Goodbye, Passwords. You Aren't a Good Defense.
THE best password is a long, nonsensical string of letters and numbers and punctuation marks, a combination never put together before. Some admirable people actually do memorize random strings of characters for their passwords …
Context & Ripple Effects
This 2008 argument that passwords are a weak defense was an early shot in a debate that only intensified. Two years later, the Times followed up with the point that even a strong password isn't the strongest security, and by 2012 Wired went further, arguing it was time to kill the password outright because character strings could no longer protect anyone.
First-order effects
- Users are told the best practice — long random strings memorized by hand — is both burdensome and insufficient, shifting responsibility toward sites and services to offer stronger authentication.
- Security-conscious consumers begin looking beyond passwords alone, priming demand for hardware tokens and device-based sign-in like the iPhone-as-password idea that followed in 2009.
Second-order effects
- Vendors respond with layered alternatives: Google's 2017 Advanced Protection Program made physical security keys mainstream for high-risk users, showing where the market was heading.
- Password managers and two-factor tools become an adjacent growth market as users seek to offload the memorization burden this article describes.
Third-order effects
- If the pattern holds, authentication migrates from something users know to something they have or are — culminating in today's passkey era, though as recent coverage notes, syncing passkeys through password managers can create platform lock-in and usability trade-offs.
- The industry slowly reframes account security as a shared platform responsibility rather than an individual user's discipline, with regulators and large platforms pushing passwordless standards.
The trend: A sixteen-year arc from 'make better passwords' to 'abolish passwords,' as the industry moves from user-memorized secrets toward cryptographic, device-bound authentication like passkeys.