How to Get Rid of Passwords - Today

Passwords are a structurally weak authentication method: they are frequently guessed, brute-forced, or stolen through social engineering, and compromised credentials are a common starting point for breaches. Attackers exploit predictable human behavior—unchanged default passwords, password reuse across work and personal accounts, and simple choices like “Password123”—and also leverage credential-harvesting malware such as keyloggers. They can further accelerate guessing with machine-learning tools like PassGAN, which learns from leaked password datasets to generate high-quality guesses, making account takeover both easy and attractive.

Because adversaries using valid credentials can be hard to detect, preventing password compromise is a priority; user behavior analytics can help but is not a complete solution. Near-term risk reduction includes password managers (to promote unique, complex passwords with automated rotation), single sign-on (to reduce password sprawl), and multifactor authentication, particularly to protect access to password managers and SSO portals. Organizations can strengthen controls with adaptive authentication (varying factors based on risk and context) and continuous authentication (ongoing session checks such as proximity cards or keystroke patterns to prevent session hijacking). Windows Hello and device-based biometrics can also reduce password reliance, though recovery, resets, and enrollment often still fall back to passwords; even Windows Hello uses a PIN, positioned as safer due to TPM-bound storage and device dependence.

True password elimination requires passwordless enrollment and recovery and broad support for diverse authenticators (biometrics, hardware tokens, mobile). Short-term paths include SAML-based access management integrating passwordless authenticators and using FIDO2 tokens or single-use QR codes for onboarding. Azure Active Directory can accelerate adoption via built-in support for FIDO2, Microsoft Authenticator, and Windows Hello, while Google Cloud Identity offers MFA/SSO for many SAML apps plus Secure LDAP for legacy use. Longer-term success depends on widespread FIDO2/WebAuthn and OAuth implementation, improved interoperability and UX, and a shift toward AI-supported back-end, risk-based transaction controls, potentially within an “Identity Fabric” using decentralized identities.

• Brute-force attacks use automated tools that test thousands of passwords based on dictionary words, defaults, common choices, or previously leaked lists.
• Social engineering can capture passwords by directing users to phishing sites designed to harvest entered credentials.
• Attackers can reset passwords by compromising email accounts and using reset links sent via automatic email responses.
• Keylogger malware and spyware can harvest user credentials.
• PassGAN uses Generative Adversarial Networks (GANs) trained on real password leaks to generate high-quality password guesses.
• User Behavior Analytics (UBA) can provide some protection when adversaries use legitimate passwords.
• Windows Hello can use facial recognition or fingerprint recognition for authentication.
• Windows Hello requires users to enter a PIN from time to time.
• Microsoft positions Windows Hello PINs as more secure because they are stored within the device’s Trusted Platform Module (TPM).
• Google Cloud Identity supports MFA and SSO for over 200 SAML-compatible cloud applications.

• “Passwords are easily guessed, brute forced or stolen using techniques such as social engineering.”
• “There is little doubt that passwords alone provide little or no security as a means of authentication to control access to IT systems and enterprise data.”
• “As a result, account takeover is extremely easy and popular among attackers.”
• “Preventing password compromise should be a top priority for organizations.”
• “Adjusting the number of authentication factors according to the context is known as risk adaptive or dynamic authentication.”
• “Another passwordless approach is continuous authentication.”
• “By providing ongoing checks throughout a user session, continuous authentication guards against illegitimate users taking over legitimate user sessions.”
• “Biometrics has long been touted as a potential replacement for passwords, but the technology is still immature and prone to error.”
• “Short term, going passwordless means solving the challenge of enrolment and account reset or credential recovery without requiring a password.”
• “To prepare for such a passwordless future, organizations should also consider switching to a services-based approach to Identity and Access Management (IAM) using Application Programming Interfaces (APIs) in the concept of an ‘Identity Fabric’ to connect users to services, systems and data using a decentralized identity rather than a password.”