Something Only You Know

In the spring of 1962, Allan Scherr, a doctoral student at MIT, wanted more computer time. He was one of the researchers using the Compatible Time-Sharing System, a machine that let many people work on one expensive IBM computer at the same time, each with a private allotment of hours and a private password. The passwords sat together in a single file on the system. Scherr found that he could ask the machine to print files offline by submitting a punched card, and that nothing stopped him from asking for that one. He printed the list, used other people’s accounts to stretch his hours, and shared the passwords with others, one of whom used the account of the laboratory’s director to leave messages. Scherr told the story to Wired half a century later; he had confessed it in person to a senior MIT professor about twenty-five years after it happened.¹

The computer password had barely been invented, and it had already failed in the way it would keep failing. The secret that proved who someone was had to be stored somewhere so the machine could check it, and anything stored could be read by the wrong person. Six decades later, the same idea guards bank accounts, medical records, tax returns, company networks and the private messages of billions of people. A study of half a million web users in 2007 found that the average person had about 25 accounts that needed passwords, used 6.5 different passwords across them, and typed one about eight times a day.² In the 2025 edition of Verizon’s annual survey of data breaches, the use of stolen or guessed credentials was the most common way attackers first got in, accounting for 22 percent of the breaches studied.³ And the industry is now trying to retire the password altogether: in October 2026 the FIDO Alliance, the body behind passkeys, estimated that 7 billion of them were in use.⁴

This essay follows how a secret word typed into a shared computer became the way machines decide who people are. It follows the decisions that shaped that change: how passwords were stored, how they were combined with cards and phones, how companies tried to give the web a single login, how officials wrote rules that made passwords worse, how leaks and phishing showed the limits of shared secrets, and how identity moved into devices, bodies and national databases. Its deeper subject is what it means to be recognised by a machine, and what happens when the proof of who someone is moves out of their memory and into things that others build and control.

Before the password: watchwords, seals and signatures

Proving identity at a distance is an old problem, and the oldest solution is a shared secret. In the sixth book of his Histories, written in the second century BC, the Greek historian Polybius described how the Roman army circulated a watchword through its camp each night. The word was written on a wooden tablet, passed from unit to unit and returned to the tribune, so that the officers could tell if any unit had failed to receive it, and sentries on watch were inspected through the night.⁵ The watchword let a sentry tell friend from enemy in the dark, but only so long as the enemy did not learn it, and every person who knew it was a possible leak. The Book of Judges tells of a test that worked the other way, by a trait that could not be taught: the Gileadites made fugitives say the word “shibboleth” and identified their enemies by how they pronounced it.

For most of history, though, identity was established face to face and by what people carried. A merchant was known by his seal, a traveller by letters of introduction, a bank customer by a signature card kept at the branch and compared by a clerk. Each method rested on something hard to forge and on a person who knew what to look for. States, as the historian John Torpey has shown, spent the nineteenth and twentieth centuries building systems of documents, passports and registers to identify people they had never met, and those systems made identity something a citizen had to prove rather than something neighbours simply knew.⁶ The password combined the oldest of these methods, the shared secret, with a new kind of guard that never got tired, never recognised a face and could check a secret thousands of times a second.

A key for a shared machine

At the start of the 1960s, computers worked in batches. A programmer handed a deck of punched cards to an operator and came back hours later for the output. Time-sharing changed that. A program switched the machine rapidly between many users at terminals, so each seemed to have the computer to themselves. At MIT, a team led by Fernando Corbató built the Compatible Time-Sharing System, first demonstrated in 1961, and in the years that followed it became the system most computer historians credit with the first computer passwords.¹

The reason was practical. Many researchers shared the system, each with a ration of time and a set of private files. The system had to know who was logged in to charge their time and to keep people out of one another’s work. Corbató later said the aim was to stop researchers from nosing around in each other’s files. A password typed at the terminal was the cheapest answer: no new hardware, no cards to issue, and nothing to lose except a word. In 2014, at the age of 87, Corbató told the Wall Street Journal that the arrangement had become “kind of a nightmare” with the World Wide Web, and admitted that he had kept his own passwords on a crib sheet.⁷

The stakes in 1962 were low, and the community was small. Scherr’s theft was a prank in a world where the worst outcome was a stolen hour of computing. But the system’s weakness was built in: it kept every user’s password in readable form, in one file, which had to be protected perfectly. It was not. Robert Morris, later a computer scientist at Bell Labs, recalled being on the system in the early 1960s when one administrator was editing the password file while another edited the daily message shown to every user at login. A design error swapped the two editors’ temporary files, and for a while the password file was printed on every terminal that logged in.⁸

Not everyone at MIT wanted passwords at all. At the Artificial Intelligence Laboratory, the culture Steven Levy described in Hackers (1984) held that computers should be open to anyone who could use them well. When MIT’s Laboratory for Computer Science introduced passwords, in the late 1970s or around 1980 by different accounts, Richard Stallman, then a programmer at the AI Lab, campaigned against them, urging users to choose an empty password. Accounts of the episode differ on its date and methods, and the passwords stayed.⁹ The disagreement was about more than convenience. A password assumed that the people sharing a machine might not trust each other. The hackers’ objection was that building that assumption into the machine would help make it true.

