PayPal Says It's Time to Ditch Passwords and PINs, and Apple may lead the way with iPhone 6
PayPal CISO Michael Barrett took the keynote stage at Interop today to announce the impending death of passwords and their replacement with more robust authentication protocols based on an open standard …
Context & Ripple Effects
This is the second act in a story that has been building since early 2011, when Computerworld framed how Apple and Google will kill the password as a platform question rather than an identity-vendor one. At Interop this week, PayPal gave it an operator's voice: CISO Michael Barrett declared passwords and PINs headed for replacement by open-standard authentication protocols.
The rumor layer is what makes the keynote travel — eight outlets including Engadget, PC Magazine and The Register picked up the claim within a day, and all of it leans on Apple's unconfirmed role with the next iPhone. What is confirmed around the same date supports the thesis: Apple just expanded two-step verification to ten more countries, and law enforcement agencies reportedly cannot unlock iPhones without Apple's cooperation — evidence that the security perimeter has already moved into the device itself.
First-order effects
- PayPal commits its own merchant and consumer base to open-standard credential schemes over passwords, making Barrett's organization an early reference implementation rather than a bystander.
- Apple's rumored lead role ties passwordless login to the next iPhone's hardware, turning biometrics and secure elements into a headline feature competitors would have to match.
Second-order effects
- Rival wallet players — the ones Computerworld flagged alongside Apple back in 2011, Google among them — face pressure to ship equivalent device-based authentication or concede the checkout experience to whoever owns the credential.
- Handset makers become the de facto identity gatekeepers for payments, since the credential lives in their silicon; banks and processors risk renting access to customers they currently authenticate themselves.
Third-order effects
- An open standard for passwordless auth, if it holds, shifts trust architecture industry-wide from server-stored shared secrets to device-bound credentials — which also concentrates regulatory and breach-liability questions on the platform holders whose devices hold those credentials.
The trend: Consumer authentication is migrating from passwords held on servers to credentials bound to handsets, with platform owners like Apple positioned to control who authenticates whom.