Microsoft Amps Up War On Passwords With A Key Change To New Accounts

Nefarious hackers have figured out many ways to circumvent 2FA restrictions and harvest passwords with sophisticated phishing traps. Many of these bad actors, however, will soon be looking for new ways to attack Microsoft user accounts. Microsoft seems to have delivered on its earlier promise to push users a passwordless sign-in experience. In addition to optimizing the sign-in UX for passkeys, Microsoft also revealed that it will create a default passwordless experience for new Microsoft account users.

So, what happens to existing account owners? Microsoft explained that existing users should delete passwords and switch to passkeys under the account settings feature.

In a blog post, Microsoft revealed that it will now auto-detect the safest login method attached to user accounts and present it to users trying to log in. It's well known that one-time codes are safer than passwords because if attackers manage to circumvent them once, they cannot use the code to sign in again. However, may access accounts indefinitely with the same compromised passwords. Microsoft then explained the purpose of this feature with this example -- if a user has two login methods attached to their account, like a one-time code and password, this feature will automatically present the one-time code sign-in method to the user because it is the most secure.

Microsoft added that many bad actors are perturbed by passwords being phased out, and that this will likely intensify their efforts to compromise users’ accounts that still rely on passwords in the short term. This is likely true given that fewer than 3500 passwords per second were being attacked in 2023; however, last year, a whopping 7,000 passwords were being attacked per second.


About 10 years ago, Microsoft introduced Windows Hello Biometric Security. It was a bold step that reflects Microsoft's long-term goal to phase out passwords. Although there were reports that hackers had found ways to bypass its facial recognition feature, passwordless login methods are still statistically safer.

Also, considering the advancement of AI and graphics processors and their success rate at cracking passwords, relying on passwords to protect our devices may not be the best option.

Microsoft is not the only company talking about the vulnerabilities of passwords. Apple has also embraced the use of passkeys. A few years ago, Google redesigned the Chrome to support passkeys. Microsoft, Google, Apple, and several other tech giants are intensifying their efforts to phase out passwords, and it won't be long before they're eventually replaced.

Top Image Credit: Microsoft