Storing what cannot be read

The fix for the stored password came from Cambridge. In 1967 Roger Needham, working on the Titan computer in Maurice Wilkes’s laboratory, proposed that the system should never store the password at all. Instead it would store the result of a one-way function: a calculation easy to perform on the password and practically impossible to reverse. When a user logged in, the system would apply the same function to what they typed and compare the results.¹⁰ An attacker who stole the file would get only the scrambled values.

The idea reached Unix, the operating system written at Bell Labs, and in November 1979 Robert Morris and Ken Thompson published a short paper in Communications of the ACM on how Unix had learned to protect passwords.⁸ It is one of the first honest accounts of what users actually do. Morris and Thompson collected 3,289 passwords and tried to guess them. Fifteen were a single character, 72 were two characters, and hundreds more were short strings or single words. In all, 2,831, or 86 percent, fell into classes an attacker could search, and a five-minute dictionary search alone found about a third. Their anecdote about system-chosen passwords was worse: one installation generated random eight-character passwords that should have taken 112 years to search, but its random number generator had so few starting values that a friendly user found every password with about a minute of machine time.

Their answer had three parts, each a trade-off. First, make the scrambling slow. The Unix scheme used the newly published DES cipher, run 25 times, so each guess cost an attacker real time; the same cost fell on the system at every login, but a user logs in rarely and an attacker guesses millions of times. Second, nudge users toward longer passwords, though “he is not prevented from using his spouse’s name if he wants to,” as the paper put it. Third, add salt: a 12-bit random number mixed into each password before scrambling and stored beside the result. Salt did not make any single password harder to crack. It stopped an attacker from scrambling a dictionary once and comparing it against every user at the same time, because each user’s passwords now had to be attacked separately, and two people with the same password had different entries in the file.

Morris and Thompson’s guiding principle was to assume the password file would be read. That principle was soon tested. In November 1988 a self-copying program written by Robert Tappan Morris, the son of the 1979 paper’s co-author, spread across the early internet. One of its methods was to guess passwords on each machine it reached, trying variations of the user’s name, then a built-in list of 432 likely words, then the system’s dictionary.¹¹ It worked often enough to help the worm spread to thousands of computers. Users, given the freedom to choose, were choosing what attackers would guess first.

Four digits at the cash machine

While computer scientists wrestled with passwords, banks were inventing a different arrangement for a much larger public. In May 1966 James Goodfellow, an engineer at a Smiths Industries subsidiary in Glasgow, filed a British patent for a cash dispenser that would release money only when a customer presented a card and entered a personal identification number that matched a coded value on the card in a predetermined way.¹² On 27 June 1967, Barclays opened a cash machine at its branch in Enfield, north London, built by De La Rue to a design credited to John Shepherd-Barron.

Shepherd-Barron later explained why the code was short. He had first wanted six digits, the length of his army number, which he could remember. His wife, Caroline, told him at the kitchen table that she could remember only four, and “because of her,” he told the BBC, “four figures became the world standard.”¹³ The account is his own, and other machines and patents of the period had their own designs. But the arrangement that spread was the one that mattered: a card the customer carried and a short code the customer remembered.

That pairing was the first mass deployment of what security engineers later called two-factor authentication: something you have and something you know. Each factor was weak alone. A card could be stolen; four digits could be guessed one time in ten thousand. Together, a thief needed both, and the machine could swallow the card after a few wrong guesses, which made guessing hopeless. The bank had chosen a code ordinary people could remember over one that would resist a determined attacker, and had made up the difference with a physical object. It was a better bargain than most computer systems would strike for another forty years.

Strangers on a network

Time-sharing put many users on one computer. Networks put many computers in contact, and a password typed on one machine now had to be checked by another, often across wires anyone might tap. In 1976 Whitfield Diffie and Martin Hellman, at Stanford, published “New Directions in Cryptography,” which proposed a way out of the oldest problem in secret communication: two parties who had never met could agree on a secret over a public channel, and a person could produce a digital signature that anyone could check but only they could make.¹⁴ Each user would have two mathematically linked keys, one private and one public. The private key never had to be shared, so it could never be overheard or stolen from a server. Ronald Rivest, Adi Shamir and Leonard Adleman found a practical scheme in 1977 and published it in 1978. These ideas would take nearly four decades to reach ordinary logins, but they contained the answer the password lacked: a way to prove who you are without revealing the proof.

