On passwords

There is a widely held opinion that passwords are a relatively insecure way to authenticate, especially as the only factor — and they have been declared due for imminent replacement for decades, yet here they are, showing no sign of extinction. There is a rich literature on their pitfalls (we find Hacking Multifactor Authentication by Roger Grimes particularly enlightening); rather than retell it, we will summarize and apply some critical analysis.

The common critique#

The most commonly cited deficiencies of passwords as a factor:

• People choose simple, guessable passwords (e.g. “ronnie123”).
• Humans cannot memorise random, highly complex secrets.
• People reuse the same password everywhere. When some otherwise-unimportant service is breached, the leaked password compromises every other place the same identity is used — a reused password is only as safe as the least safe place it has ever been used.
• Passwords get written down in notebooks and spreadsheets.
• They are shared with family or assistants on the same computer.
• Phishing — people are tricked into handing credentials to a malicious site. This is the elephant in the room.
• On insecure Wi-Fi, cleartext passwords are visible to eavesdroppers.

Is it that bad?#

The answer is nuanced — but more yes than no. All of these are legitimate concerns, yet they share something: it is mostly about how people manage passwords, not the concept of a password itself. And phishing or a network leak compromises a password regardless of how complex it is — the question is how easily a user can be tricked into revealing it.

Phishing-resistant approaches are much harder for attackers to trick the same way. WebAuthn binds a login to the real site. Ydentifi’s phone signs the exact details of an action, so nobody can change them in transit. Password managers keep strong, unique passwords per site, addressing both weakness and reuse.

If you divide authentication factors into the classic three — something you know (a password), something you have (a device), something you are (a fingerprint, Face ID) — every mitigation above pushes the solution from “know” toward “have” and “are.” There is a fair question whether a mobile phone, by far the most popular authentication device, is much safer than a password. Most phones unlock with a six-digit code when Face ID fails; biometrics are themselves hackable; and it does not take a hacker to read your phone code — just the person behind you in the supermarket queue. But physically expropriating a device is a different kind of attack: it needs proximity, motivation and different skills, not remote software trickery. One risk is mitigated; another is assumed.

Our pragmatic view#

• Passwords — or rather the way we humans use them — can be a weak factor in isolation.
• Mitigations like password managers work well; use them where you can.
• None of them stop phishing, so you still have to educate users against social engineering, which targets the person, not the technology.
• Passwordless protocols work, but they are comparatively new — the more popular they become, the more novel attacks will appear. Great, but not infallible.
• All of the above shift the problem from “something you know” to “something you have,” which opens new attacks (see On devices).
• In most low-to-medium-criticality cases this ends in a heavy reliance on a single mobile device — decide whether that fits your risk appetite and threat profile.
• User education is critical, and feasible in enterprise environments even where it is hard for diverse retail bases.
• Passwords remain the most popular “something you know” factor. As a different kind of barrier, they offer a protection the other two categories cannot mimic.
• Used correctly as one step of MFA, passwords make sense — take a pragmatic, not polarised, view. As OWASP put it, “MFA is by far the best defense against the majority of password-related attacks,” and a Microsoft analysis found MFA “would have stopped 99.9% of account compromises.”

Finally, on forced expiration: NIST no longer recommends changing passwords at a fixed interval — it only nudges users toward weaker, incremental secrets. Rotate only on evidence of compromise.