Stronger authentication is genuinely harder to run than weak authentication, and for one honest reason. Strength comes from binding a credential to a person or to a physical thing, and anything bound has to be issued, carried, enrolled and eventually replaced. A password carries none of that cost. That is exactly why it is weak.
Three principles underpin all modern authentication
The three musketeers of identity have not changed in decades. Every modern authentication system rests on the same three principles:
- Something you know: knowledge of a secret
- Something you have: possession of an object
- Something you are: personal identity itself, such as a fingerprint or facial recognition
All three do the same job. Each one narrows down whether an unknown user is who they say they are.
Only the first looks free. A secret can be copied without anyone noticing it has gone, which is convenient for the user and considerably more convenient for the attacker. It is not actually free either. It simply bills later, in resets, lockouts, helpdesk queues and the hours an IT team spends clearing them, none of which appear in the business case for keeping passwords.
A security key cannot be copied. Neither, practically speaking, can a fingerprint. The properties that make the second and third factors worth having are the same properties that make them awkward to operate: they exist in the physical world, they get left in hotel rooms, they need enrolling before they work, and they need replacing when they fail. Usually at 4pm on a Friday. The difference is when you pay. Strong authentication charges up front, visibly, in issuance and enrolment. Passwords charge quietly, continuously, and for as long as you keep them.
So part of the difficulty is real, and no vendor can talk it away. Most of what organisations experience as hassle is something else, and it is avoidable.
Passwords are the most convenient method and the weakest
Passwords have been used since the first shared computers, and the idea is thousands of years older than that. Knowledge-based authentication is simple: if only two parties know a secret, saying the secret proves who you are, because nobody else can say it. For computers this looked close to perfect.
The weak link is the human generating the password. Passwords that are simple and easy to remember are also the simplest and easiest to crack. Complex passwords are rewarded with greater security and punished with far less convenience, because they get forgotten, which produces resets. Most organisations eventually notice that the real trade-off is not security against convenience. It is security against helpdesk volume.
A stolen password also leaves nothing behind. The user still has it, so nothing looks wrong, which is why credential theft stays useful to attackers long after the theft itself.
Password managers move the weak link rather than removing it
Password managers take the human out of the chain, and that is a real gain. Passwords are not inherently insecure. Generated correctly and never reused, a random password is cryptographically sound authentication.
What a manager cannot change is what happens when the password is used. However strong the secret, it still has to be presented to the service to prove who you are, which means it can be lifted by a keylogger, scraped from a compromised endpoint, or handed straight to a convincing fake login page. Once captured it can simply be replayed, and it works exactly as well for the attacker as it does for the owner, because a password has no way of knowing who is presenting it. A 40-character random string is no harder to replay than “password1”.
The problem does not disappear, then. It moves, and it moves twice. The vault becomes the target, and it holds everything. And the credential itself stays replayable no matter how well it was generated.
LastPass showed what that looks like. Following its 2022 breach, the UK Information Commissioner’s Office fined LastPass UK Ltd £1,228,283 in November 2025 for failing to put appropriate technical and organisational measures in place, affecting up to 1.6 million UK users. The company separately settled a consolidated US class action for around $24.5 million. Most striking of all, a US federal forfeiture complaint tied a single $150 million cryptocurrency theft in January 2024 to private keys recovered by cracking vault data stolen in that breach. It was not the company’s first security incident either.
Managers that keep vaults on the device rather than in the cloud raise security and lower convenience, and they are still exposed to infostealer malware harvesting credentials from the endpoint. These events are rare. They are not hypothetical.
Push notifications trade a password for an interruption
Push authentication rests on something you have. A notification arrives on a registered phone and the user accepts or declines. No password is typed, and where the phone requires a fingerprint or face scan to approve, something you are comes along too. It is one of the most widely deployed second factors in the enterprise, which is precisely why attackers have spent so much effort on it.
The convenience cost is a small interruption repeated all day. You need the phone, and you need to pick it up, unlock it, find the notification, approve it, and put the phone back down. Lose the phone, run the battery flat or lose signal and authentication becomes impossible rather than merely slow.
The security cost is push fatigue. An attacker who already holds the password simply requests approval over and over until the user taps accept to stop the noise, which works best late at night when nobody is at their sharpest. This is why the US Cybersecurity and Infrastructure Security Agency (CISA) does not count push among phishing-resistant methods, and why the US federal zero trust strategy set out in OMB Memorandum M-22-09 directs agencies away from it. Number matching helps, and CISA is explicit that it is an interim mitigation rather than the destination.
Passkeys split into two very different experiences
Passkeys took a long route to adoption. The Fast Identity Online (FIDO) Alliance formed in 2012, WebAuthn became an official web standard in March 2019, the word “passkey” arrived as a consumer term in 2022, and in 2023 the FIDO Alliance extended it to cover two distinct things. The distinction matters more than the marketing suggests, because the two behave differently on both axes.
Device-bound passkeys
The private key is generated in hardware and never leaves it. Authentication is a cryptographic challenge and response bound to the origin of the site requesting it, so a convincing fake website cannot use the credential. In the good case the whole thing is a two-second fingerprint scan. CISA treats FIDO and PKI as the only two widely available approaches that genuinely resist phishing, and this is one of them.