In the meantime, universities built systems to manage passwords across networks. MIT’s Project Athena, which put workstations across the campus, faced the problem that a student’s password typed at any machine would otherwise travel the network in readable form. Its answer, described in 1988 by Jennifer Steiner, Clifford Neuman and Jeffrey Schiller, was Kerberos, named after the three-headed dog of Greek myth.¹⁵ A user proved their password once to a trusted central server, which issued time-limited tickets that the user’s machine could present to other services, so the password itself never crossed the network. Kerberos built on a 1978 protocol by Needham and Michael Schroeder. Microsoft later made Kerberos the default way to log in to Windows networks, beginning with Windows 2000, and it still underpins the login of most large organisations. It also established a pattern that would return on the web: a central party that vouches for users so that each service does not have to check them itself.

Nobody knows you’re a dog

On 5 July 1993 the New Yorker published a cartoon by Peter Steiner showing a dog at a computer telling another dog: “On the Internet, nobody knows you’re a dog.”¹⁶ It became the most reprinted cartoon in the magazine’s history, because it captured both the freedom and the problem of the new network. A person online could be anyone, which allowed experimentation, anonymity and escape, and also impersonation and fraud. A website had no way of knowing who was typing except what they typed.

The commercial web resolved this by giving everyone accounts. Every shop, newspaper, forum and bank asked visitors to choose a username and password, and the decisions about how to protect them were made thousands of times over, by companies of every size and skill. The result fell on users. Florêncio and Herley’s study, which measured the password habits of more than half a million people over three months in 2006 and 2007 through a component of a Microsoft toolbar, found the 25 accounts and 6.5 passwords mentioned at the start of this essay, which meant each password was shared by nearly four sites. Most people chose passwords of lower-case letters alone unless forced to do otherwise, and at least 1.5 percent of Yahoo’s users forgot their passwords each month.²

Researchers had already begun to argue that this was a design failure, not a user failure. In 1999 Anne Adams and Martina Angela Sasse, at University College London, published “Users Are Not the Enemy” in Communications of the ACM. Surveying and interviewing employees, they found that people wrote passwords down, reused them and shared them because the rules they were given conflicted with the way they worked and with the limits of memory, and because no one had explained the reasons for the rules. Security departments, they argued, treated users as a risk to be controlled when they should design around them.¹⁷ It took nearly two decades for official guidance to agree.

One login for the whole web

If people had too many passwords, the obvious remedy was one login for everything. In 1999 Microsoft launched Passport, which let users sign in to participating websites with a single Microsoft account. It became the required login for Hotmail and other Microsoft services, and the company hoped it would become the identity layer of the web. Few large sites outside Microsoft adopted it. They were reluctant to hand their relationship with customers to a rival that would see every login. In 2001 a coalition of privacy groups complained to the US Federal Trade Commission, and in August 2002 Microsoft settled charges that it had misrepresented Passport’s security and the information it collected. The settlement required a security programme with independent audits for twenty years; it was not an admission of wrongdoing, and the FTC did not find that any breach had occurred.¹⁸

Inside Microsoft, the failure prompted rethinking. In 2005 Kim Cameron, the company’s identity architect, published “The Laws of Identity,” which argued that any identity system the web would accept had to put users in control, disclose the minimum information needed only to parties with a justified need, and allow many identity providers rather than one.¹⁹ Microsoft built a product on these principles, CardSpace, which stored “information cards” on the user’s computer. It never caught on, and in February 2011 Microsoft announced that its next version would not ship.

The web solved single sign-on another way, through open standards and the companies people already used. In 2005 Brad Fitzpatrick, the creator of the blogging site LiveJournal, developed OpenID, which let a person use an address they controlled to log in elsewhere.²⁰ OAuth followed, a standard for letting one service act on a user’s behalf at another without seeing their password; its second version was published by the Internet Engineering Task Force in October 2012, after a dispute in which its lead editor resigned, arguing that the standard had become too loose to guarantee that different implementations would work together or be secure.²¹ On these foundations Google, Facebook and others offered “Sign in with” buttons that millions of sites adopted. Microsoft’s centralised vision came true, in a different form, run by the largest consumer platforms. In 2019 Apple added its own button, which could give each website a different, randomly generated email address that forwarded to the user’s real one, so sites could not use a shared address to link a person’s accounts.²² Logins had become a contest over who would know where people went.

