Logging into a bank account now often means a Face ID prompt instead of a typed password — a silent handshake between a device and an account, standardized under the FIDO Alliance's passkey protocol and pushed hard by Apple, Google, and Microsoft since 2023. Nothing is typed from memory. Something is simply resembled.
A password is a secret — something a person knows that can, in principle, be changed if compromised. A passkey tied to Face ID or a fingerprint is a signal — something a person is or has — and signals are not really secrets at all, since a face is public by default and a device can be physically taken.
The new stack solves the single worst failure mode of passwords — reuse and phishability — extremely well, because there is no secret to phish. It introduces a different failure mode in exchange: what happens when the signal itself is compromised, spoofed, or simply unavailable, since a face cannot be reset the way a password can.
The shift disadvantages people whose device access is unstable — shared family devices, older hardware, people who lose or replace phones often — because passkeys bind identity to a device in a way that assumes continuous, individual ownership that not everyone actually has.
Account recovery, already a weak point in security design, becomes structurally harder in a passwordless system, because the recovery path has to answer a genuinely difficult question — how to prove identity using some other signal once the primary one is gone — without simply recreating a new secret-based backdoor that undoes the whole point. Every major platform pushing passkeys has, so far, kept a password or a code as the quiet fallback, which is itself an admission the new stack is not load-bearing alone yet.
The systems most likely to hold up under real-world failure are the ones that treat identity as a portfolio of signals rather than a single strong one, combining device, biometric, and behavioral factors so that losing any single one degrades security gracefully rather than catastrophically. The post-password era is not eliminating the identity problem. It is trading a well-understood set of failures for a less familiar one, and adoption is running ahead of anyone's experience with the edge cases.