Synced passkeys
A synced passkey is replicated across a user’s devices through a cloud account. On your own hardware that is excellent. Signing in on a machine that does not hold the passkey is a different story: the screen shows a QR code, the user scans it with a phone, and the two devices complete the ceremony over an encrypted network tunnel with a Bluetooth proximity check confirming they are near each other. Both devices need to be powered, online and Bluetooth-capable, and where Bluetooth is unavailable the flow can dead-end with no way forward. Scanning a QR code to log in is not a two-second experience.
The security difference follows the same logic. A key that never leaves one piece of hardware is protected by that hardware. A key replicated to every device on an account is protected by whatever protects the account.
Smart cards buy their convenience back after the first login
Smart cards are more specialised than anything above and remain the strongest option available to most organisations. The card is a physical token, roughly the size of a credit card. To prove who you are, insert the card, which is something you have, and enter a PIN, which is something you know.
The effort is front-loaded into a single action at the start of a shift. Once the card is in the reader, subsequent authentications need only the PIN, which makes steady-state use about as fast as typing a short number while carrying the security of a hardware-held cryptographic credential. Smart cards are not inconvenient. They are inconvenient once.
The limits are honest ones. Issuing a physical card takes a process, and losing one means collecting a replacement from IT rather than clicking “forgot password”. Due to logistical complications, nobody is going to authenticate to a personal email account this way. Theft attacks against the cards themselves exist in theory and are extremely rare in practice. USB keys such as the YubiKey work on the same principle, and several models read a fingerprint instead of a PIN, swapping something you know for something you are. Price is what keeps them uncommon outside the workplace.
The perfect blend does not exist
| Method | What the credential is | Replayable | The real limitation |
| Passwords | Static shared secret | Yes | Only free and convenient if it never changes, is reused everywhere and nobody enforces rules |
| Password managers | Static shared secret, well generated | Yes | A better secret is still a secret, and it still has to be presented to be used |
| Push notifications | Dynamic approval | No | Push fatigue. The credential holds, the person is persuaded |
| Synced passkeys | Private key replicated to a cloud account | No | Control over where the key lives and what it syncs with sits outside the organisation |
| Device-bound passkeys | Private key held in hardware | No | Enrolment and a recovery path have to exist before you need them |
| Smart cards and hardware keys | Private key held in hardware | No | Physical issuance, and a reader |
Everything above the line in that table shares one property: the credential can be taken and used by somebody else. That is the dividing line, and it matters more than any ranking of how pleasant each method is to live with. Below it, the credential cannot be replayed, and the remaining problems are ones of enrolment, recovery and control rather than theft.
The hassle is the patchwork, not the authentication
Here is what the table cannot show. No organisation picks one row. Different parts of a workforce genuinely need different rows at the same time. Engineers on air-gapped networks. Shift workers sharing a terminal. Contractors who need access for six weeks. The finance team. The systems administrators whose accounts are worth more to an attacker than everyone else’s combined. Each requirement gets solved as it appears, usually with a separate product, a separate administrative console and a separate contract.
That is where the effort goes. Not into the daily logon, which is usually fine, but into enrolment, recovery, integration and the administrative interfaces nobody owns end to end. CISA’s guidance on phishing-resistant MFA includes a section on the stumbling blocks organisations hit during deployment, and none of them are cryptographic. They are systems a vendor never got round to supporting, user groups that cannot move yet, and decisions about what to protect first.
The same guidance names FIDO and PKI as the only two widely available methods that resist phishing. Those two are not alternatives to each other. They suit different people in the same building.
Most organisations need passwords, MFA and PKI at the same time
Authentication maturity is a spectrum, not a ladder. Organisations do not progress neatly from passwords to multi-factor authentication to public key infrastructure and stop at the end. In practice a large enterprise runs all three at once: password security for the users who still need a password, multi-factor authentication for the majority, and PKI smart cards for the highest-assurance roles. Nothing on that spectrum is a stepping stone to anything else, and nothing sits above or below anything else. Each point serves a different part of the workforce.
Read that way, the question changes. It stops being “which method should we standardise on” and becomes “how few systems can we run while still covering everyone”.
Count the consoles before blaming the cryptography
The friction built into strong authentication is small and unavoidable: a card to carry, a key to enrol, a PIN to remember. Nobody should pretend otherwise, least of all a vendor. The friction most organisations feel is something different, and it sits in the seams between products that were each the correct answer to one question asked three years apart.
That is the gap MyID® is built to close, because one suite covers the whole spectrum. MyID PSM secures the passwords that remain, enforcing policy aligned to NIST 800-63B and checking credentials against a database of over 11 billion breached passwords, both as passwords are set and retrospectively across Active Directory. MyID MFA covers the middle, from one-time codes and hardware tokens through to FIDO2 passkeys in synced and device-bound form, with passwordless Windows logon that works offline. MyID CMS issues and manages the high-assurance end, PKI smart cards and tokens at FIPS 201 compliance, from hundreds of users to millions. Underneath both, MyID SecureVault recovers keys independently of any certificate authority.
Fast, easy authentication with minimal helpdesk traffic does not have to come at the cost of security, and security has to come first. There have been enough data breaches. We do not need one more.
See it for yourself, cover the whole scale with one suite. Book a MyID demo and we will map your workforce across the authentication spectrum, then show you which products cover each part of it.