The rules that made passwords worse

The other answer to weak passwords was to require stronger ones. In 2003 the US National Institute of Standards and Technology published Special Publication 800-63, guidance on electronic authentication for federal agencies. Its Appendix A, written by Bill Burr, a NIST manager, offered a way to estimate a password’s strength, and from it grew rules that spread across the world: at least eight characters, a mix of upper and lower case, a digit, a symbol, and a change every 90 days. The guidance was meant for government systems, but companies, banks and universities copied it because it carried the authority of the national standards body.

The rules met people as Adams and Sasse would have predicted. Users chose the simplest password that satisfied them, such as a capitalised word followed by a digit and an exclamation mark, and when forced to change it, changed one character. Attackers built those patterns into their guessing programs. In 2017 Burr, by then retired, told the Wall Street Journal that “much of what I did I now regret.” He had worked with little real data, drawing on a white paper from the 1980s.²³ The same year NIST published a revised guide, SP 800-63B, which dropped composition rules and periodic changes and told organisations instead to allow long passwords and to check new ones against lists of common and breached passwords. In the fourth revision, finalised in 2025, the language hardened: systems following the guidance shall not impose composition rules and shall not require periodic changes unless there is evidence that a password has been compromised.²⁴

The episode shows what happens when a measurable proxy becomes the goal. Complexity rules measured the variety of characters in a password, which is easy to check, rather than how guessable it was, which is what matters. People optimised for the measure. The rules also imposed a cost that no one counted: the time and frustration of millions of users, and the help-desk calls of everyone who forgot.

The great leaks

In December 2009 an attacker broke into RockYou, a company that made applications for social networks, and took the details of 32 million users. RockYou had stored the passwords in plain text. When the security firm Imperva analysed them in January 2010, it found that 290,731 people had used “123456,” and that nearly half of the passwords were names, dictionary words, slang or trivial patterns.²⁵ The RockYou list became the standard dictionary that password-cracking tools used for years afterwards, a ready-made map of how people choose.

RockYou was a small company, but large ones made similar choices. In 2012 LinkedIn reported that about 6.5 million password hashes had been posted online. They were scrambled with SHA-1, a fast function, and without salt, so most were cracked quickly. In May 2016 the full set surfaced for sale, and LinkedIn confirmed that it covered about 117 million accounts.²⁶ Yahoo disclosed in December 2016 that an attack in August 2013 had affected more than a billion accounts; in October 2017 it said that all of its roughly three billion accounts had been affected.²⁷ The Unix designers had shown in 1979 how to store passwords so that a stolen file would yield little. Thirty years later, many companies had not followed them.

The leaks mattered far beyond the companies that lost them because of reuse. A person who used the same password on a gaming site and an email account had, in effect, given the gaming site the key to their email. Attackers learned to take lists of leaked usernames and passwords and try them automatically against banks, shops and email services, a technique called credential stuffing. In 2013 the security researcher Troy Hunt began collecting breached data into a public service, Have I Been Pwned, so that people could check whether their addresses appeared. For the many sites that still relied on passwords alone, the security of an account now depended on the weakest site where its password had ever been used.

Cormac Herley, a researcher at Microsoft, made an argument in 2009 that unsettled security professionals. In a paper titled “So Long, and No Thanks for the Externalities,” he argued that users who ignored security advice were often behaving rationally. The advice imposed a certain cost, in time and effort, on every user every day, while protecting each of them against a small expected loss, much of which banks absorbed. He estimated that if every American internet user spent a minute a day checking web addresses to avoid phishing, the cost in time would be about a hundred times larger than all phishing losses.²⁸ The problem was not that users were careless. It was that the advice asked them to pay for protection whose benefits fell mostly on others.

Something you have

The fix the banks had used in 1967, adding a second factor, came slowly to computer logins. Security Dynamics, later RSA Security, sold SecurID tokens: small key fobs whose display showed a six-digit number that changed every minute, computed from a secret seed shared with the company’s server. For two decades they protected the remote access of banks, governments and defence contractors.

Their weakness lay at the centre. In March 2011 RSA disclosed that attackers had broken into its network, after one of four targeted employees opened an attachment to a spear-phishing email, and had stolen information related to SecurID. In May, Lockheed Martin detected an attack on its network that RSA later confirmed had used the stolen information, and RSA offered to replace tokens for many of its customers.²⁹ A second factor based on a shared secret had the same flaw as a password, moved up a level: whoever held the seeds held the keys.

