I test systems for a living, with permission, and I will let you in on a secret. The flashy exploits you see in movies are rare. Most of the time I do not break the lock. I just walk in with a key someone already lost.
That key is a password. And the password is dying. Good.
Why passwords fail
A password is a shared secret. You know it, the server knows it. The whole model falls apart the moment anyone else learns it, and someone always does.
Three things kill passwords, over and over.
Reuse. Be honest with yourself. You have one "good" password with a number on the end, and you use it in ten places. When one of those sites gets breached, attackers take the leaked list and try it against your email, your bank, your GitHub. This is called credential stuffing. It is cheap, automated, and brutally effective.
Leaks. Have I Been Pwned tracks billions of compromised accounts. Billions. Your password is probably sitting in one of those dumps right now, from some forum you forgot about in 2015.
Phishing. A password is just text. If I can trick you into typing it into a page that looks like your bank, I have it. No malware, no zero-day. Just a convincing login box and one moment of your inattention.
Year after year, Verizon's breach report puts stolen credentials and the human element at the center of most incidents. We have known this for a decade. We kept shipping password fields anyway.
MFA helped, but it is not the finish line
Two-factor authentication was the obvious patch. Add a second thing. A code, a push, a text.
It raised the bar, and you should absolutely turn it on today. But let us not pretend it is bulletproof.
SMS codes can be stolen through SIM swapping, where an attacker talks your carrier into moving your number to their own phone. One-time codes from an authenticator app are better, but they can still be phished in real time. I send you to a fake page, you type your six digits, I relay them to the real site within seconds.
And push notifications? Attackers just spam you with prompts until you tap "approve" out of sheer exhaustion. That is how attackers got into Uber in 2022. MFA fatigue is a real attack, not a theory.
The problem is the same every time. If a human can read a secret and type it somewhere, a human can be tricked into typing it somewhere wrong.
Passkeys change the game
This is the part I am genuinely excited about.
Passkeys are built on the FIDO2 and WebAuthn standards from the FIDO Alliance and the W3C. Instead of a shared secret, your device generates a cryptographic key pair. The private key never leaves your phone or laptop. The site only ever stores the public half, which is useless to a thief.
When you log in, your device signs a challenge. There is no secret to phish, no code to relay, nothing to leak in a database dump.
Here is the part that matters most to me. A passkey is bound to the real site's domain. If you land on a lookalike phishing page, your device simply will not sign. It does not get fooled by a convincing login box, because it never trusted the box in the first place. It trusted the math.
Apple, Google, and Microsoft all support passkeys now, synced through their keychains. The friction that killed every past attempt at going passwordless is finally gone.
What developers should actually do
Stop treating this as a someday problem.
Turn on MFA for everything you own, and prefer an authenticator app or a hardware key over SMS. For the apps you build, add WebAuthn and offer passkeys as a first-class login option, not a setting buried three menus deep. Check new passwords against breach lists like the Pwned Passwords API. Retire SMS as a primary factor wherever you can.
We spent thirty years asking humans to be perfect secret-keepers. They never were. The fix was never a longer password or one more special character. It was removing the secret entirely.
The password is dying. Help it along.
I am Ksatria Bintang Samudra, an AI-native full-stack engineer with a penetration-testing background and a deep interest in digital forensics, open to remote work worldwide. More of what I build at ksatriabintangsamudra.com.
Top comments (0)