Passwordless

Passwords are probably the most unsolved user experience issue since the beginning of the Internet era. The biggest fail. There is one thing that keeps them alive, which is (the recovery) email. Email is - in the end - the last resort when we mess with passwords, by simply forgetting them. The problem with passwords is that by trying to make them more secure, by enforcing policies of "difficult" passwords or policies to change them frequently, we force users to keep them stored in plain text either on easily accessible electronic notes or on post-its.

And any web service which is accessed less frequently, we probably start with the "forgot password" option which emails us a recovery link. Then there are password managers which themselves are a mess. I have always had issues trusting them fully. Probably one useful thing they offer are statistics. E.G., Google Chrome tells me I have about 300 passwords to various web sites. 300 is obviously not manageable in any way and many of these are the same, which creates a problem of a leak on one site affecting many other sites.

So how about getting rid of passwords at all?

The good news is we are getting there. And - surprisingly - Microsoft seems to be leading this effort. I have just discovered it is possible to use all of Microsoft services (that includes Office 365, Skype and others) completely passwordless. Just install the Microsoft Authenticator App. The process is very simple, allows you to associate multiple accounts (e.g., a business account and a personal account). Then make sure the "Passwordless" option is enabled as well as link non-Microsoft services. I have also been successful to replace the native Google Authenticator app with the Microsoft Authenticator for my Gmail! But at this moment Gmail still requires a password, using the Authenticator as a 2nd factor only. I wonder what security strength is compromised by still requiring passwords. It seems not much, and if this is the case, we may quickly see variety of 3rd party services offering this passwordless option. Hey, what a relief that would really be!