For consumers, the second factor became the phone. In February 2011 Google offered two-step verification to all its users: after the password, a code sent by text message or generated by an app.³⁰ Banks and websites adopted text-message codes widely, because nearly everyone had a phone and needed nothing new. But a phone number belongs to a mobile network, not to the person, and networks could be talked into moving it. In August 2019 attackers persuaded an employee of the mobile operator AT&T to transfer the phone number of Jack Dorsey, Twitter’s own chief executive, and used it to post offensive messages from his account through a feature that allowed tweeting by text message.³¹ NIST had already warned in 2016 that text messages were a weak channel; its final 2017 guidance classed them as “restricted,” usable only with an alternative offered and the risks explained.³²

Even weak second factors helped against the commonest attacks. In a presentation in February 2020, Alex Weinert, Microsoft’s director of identity security, reported that about 1.2 million Microsoft enterprise accounts had been compromised in January of that year and that 99.9 percent of them had not used any form of multi-factor authentication.³³ Most attacks used passwords stolen or guessed in bulk, and anything beyond a password stopped them.

Something you are

The third classic factor is the body. Fingerprints had identified criminals since the late nineteenth century, but fingerprint readers on consumer devices were unreliable until Apple introduced Touch ID on the iPhone 5s in September 2013. The design decision that mattered was where the fingerprint went. Apple stored a mathematical representation of the print, not an image, inside a separate secure processor on the phone’s chip, the Secure Enclave, and never sent it to its servers or backups.³⁴ The fingerprint did not prove identity to Apple or to anyone else. It unlocked a key held on the phone, which then did the proving. In 2017 Apple added Face ID, which it said had a far lower chance of a stranger unlocking the phone than fingerprints.

The alternative design, a central database of bodies, showed its danger two years later. In 2015 the US Office of Personnel Management disclosed that attackers had taken background investigation records on 21.5 million current, former and prospective federal employees and contractors, and in September it raised its estimate of stolen fingerprint records from 1.1 million to 5.6 million.³⁵ A password can be changed after a breach. A fingerprint cannot.

A number for a billion people

The largest experiment in digital identity began in India. In 2009 the government created the Unique Identification Authority of India, chaired by Nandan Nilekani, a co-founder of the software company Infosys, to give every resident a twelve-digit number, Aadhaar, linked to their fingerprints, iris scans, photograph and basic details. On 29 September 2010 the first numbers were handed to residents of Tembhli, a tribal village in Nandurbar district, Maharashtra.³⁶ The problems it addressed were real: many Indians lacked any document accepted by banks and government offices, and welfare schemes lost money to fictitious and duplicate beneficiaries. UIDAI’s dashboard reported more than 144 crore, or 1.44 billion, Aadhaar numbers generated, and in November 2025 the system recorded about 231 crore authentications in a single month.³⁷ It became the base of India’s digital public infrastructure, including the e-KYC checks that let a person open a bank account in minutes and the identity layer beneath the payments system described in Paying a Stranger.

Aadhaar also became the subject of the most important court cases on digital identity anywhere. Challenges to the scheme led India’s Supreme Court to ask a nine-judge bench whether the Constitution protected privacy at all. On 24 August 2017, in Justice K. S. Puttaswamy (Retd.) v. Union of India, the bench held unanimously that privacy is a fundamental right.³⁸ In September 2018 a five-judge bench upheld the Aadhaar Act by four to one, but struck down the provision that let private companies require the number, and limited its mandatory use; Justice D. Y. Chandrachud, dissenting, would have struck down the Act.³⁹

The hardest evidence concerned the people the system failed to recognise. Fingerprints wear down with manual labour and age, and authentication needs working machines and network connections. Karthik Muralidharan, Paul Niehaus and Sandip Sukhtankar ran a large randomised evaluation in Jharkhand, covering 15 million beneficiaries, of the requirement that people authenticate with a fingerprint to collect subsidised rations. In a 2020 working paper they reported that the requirement did not reduce leakage, slightly raised costs for the average beneficiary and reduced benefits for some genuine recipients who were excluded.⁴⁰ Other economists, including Jean Drèze and Reetika Khera, argued that the costs were larger still. The debate concerns how to weigh the gains against the exclusion. That exclusion occurred is not in dispute.

The human layer

As technical defences improved, attackers aimed at the person. In 2006 Rachna Dhamija, J. D. Tygar and Marti Hearst asked 22 people to judge whether websites were genuine. The best fake site fooled 90 percent of them, and 23 percent did not look at the address bar, the padlock or any other security indicator at all.⁴¹ Phishing worked because people judge a website the way they judge a shop front, by how it looks.

