you’ll only need to enter your email address, and then verify it with a one-time code. This becomes the default credential for your new account, making it passwordless from the start.

Once signed in, you’ll create your passkey, which will become the default sign-in choice whenever possible. Microsoft is clear that adding passkeys is not enough if passwords remain on the account, as this leaves the account vulnerable to phishing attacks.

The Goal: A Passwordless Future

Microsoft’s ultimate goal is to remove passwords completely and have accounts that only support phishing-resistant credentials. The company is not alone in this quest; HYPR has confirmed that phishing-resistant authentication, led by FIDO passkeys, is projected to become the most widely deployed authentication method within two years.

The Call to Action

While Microsoft’s clarity and simplicity in messaging are commendable, it’s crucial that other major platform providers follow suit. Google, for example, still allows passwords as a backup credential for account access, which leaves a vulnerability in place. This year, we should see consistent advice on passkeys and the eradication of password and simple 2FA usage.

Conclusion

Microsoft’s bold move to a passwordless future is a significant step forward in online security. As the company’s update rolls out, it’s essential to adopt passkeys and abandon passwords. The future of online security depends on it. By working together, we can create a safer, more secure online environment for everyone.

Actionable Insights

• Start using passkeys today and abandon passwords.
• Encourage other platform providers to follow Microsoft’s lead and adopt passkeys.
• Stay vigilant and keep an eye out for phishing attacks, as they will continue to evolve.

Summary

Microsoft’s update marks the end of the password era, and it’s time to adopt passkeys. With unparalleled security and convenience, passkeys are the future of online authentication. By working together, we can create a safer, more secure online environment for everyone.