The password turns sixty-five this year. It was introduced at MIT in 1961 to allocate time on a shared mainframe, and it was compromised almost immediately — a researcher printed the password file to get extra machine time. The mechanism has not fundamentally changed since, while the threat environment has changed beyond recognition.
The central problem is reuse. Users maintain accounts across dozens of services and cannot remember dozens of distinct strings, so they reuse one or two with minor variations. When any single service suffers a breach, attackers obtain a credential pair that works elsewhere. This is credential stuffing, and it is the dominant account-takeover technique by volume precisely because it requires no sophistication: take a leaked list, automate attempts across other services, collect whatever opens. Success rates are low per attempt and enormous in absolute terms.
Phishing is the other major vector, and it defeats password strength entirely. A twenty-character random password typed into a convincing replica of a login page is exactly as compromised as “password123”. Attackers now run reverse-proxy kits that relay credentials to the real service in real time, capturing the session cookie after authentication completes — which means they also defeat one-time codes delivered by SMS or authenticator app.
That last point matters because it explains why the security field has moved past shared secrets altogether. FIDO2 and WebAuthn, the standards behind passkeys, replace the secret with a cryptographic key pair. The private key never leaves the user’s device, and the browser cryptographically binds each authentication to the origin domain. A passkey issued for a genuine site will not produce a valid signature for a lookalike domain, regardless of how convincing the replica is. This is phishing resistance by construction rather than by user vigilance, and user vigilance has never been a reliable control.
Until passkeys are universal, layered defence is the practical answer. Platforms that hold funds or identity data — banking, government services, licensed operators running pages such as a 7 lottery login — increasingly combine a password with device fingerprinting, geographic anomaly detection and step-up verification triggered by unusual behaviour. Rate limiting and breach-corpus checking at registration catch a substantial share of automated attacks before they reach a user account at all.
For individuals, the advice is short and has not changed in years. Use a password manager and let it generate a distinct string per site; the security benefit comes from uniqueness, not from complexity. Enable the strongest second factor on offer, preferring a hardware key or passkey over an app code, and an app code over SMS — SIM swap attacks are routine. Check your addresses against Have I Been Pwned and rotate anything that appears.
And for developers: stop enforcing periodic password rotation. NIST withdrew that recommendation years ago because forced rotation produces predictable incremental variants, which are weaker than the original. Rotate on evidence of compromise, not on a calendar.