Organisations had their own human layer: the help desk, whose job is to let people back in when they are locked out. In September 2023 attackers found an MGM Resorts employee on LinkedIn, called the company’s IT help desk pretending to be that person, and obtained access that led to a ransomware attack which disrupted hotels and casinos for about ten days. The group known as Scattered Spider claimed responsibility, and MGM told investors the attack would cost it about $100 million.⁴² The details of the call come from the attackers and the press, not from MGM. The account recovery process, designed to be helpful, was the weakest door.

New tools made impersonation cheaper. In January 2024 a finance employee at the Hong Kong office of the engineering firm Arup joined a video call with people who looked and sounded like the company’s chief financial officer and colleagues. They were generated by software from public video and audio. The employee made 15 transfers totalling HK$200 million, about $25 million.⁴³ And in 2024 attackers used passwords stolen by malware from personal computers to log in to the cloud data accounts of about 165 customers of Snowflake, including AT&T and Ticketmaster, where multi-factor authentication had not been required, and took vast amounts of customer data. Snowflake afterwards moved to require it by default.⁴⁴

Password managers, programs that generate and store a different strong password for every site, were the security profession’s answer to reuse, and they work. But they concentrate risk. In 2022 attackers stole encrypted backups of customer password vaults from LastPass, one of the most popular. The vaults were protected by each customer’s master password; where that password was weak, attackers could crack it offline at leisure. Investigators and researchers have since linked thefts of cryptocurrency running into hundreds of millions of dollars to vaults stolen in that breach, continuing as late as 2025.⁴⁵

Keys that cannot be phished

The way out had existed since 1976: let each person hold a private key that never leaves their device and prove their identity by signing a challenge from the website. A phishing site cannot reuse the signature, because it is bound to the real site’s address, and a stolen server database contains only public keys, which are useless to a thief. In 2012 a group of companies including PayPal, Lenovo and the start-up Nok Nok Labs formed the FIDO Alliance, publicly launched in February 2013, to standardise such logins.⁴⁶ Small hardware security keys built to the standard followed. In 2018 Google told the journalist Brian Krebs that since requiring security keys for all of its more than 85,000 employees in early 2017, it had had no reported or confirmed account takeovers of their work accounts.⁴⁷ In March 2019 the World Wide Web Consortium made Web Authentication, or WebAuthn, an official standard, so any website could accept such keys and the authenticators built into phones and laptops.⁴⁸

Hardware keys stopped phishing, but few consumers bought them, and a key tied to one device was lost with it. On 5 May 2022, Apple, Google and Microsoft announced that they would support passkeys: FIDO credentials that sync across a person’s devices through their Apple, Google or Microsoft account, and that are unlocked with the phone’s fingerprint, face or PIN.⁴⁹ Apple shipped them in iOS 16 that September. In October 2023 Google made passkeys the default sign-in option for personal Google accounts,⁵⁰ and in May 2025 Microsoft announced that new consumer accounts would be passwordless by default.⁵¹

By the FIDO Alliance’s estimates, adoption was rapid. Its Passkey Index, published in October 2026 from data supplied by 15 consumer services, put the number of passkeys in use at about 7 billion and found that 36 percent of successful sign-ins at those services used one, up from 26 percent a year earlier. Sign-ins with passkeys succeeded 93 percent of the time, against 78 percent for passwords combined with other methods.⁴ The figures come from an industry body promoting the technology, and it has not published how it arrived at the total.

The attacks moved to the edges. In August 2026 researchers at Abnormal AI analysed a phishing kit sold on a criminal forum for $10,000 that targeted Google accounts whose owners had passkeys but could also sign in with older methods. The kit phished the older method, then used the attacker’s session to register a new passkey on the account, which survived a password reset.⁵² The passkey had not been broken. The account still had a side door. Recovery remains the open problem: a person who loses all their devices must prove who they are some other way, and every other way is weaker. Moving passkeys between Apple’s, Google’s and Microsoft’s ecosystems also remained awkward, which tied a person’s logins more closely to the platform they started with.

Wallets, agents and the next proof

Governments are now building identity into phones as well. The European Union’s revised regulation on electronic identification, adopted in 2024, requires each member state to offer its citizens at least one free European Digital Identity Wallet by 24 December 2026, an app that holds verified credentials such as a national ID or a driving licence and lets people prove specific facts, such as being over 18, without revealing everything else.⁵³ Reports in the autumn of 2026 suggested that most member states would miss the deadline. The wallet puts Kim Cameron’s principles of 2005, minimal disclosure and user control, into law, while leaving open how many people will use it and what happens to those who do not.

