Microsoft Confirms Password Deletion for 1B Users
Microsoft’s push to replace passwords with passkeys is met with both enthusiasm and deep skepticism. Supporters highlight strong phishing resistance and easier logins using public‑key cryptography, while critics worry about device loss, confusing recovery flows, vendor lock‑in, lack of portable backups, and how non‑technical or low‑income users will cope. Many argue that passkeys mainly solve providers’ security and support costs, and that until export and cross‑platform management are mature, password managers with strong, unique passwords remain the more trustworthy option.
Scope and framing of Microsoft’s move
- Many see the Forbes headline as overstated; Microsoft talks about millions of password deletions and a roadmap, not confirmed removal for 1B users yet.
- Some view this as security progress; others see it as Microsoft papering over its own security failures and pushing lock‑in.
Recovery, lockout risk, and backups
- Biggest anxiety: “lost phone / stolen device / house fire / travel with no device” ⇒ permanent account loss.
- Current reality: recovery typically falls back to email, SMS, backup codes, or support flows, which reintroduce password‑like or KBA risks.
- People complain there’s no simple, user‑controlled backup/export; draft “credential exchange” specs exist but are immature and often cloud‑mediated.
- Power users want printable, offline, cross‑vendor backups; others argue unexportability is a security feature.
Device, vendor lock‑in, and cloud trust
- Strong concern that mainstream passkey implementations are tied to Apple/Google/Microsoft clouds and specific OS ecosystems.
- Cross‑platform support via password managers (Bitwarden, 1Password, KeePassXC, Proton Pass, etc.) is praised but seen as poorly communicated and sometimes discouraged by attestation policies.
- Some explicitly reject any scheme where a cloud vendor can ban or misidentify them and thereby cut off all access.
Security improvements vs passwords
- Pro‑passkey arguments:
- Public‑key challenge–response; private key never leaves device.
- Domain binding prevents credential reuse on phishing sites.
- Eliminates password stuffing and most server‑side password leak impact.
- Forces uniqueness and sufficient entropy, especially for non–password‑manager users.
- Skeptics note that password managers with strong, unique passwords and autofill already mitigate many of these issues for power users.
Usability, UX, and non‑technical users
- Some report excellent UX (two taps with Face/Touch ID; “feels magic”), and higher success than passwords.
- Others recount broken or confusing flows, especially: multi‑device setups, Windows Hello quirks, browser differences, and QR‑code “hybrid” sign‑ins.
- Serious worry about elderly or low‑income users: single phone, no backups, weak mental model; current messaging and tooling are seen as too complex.
Hardware tokens and alternatives
- YubiKeys and similar “roaming authenticators” are liked for security but criticized as expensive, easy to lose, and awkward to manage across many services.
- Some prefer passkeys stored in password managers over platform clouds; others stick with TOTP or even PAKE‑based password systems.
Ethics, coercion, and policy
- Many resent “dark pattern” prompts that won’t accept a permanent “no.”
- FIDO attestation and potential whitelisting are viewed by some as a future tool for excluding “undesirable” devices/providers and tightening platform control.