Kill the Password: Why a String of Characters Can't Protect Us Anymore
You have a secret that can ruin your life. — It's not a well-kept secret, either. Just a simple string of characters—maybe six of them if you're careless, 16 if you're cautious—that can reveal everything about you.
Context & Ripple Effects
Wired's 'Kill the Password' manifesto lands at the end of a four-year arc of mainstream obituaries for the password: The New York Times declared passwords weren't a good defense back in August 2008, and by September 2010 it was arguing a strong password isn't the strongest security either. What changed by late 2012 is the attacker side of the ledger — Ars Technica's August 2012 reporting showed crackers have never been stronger, turning password weakness from a user-hygiene story into an arms-race story.
The piece also traveled unusually far for a feature argument: Digital Trends, Quartz, BuzzFeed and The Verge all carried it on or about November 17, 2012, suggesting the kill-the-password framing had become the consensus shorthand for the industry's authentication problem rather than one outlet's provocation.
First-order effects
- Consumer web services face immediate pressure to stop treating a single character string as adequate account protection, since the article's core claim — that simple passwords can no longer protect personal information — is now framed as settled across four years of coverage.
- Security vendors and device makers get a ready-made narrative for selling alternatives; the 2009 Bits report on an iPhone acting as the only password you need already sketched the device-as-credential model this argument strengthens.
Second-order effects
- Sites that keep password-only login become the competitive laggards, pushed toward two-factor schemes and device-bound credentials as the visible baseline shifts under them.
- The economics favor whoever controls the second factor: handset makers and platform owners are positioned to monetize identity, while sites that outsource authentication cede part of their customer relationship.
Third-order effects
- If the pattern holds, authentication restructures from something users memorize to something platforms issue — hardware tokens, devices, and eventually biometrics — concentrating identity infrastructure in a few large vendors and raising new questions about lock-in and recovery when the credential is lost.
The trend: Authentication is migrating from user-memorized strings toward device- and platform-issued credentials, with each major breach cycle accelerating the shift.