Software agents raise a newer question. When an AI system books travel or pays bills for a person, the service on the other end needs to know both who the person is and what the agent has been allowed to do. The current approach keeps the person’s own sign-in with a passkey and gives the agent a limited, revocable permission through OAuth, the delegation standard of 2012.⁵⁴ The more difficult problem lies in the other direction. Generated voices and faces have made it harder to know whether a person on a call is who they seem, and no passkey can vouch for a video.

What passwords and digital identity are today

Today a person proves who they are to machines through a stack of methods of very different ages. Passwords remain the most common and the most attacked, now usually stored in a password manager or a browser and backed by a code from a phone. Passkeys, unlocked by a fingerprint or face, are the default for new sign-ins at the largest platforms and spreading through banks, shops and governments. Behind them stand a few identity providers: Apple, Google and Microsoft for consumers, Microsoft, Okta and a few others for most large employers, and in India and Europe, states that issue digital identities. Recovery, when everything else is lost, still often comes down to a phone number, an email address or a person at a help desk. And the weakest point is usually not the strongest method a service offers but the oldest one it still accepts.

How passwords and digital identity changed who we are to machines

From a shared machine to a thousand doors

The password began as a way to tell apart a few hundred colleagues on one computer. It became the entrance to dozens of separate services for every person, each keeping its own copy of the secret, and the burden of managing those doors fell on individual memory.

From what you remember to what you carry

Identity moved from a secret in the head to a key in a device. Passkeys and security keys prove identity by possession of something that cannot be told to a stranger over the phone, which removes the commonest attack and makes the device, and the account behind it, the thing that must not be lost.

From the body as evidence to the body as a key

Fingerprints were once collected by states to identify suspects. On a phone they unlock a local key in private. In national systems such as Aadhaar they are matched against central records to grant entitlements. The same body part plays opposite roles depending on where the data lives.

From each site checking to a few vouching for everyone

The web began with every site checking passwords itself. Now a few platforms and states vouch for people, through sign-in buttons, passkey syncing and digital wallets, which makes logins easier and safer and gives those vouching parties a view of where people go and the power to lock them out.

From proving a secret to proving a person

The question a login asks has changed. It used to be whether someone knew the secret. Now services increasingly need to know whether a real, particular person is present, whether an agent is acting with permission, and whether a face on a screen is real.

What the history suggests

The history repeats patterns seen across this site. Permissive defaults were borrowed time, as companies stored passwords carelessly for decades after the means to do it well were published, and paid for it when their files leaked. A measure became a target, as complexity rules optimised for varied characters rather than unguessable passwords. Making something cheap moved the cost elsewhere: the password was cheap for those who deployed it because its cost fell on users’ memory, on help desks and on the victims of reuse. Distribution beat design, as strong cryptographic logins waited decades for adoption until the companies that made phones built them in. And open standards outreached a closed scheme, as Microsoft’s single login gave way to OpenID, OAuth and FIDO, which any company could implement, though the companies that implemented them most widely ended up holding much of the power Passport had sought.

The password’s history also shows something more particular. Almost every major failure came from treating identity as a fact about a person when it is a relationship between a person and someone who has to decide whether to believe them. A password, a fingerprint and a passkey each answer the question “is this the same person as before?” in a different way, and each moves the burden of answering it onto someone: the user’s memory, the user’s body, the device maker, the state. Who carries that burden, and who is left out when it fails, is where the philosophy begins.

Understanding the philosophy

The rest of this essay examines eight ideas beneath passwords and digital identity, one at a time. Each is explained in plain terms, placed in the tradition of thought that has examined it, traced in the history above, tested against its strongest objection and related to how people and organisations decide today. Two of them are psychological. The connections to philosophers, psychologists, economists, sociologists and legal scholars are interpretations offered to make the ideas clearer. The engineers and officials who built these systems were solving practical problems, and did not, as a rule, set out to answer these thinkers.

1. You are the one who remembers

The idea in plain terms

When a computer asks for a password, it is not checking who you are. It is checking whether whoever is typing knows what the account’s owner knew last time. The password system quietly adopts a theory of identity: the person now is the same as the person then if they share a memory. That theory has a long history in philosophy, and its weaknesses are the password’s weaknesses.

The tradition

In 1694, in the second edition of An Essay Concerning Human Understanding, John Locke added a chapter titled “Of Identity and Diversity.” He asked what makes a person at one time the same person at another. Not the same body, he argued, since bodies change their matter constantly, and not the same soul, since we have no access to souls. A person is a thinking being that can consider itself as itself in different times and places, and personal identity reaches as far back as consciousness can extend to past thoughts and actions. Remembering being the one who did something makes you that person. Locke drew a legal consequence: punishment is just only for acts a person can be conscious of having done.

