![\"\"](\"https:\/\/www.woodcentral.com\/-\/peter\/wp-content\/uploads\/sites\/9\/2026\/10\/pass1.jpeg\")
<\/figure>\n\n\n\n1. Passkeys \u2014 the best general-purpose replacement<\/p>\n\n\n\n
Passkeys use public-key cryptography. Your device holds a private key, while the website stores the corresponding public key. When you sign in, your device proves possession of the private key without transmitting it to the website.<\/p>\n\n\n\n
- \n
- No password to steal, reuse, or phish.<\/li>\n\n\n\n
- The server doesn’t hold a reusable secret that can unlock the account.<\/li>\n\n\n\n
- Authentication can require a fingerprint, face recognition, or device PIN.<\/li>\n\n\n\n
- Supported by modern browsers, operating systems, and major authentication platforms.<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"https:\/\/www.woodcentral.com\/-\/peter\/wp-content\/uploads\/sites\/9\/2026\/10\/pass2.jpeg\")
<\/figure>\n\n\n\n2. Hardware security keys \u2014 for high assurance<\/p>\n\n\n\n
Devices supporting FIDO2\/WebAuthn provide phishing-resistant authentication. They are especially appropriate for administrators, financial accounts, and anyone who wants a physical credential independent of a phone.<\/p>\n\n\n\n
A lost key can be replaced if another registered key or recovery method is available.<\/p>\n\n\n\n
![\"\"](\"https:\/\/www.woodcentral.com\/-\/peter\/wp-content\/uploads\/sites\/9\/2026\/10\/pass3.jpeg\")
<\/figure>\n\n\n\n3. Email links or one-time codes \u2014 convenient, but weaker<\/p>\n\n\n\n
A user supplies an email address and receives a sign-in link or code. No permanent password is required.<\/p>\n\n\n\n
This is easier to implement, particularly for occasional users, but security depends on the email account. Email phishing, compromised mailboxes, and session theft remain risks. SMS codes are also vulnerable to SIM-swapping and interception.<\/p>\n\n\n\n
My preference would be passkeys for routine authentication, hardware keys for privileged access, and carefully designed recovery procedures. Email-based login is a reasonable alternative when convenience and accessibility outweigh the additional risk.<\/p>\n\n\n\n
The bigger problem: why do websites need accounts at all?<\/h2>\n\n\n\n
I think this is the more interesting question.<\/p>\n\n\n\n
Websites frequently demand registration even when they have little reason to know who the visitor is. That creates a database of personal information, adds administrative overhead, and gives attackers another target.<\/p>\n\n\n\n
There are three distinct requirements that often get confused:<\/p>\n\n\n\n
Requirement<\/th> Better approach<\/th><\/tr> Recognize a returning visitor<\/td> Anonymous, random browser token<\/td><\/tr> Preserve preferences or bookmarks<\/td> Random identifier in a secure cookie, with server-side or carefully designed local storage<\/td><\/tr> Prove permission to perform a sensitive action<\/td> Passkey or another appropriately strong authentication method<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n These are different problems and don’t necessarily require the same solution.<\/p>\n\n\n\n
For example, a woodworking website could let visitors bookmark articles, save preferences, and participate in certain site features without ever asking for a name or password. A random, revocable identifier could recognize the browser. Only features requiring persistent identity, moderation privileges, or account recovery would need stronger authentication.<\/p>\n\n\n\n
The limitation is that an anonymous cookie identifies a browser, not a person. It can be copied, deleted, or lost, and it doesn’t establish who is using it.<\/p>\n\n\n\n
What I would change about authentication<\/h2>\n\n\n\n
I’d favor the following design principles:<\/p>\n\n\n\n
- \n
- No mandatory passwords. Don’t require users to invent, remember, or periodically change them.<\/li>\n\n\n\n
- No mandatory usernames. Use a randomly generated internal account identifier; let people choose a public display name only when necessary.<\/li>\n\n\n\n
- No unnecessary registration. Allow anonymous use wherever identity isn’t required.<\/li>\n\n\n\n
- No shared secrets stored by the website. Prefer public-key authentication.<\/li>\n\n\n\n
- No SMS as the primary security mechanism. Prefer phishing-resistant credentials.<\/li>\n\n\n\n
- No insecure recovery back door. Recovery must be designed as carefully as initial authentication.<\/li>\n\n\n\n
- No permanent trust in a successful login. Protect sessions with secure cookies, expiration, revocation, and appropriate reauthentication for sensitive operations.<\/li>\n<\/ul>\n\n\n\n
There is one important caveat: passkeys do not eliminate every authentication problem. Devices can be lost, accounts can be compromised through recovery procedures, and an attacker who steals an active session may not need to authenticate again. Authentication is only one part of account security.<\/p>\n\n\n\n
Is the username\/password era actually ending?<\/h2>\n\n\n\n
Yes, in a meaningful technical sense. The FIDO Alliance’s passkey approach and the WebAuthn standard have made passwordless authentication practical across mainstream platforms. Passwords will remain in use for years because of legacy systems, incompatible devices, and recovery requirements, but there is little reason for new systems to make them the default.<\/p>\n\n\n\n
The real change is conceptual: instead of proving identity by presenting a secret that a user memorizes, the user proves control of a cryptographic credential.<\/p>\n\n\n\n
My bottom line: the future should be identity when necessary, authentication when justified, and anonymity by default. A website shouldn’t need to know who you are merely to remember what you were doing.<\/p>\n\n\n\n
That approach is particularly attractive for independent websites that value privacy and don’t need to collect personal information to function.<\/p>\n","protected":false},"excerpt":{"rendered":"
The username\/password combination is an old solution to a problem that has changed dramatically. It was designed for a world where people remembered a handful of passwords and attackers had limited computing resources. Today, people maintain dozens or hundreds of accounts, phishing is industrialized, and stolen credentials are traded automatically. We have better technology now. … Read more<\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-2309","post","type-post","status-publish","format-standard","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/posts\/2309","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/comments?post=2309"}],"version-history":[{"count":2,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/posts\/2309\/revisions"}],"predecessor-version":[{"id":2314,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/posts\/2309\/revisions\/2314"}],"wp:attachment":[{"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/media?parent=2309"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/categories?post=2309"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/tags?post=2309"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}