DEV Community: Short Lived

Passwords Are Losing, and the Numbers Finally Prove It

Short Lived — Thu, 06 Aug 2026 09:49:45 +0000

What the report found

The FIDO Alliance — the industry group behind the passwordless authentication standard — released its State of Passkeys 2026 report in May, based on research across 11,000 consumers and 1,400 enterprise decision-makers in ten countries. A few numbers stand out: passkeys now see a 93% sign-in success rate compared to 63% for passwords, and average sign-in time drops to roughly 8.5 seconds versus over 30 seconds for password-based logins. Awareness has also jumped to 90% of consumers, with about 5 billion passkeys now active worldwide.

The security case is the more important one. Passkeys are built to be phishing-resistant by design — unlike a password, there’s no shared secret that can be typed into a fake login page, because the credential is cryptographically tied to the real site and your device. That’s a structural fix, not a behavioral one — it doesn’t depend on you spotting a scam email, which is precisely where most password-based breaches start.

Why adoption still lags

Here’s the more interesting number: even among organizations that have rolled out passkeys, the majority still keep passwords running in parallel as a fallback, and a large share of individual users still don’t use passkeys everywhere they’re offered. The barrier at this point isn’t awareness — it’s habit. People default to what’s familiar, even when the safer option is one tap away.

The practical takeaway

Most major platforms — Google, Apple, Microsoft, and a growing list of banks and retailers — now offer passkeys as a login option, usually sitting quietly in account security settings labeled “passkey” or “sign in without a password.” The action worth taking today: pick your two or three most important accounts (email first, since it’s the recovery path to everything else) and set up a passkey where it’s offered, instead of waiting for a breach to force the decision.

Passkeys aren’t foolproof — device loss and account-recovery flows are still an active area of security research — but they close off phishing, which remains the largest single cause of account compromise today.

Reference

FIDO Alliance, “The State of Passkeys 2026: Global Consumer and Workforce Report” (May 2026). https://fidoalliance.org/fido-alliance-reports-accelerating-global-passkey-adoption-on-world-passkey-day-2026/

AI Can Make You Sharper at Spotting Misinformation — Or Worse at It

Short Lived — Thu, 06 Aug 2026 04:32:18 +0000

What the research found

Researchers at MIT's Media Lab ran a four-week study tracking 67 participants as they used AI assistants to help judge whether news headlines and images were real or fake. The AI tools themselves were genuinely useful — often landing on the accurate answer. But something notable happened to the people using them: participants who leaned on the AI's answers heavily got worse at spotting misinformation on their own over time, not better.

The researchers point to a specific mechanism: the AI tended to hand over a confident answer rather than walk users through how to evaluate the claim themselves. Convenient in the moment, but it meant users weren't practicing the underlying skill — they were outsourcing it. The comparison researchers drew: much like GPS has quietly eroded many people's sense of direction, leaning on AI for judgment calls can erode the judgment itself.

This isn't an isolated finding — a growing body of research this past year has converged on the same pattern across different tasks: AI tools reduce the mental effort a task takes, but that reduced effort sometimes comes at the cost of the reasoning skill the effort was building in the first place.

The practical takeaway

None of this means avoid AI tools — the same research shows they're genuinely useful. The distinction that matters is how you use them:

Outsourcing judgment (accepting an AI's verdict on something and moving on) is where the erosion happens.
Using AI as a sparring partner — asking it to lay out the reasoning, checking that reasoning yourself, or asking it to argue the opposite case — keeps you actively engaged instead of passively accepting an answer.

A simple habit: before accepting an AI's answer on something that matters, ask it "what would make this wrong?" It's a small shift that keeps you in the loop rather than out of it.

This study focused on misinformation-detection tasks over four weeks with 67 participants — a meaningful but specific slice of how people use AI day to day. The broader pattern is echoed elsewhere, but effects likely vary by task and person.

Reference

Rani, A., Danry, V., Liang, P. P., Lippman, A., & Maes, P. "Dialogues with AI Reduce Beliefs in Misinformation but Build No Lasting Discernment Skills." Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems. https://doi.org/10.1145/3772318.3790656

Turning On Two-Factor Authentication Isn't Optional Anymore

Short Lived — Thu, 06 Aug 2026 04:19:46 +0000

What the research found

A study published in 2026 tracked what happened when three major Canadian banks rolled out two-factor authentication (2FA) — the extra login step beyond just a password — during 2021–2022. Two banks made it optional. One made it mandatory. Researchers then analyzed cyber threat intelligence from criminal marketplaces to see which accounts were actually showing up as compromised.

The result was clear: mandatory 2FA significantly reduced the number of compromised accounts. Optional 2FA did not — even though it was available to everyone. Having the option to be safer wasn’t enough; only requiring it moved the needle.

This tracks with what large platforms report from their own systems: Microsoft has stated that MFA blocks over 99.9% of automated account-compromise attempts, and Google’s research shows that adding even a simple recovery phone number can block the vast majority of bulk phishing and bot-driven attacks.

Why this matters for you personally

The lesson isn’t really about banks — it’s about human behavior. If 2FA is sitting there as an optional toggle in your settings, the research suggests most people simply never turn it on, even when they know it helps. The fix isn’t more awareness; it’s making the safer choice the default in your own digital life, right now, rather than waiting for “someday.”

Practical steps, in order of effectiveness:

Turn on 2FA for your email first — it’s the recovery key to everything else.
Prefer an authenticator app or a physical security key over SMS codes, which can be intercepted via SIM-swapping.
Do this for your bank and any account tied to money before anything else.

2FA isn’t perfect — SMS-based codes have known weaknesses, and no single measure eliminates risk. Treat it as a strong first layer, not a complete solution.

Reference

Kamar, E., Howell, C. J., Maimon, D., & Fraser, I. “Evaluating the Effectiveness of Two-Factor Authentication (2FA) in Mitigating Account Takeover Fraud: A Natural Experimental Study on Canadian Banks.” (2026). https://doi.org/10.1177/00111287261441235