Microsoft ruined passwords, now aims for a passwordless future
&gt; The best passwords are truly random strings that are unmemorable<p>Let&#x27;s not fool ourselves: <i>those are no longer passwords</i>. A password in the &quot;things that you know&quot; sense of Two Factor <i>must</i> be memorable for it to meet that definition. Which is not that this is bad advice, as it remains great advice: if you must use &quot;passwords&quot; at least use random garbage passwords that you cannot possibly remember and store them somewhere safe such as a Password Manager.<p>What it does point out is that <i>passwords are broken</i> and have been for some time now. Those of us with the wherewithal to use random garbage backed by password managers have already been living in the &quot;passwordless future&quot;. Certainly it is a different &quot;passwordless&quot; than what Microsoft has done, but it is in base principle the exact same thing: using a &quot;something you have&quot; factor (password manager). Certainly a number of specifics differ and in theory if you&#x27;ve bothered to setup your own you are more likely to be using a (unique) strong &quot;pass phrase&quot; as a master key and at least keeping it &quot;something you know by-proxy&quot;.<p>I appreciate the stance that Microsoft&#x27;s &quot;passwordless&quot; requires you to give Microsoft more control than other options, but I think we need to be very clear that &quot;passwordless&quot; <i>is the goal</i> whether it is &quot;passwordless&quot; via tools such as password manager or &quot;passwordless&quot; via device hardware keys and biometrics engines. Passwords in the traditional sense of &quot;secret you have memorized&quot; have never really worked well and we <i>should</i> get rid of them. (And they were broken long before the bad password policies that Microsoft helped enable that required constant password rotation.)