Sunday, May 24, 2026
Independent Technology Journalism  ·  Est. 2026
Cybersecurity

The Death of the Password Is Taking Longer Than Expected

A Breach That Shouldn't Have Happened in 2026 In March of this year, a mid-sized U.S. healthcare network disclosed a breach affecting 2.3 million patient records. The root cause, buried in p...

The Death of the Password Is Taking Longer Than Expected

A Breach That Shouldn't Have Happened in 2026

In March of this year, a mid-sized U.S. healthcare network disclosed a breach affecting 2.3 million patient records. The root cause, buried in paragraph nine of their SEC filing: credential stuffing. An attacker had used a list of reused passwords from an older, unrelated leak to walk straight through the front door. No zero-day. No sophisticated malware. Just a list and a script. The network had been warned three separate times by their insurer to implement multi-factor authentication across all external-facing systems. They hadn't. And in a world where passkeys and hardware tokens have been commercially viable for years, that's genuinely hard to explain.

We've been announcing the death of the password since at least 2004, when Bill Gates predicted its demise at RSA Conference. We're still waiting. But something has shifted in 2025 and into 2026 — not a sudden breakthrough, but an accumulation of pressure from regulators, insurers, and a slowly maturing ecosystem of alternatives that's finally becoming usable enough for real deployments. The question isn't whether passwords will go away. It's whether the transition happens before the next generation of attacks makes the cost of delay unbearable.

Why Passwords Have Survived This Long

The persistence of passwords isn't irrational. It's actually a story about switching costs and backward compatibility — similar to the way the QWERTY keyboard layout outlasted every ergonomic competitor not because it was better, but because the infrastructure built around it was too embedded to replace cheaply. Passwords are supported by every browser, every OS, every authentication library ever written. They require no hardware. They work offline. They're transferable between devices without provisioning. For a small business running on-premise software from 2014, asking them to move to FIDO2-based passkeys isn't a simple upgrade; it's potentially a full application re-architecture.

Dr. Annika Holm, a principal researcher at MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL), has studied credential-based attack patterns for the better part of a decade. She puts it bluntly: "The threat model for passwords isn't that they're cryptographically weak — it's that humans are terrible at managing secrets at scale. The protocol is fine. The implementation in human brains is the vulnerability."

"The protocol is fine. The implementation in human brains is the vulnerability." — Dr. Annika Holm, principal researcher, MIT CSAIL

That framing matters because it explains why technical fixes alone haven't worked. Forced complexity rules — 12 characters, one uppercase, one symbol — produced passwords like Password1!, which scores well on entropy metrics and terribly on actual security. NIST's Special Publication 800-63B, revised most recently in 2024, finally dropped mandatory complexity rules and special-character requirements in favor of length and breach-list screening. It took nearly two decades of evidence to move institutional guidance in that direction.

The FIDO2 and Passkey Bet: What the Data Actually Shows

The FIDO2 standard — combining the W3C's WebAuthn spec (formalized as RFC 8471's spiritual successor in the broader FIDO ecosystem) and the CTAP protocol — is the closest thing the industry has to a credible password replacement architecture. Passkeys, the consumer-friendly implementation pushed hard by Apple, Google, and Microsoft since 2022, are built on top of it. The cryptographic premise is solid: a private key never leaves the device, authentication is challenge-response, and phishing becomes structurally impossible because the credential is bound to the origin domain.

Adoption numbers have grown, but they're still modest in context. Google reported in early 2026 that over 800 million accounts have used a passkey at least once — impressive in absolute terms, but that figure includes one-time uses and doesn't reflect whether users have actually replaced their passwords or simply added passkeys as an additional option. Apple's implementation, deeply integrated into iCloud Keychain across iOS 17 and macOS Sequoia, has made passkeys nearly frictionless for users inside the Apple ecosystem. The cross-device story, however, remains messier.

Authentication Method Phishing Resistance Cross-Platform Support Recovery Complexity Enterprise Deployment Cost
Password + SMS OTP Low (SIM-swappable) Universal Low $2–5/user/month
TOTP (e.g., Google Authenticator) Medium (real-time phishable) High Medium $3–8/user/month
FIDO2 Hardware Key (YubiKey) Very High Growing (USB-A/C, NFC) High (key loss risk) $25–60 per key + management
Passkeys (Platform) Very High Medium (ecosystem-dependent) Medium (cloud sync) Low ($0–2/user/month)
Biometric + Passkey Hybrid Very High Medium-High Low-Medium $5–12/user/month

The Recovery Problem Nobody Wants to Solve

Here's the part of the passkey story that tends to get glossed over in product announcements: account recovery. If a passkey is stored on a device that's lost, stolen, or wiped, how does a user regain access? Most implementations punt to a fallback — which is usually a password, an email link, or an SMS code. That fallback becomes the actual weakest link. Attackers don't need to break FIDO2 cryptography if they can social-engineer a Tier 1 support agent into resetting an account via the legacy recovery path.

Keep reading
More from Verodate