Big Tech promises to drop the password
The three giants agreed to support passwordless sign-in across devices. What it means, and what to do while we wait.
Last week Apple, Google and Microsoft jointly committed to expand support for the FIDO passwordless standard over the next year. The idea: your phone holds a cryptographic key for each site, unlocked with your fingerprint or face, and it can sign you in on your laptop too. No password to type, steal or phish.
That’s the right direction. Passwords are behind most account takeovers, and this kind of login simply doesn’t work on a fake site.
But it will take years before most sites support it. Until then:
- Use a password manager and unique passwords everywhere.
- Turn on MFA, preferring an app or a security key over SMS.
- Try a hardware security key on your most important accounts. It uses the same FIDO standard and works today with Google, Microsoft, GitHub and many others.
- If you build software, start reading about WebAuthn now. Your users will ask for it.
The password won’t die this year. It might finally start to.