Microsoft ruined passwords, now aims for a passwordless future
> The best passwords are truly random strings that are unmemorable<p>Let's not fool ourselves: <i>those are no longer passwords</i>. A password in the "things that you know" sense of Two Factor <i>must</i> be memorable for it to meet that definition. Which is not that this is bad advice, as it remains great advice: if you must use "passwords" at least use random garbage passwords that you cannot possibly remember and store them somewhere safe such as a Password Manager.<p>What it does point out is that <i>passwords are broken</i> and have been for some time now. Those of us with the wherewithal to use random garbage backed by password managers have already been living in the "passwordless future". Certainly it is a different "passwordless" than what Microsoft has done, but it is in base principle the exact same thing: using a "something you have" factor (password manager). Certainly a number of specifics differ and in theory if you've bothered to setup your own you are more likely to be using a (unique) strong "pass phrase" as a master key and at least keeping it "something you know by-proxy".<p>I appreciate the stance that Microsoft's "passwordless" requires you to give Microsoft more control than other options, but I think we need to be very clear that "passwordless" <i>is the goal</i> whether it is "passwordless" via tools such as password manager or "passwordless" via device hardware keys and biometrics engines. Passwords in the traditional sense of "secret you have memorized" have never really worked well and we <i>should</i> get rid of them. (And they were broken long before the bad password policies that Microsoft helped enable that required constant password rotation.)