Microsoft is going password-free for consumer accounts - The Washington Post

You’ve got a lot of passwords to keep track of for your online bank account, insurance company, social media profiles and even your kid’s school software. But starting today, your Microsoft account doesn’t have to be one of them.

The company said Wednesday it is officially retiring written passwords for personal accounts, including Outlook, OneDrive and Family Safety. Corporate accounts have been eligible for password-free sign-on since March.

The change comes as the entire IT industry rethinks its decades-long reliance on “shared secret” passwords — or the kind you have to remember. People have a tendency to lose and forget them, creating extra costs and headaches for companies and customers alike.

“We know people hate passwords,” Vasu Jakkal, Microsoft’s corporate vice president of security, compliance and identity, said in an emailed statement. “Thirty percent of people said they just have stopped using an account or service they were trying to log into rather than deal with a password reset. I’ve even done that. Imagine the shopping carts, memberships or accounts that have been abandoned because of password issues.”

Another big problem with passwords is that people reuse them across sites and apps. Once hackers get their hands on one password by breaching a company’s servers, it’s easier to break into multiple accounts. A cybercriminal can trick someone in a phishing attack or buy passwords on the dark web. Microsoft says there are 579 password attacks every second, or 18 billion a year.

Andrew Shikiar, executive director at the Fast Identity Online Alliance (FIDO), an industry association with members including Microsoft, Apple, Google and Facebook working on open standards for passwordless authentication, suggested opting for the Authenticator app or Windows Hello, which comes with Windows 10 and 11 and lets you use your face or fingerprint to sign in.

Two-factor authentication is more secure than a password alone, but your account is still at risk of being compromised if someone gets a hold of your email account, phone or the security codes sent to either, he said.

If you want to go passwordless, here are the steps you can take.

1. Download the Microsoft Authenticator app and log into your account. (You may need to enable notifications and touch ID for the app.) Then, go to account.microsoft.com and log in again.
2. On microsoft.com, select Security -> Advanced Security Options -> Additional Security Options -> Passwordless Account -> Turn On.
3. Once that’s done, go back to your Authenticator app, approve the notification, and enjoy being one step closer to the “passwordless future” Jakkal and Shikiar are ushering in.

Until that future arrives, consider using a password manager to track your passwords and generate hard-to-guess alternatives to the classic-but-dangerous “Password123.” Our favorite is Dashlane.

Adblock test (Why?)

Microsoft is going password-free for consumer accounts - The Washington Post
Read More