Critics found the problems quickly. Thomas Reid, the Scottish philosopher, offered the case of a brave officer who as a boy was flogged for stealing apples, and as a general remembers taking a standard in battle but no longer remembers the flogging. If the general remembers the officer and the officer remembers the boy, but the general does not remember the boy, Locke’s theory makes the general both the same person as the boy and not the same, which is absurd. Memories also mislead: someone can sincerely seem to remember what never happened, or what happened to someone else.

In Reasons and Persons (1984), Derek Parfit pushed the memory view further. He imagined cases of duplication and gradual replacement and concluded that identity is not what matters. What matters is psychological continuity and connectedness, which can hold in degrees and can, in principle, branch. The question “is this really the same person?” may sometimes have no answer beyond the facts about memory and character.

Where it shows up

The password is Locke’s theory made literal. The account belongs to whoever can produce the remembered secret, which is why Scherr could become the laboratory’s director by printing a file, and why an attacker holding a leaked list becomes, as far as the machine is concerned, millions of other people. The security questions banks once asked, about a mother’s maiden name or a first school, were memory tests of the purest kind, and failed for Reid’s reasons: anyone who knew the facts could pass, and the owner who had forgotten could not. Recovery processes are Locke’s problem in practice. When a person forgets the secret, the system has no other account of who they are and must fall back on another witness: an email address, a phone, a clerk.

The strongest objection

Then again, this confuses authentication with identity. No engineer thought a password defined a person; it was evidence, as a key is evidence that someone may enter a house. The philosophical theory of personal identity concerns what makes someone the same over time, while a login only asks for a sign that the right person is present, and any sign will do if it is hard to fake. That is fair, and passkeys are the proof that the sign can change without changing anything about the person. But in practice systems treat the sign as the person. Whoever holds it gets the money, the messages and the reputation, and the real owner who cannot produce it is a stranger.

What it means today

The memory theory explains why moving from passwords to passkeys is more than a technical upgrade. A passkey replaces a memory with a possession, so the question of continuity becomes a question about devices and the accounts behind them. Product teams should decide deliberately what their system will treat as continuity of a person, and what happens when that continuity breaks. The recovery path is where a service’s real theory of identity shows, and it deserves as much design as the login.

2. The limits of memory, and the rational user

The idea in plain terms

Password rules assume a mind that can store many random strings, keep them apart and recall each one on demand. Human memory does not work that way. When rules demand more than memory can give, people find ways around them, and those ways are predictable. The usual verdict is that users are careless. The research suggests they are reasonable.

The tradition

In 1956 the psychologist George Miller published “The Magical Number Seven, Plus or Minus Two” in the Psychological Review. He observed that people can hold only a small number of items in immediate memory, and that they extend the limit by grouping information into meaningful chunks: a string of letters that spells a word counts as one chunk, not many. In 2001 Nelson Cowan reviewed later evidence and argued that the true capacity, once rehearsal and chunking are controlled for, is closer to four items. Long-term memory is vast but works by meaning and association, and similar items interfere with each other: learning a new password for a site makes the old ones harder to retrieve, and several passwords learned in similar circumstances blur together.

Psychologists have also studied how people use the world as memory. In 2011 Betsy Sparrow, Jenny Liu and Daniel Wegner reported that people who expected information to be saved on a computer remembered it less well and remembered where it was kept better. The study was influential, but a large replication project in 2018 failed to reproduce one of its key experiments, so the strength of the effect is uncertain. The broader idea, that minds rely on tools and other people to store what they cannot hold, is discussed on this site as The Mind Beyond the Head.

Security researchers came to the same conclusion from another direction. Adams and Sasse found that people broke password rules because the rules conflicted with work and memory. Herley argued that rejecting costly advice was often rational. Herbert Simon’s idea of bounded rationality, discussed on this site as Bounded Rationality and Satisficing, frames the point: people with limited time and attention look for a solution that is good enough, and in a world of 25 accounts, a few reused passwords is good enough until the day it is not.

Where it shows up

Morris and Thompson found in 1979 that users unconstrained by rules chose short, memorable strings. Florêncio and Herley found the same habit at web scale: lower-case passwords, shared across four sites each. Complexity rules produced capital letters at the start and digits and exclamation marks at the end, exactly where memory finds them easiest to add, and periodic changes produced passwords that differed by a single character. Corbató, the inventor, kept a crib sheet. Password managers work because they take memory out of the problem: the person remembers one strong secret and the software remembers the rest, which is extended memory in its plainest form.

The strongest objection

Some argue that this excuses carelessness. People memorise phone numbers, PINs and the plots of long novels when they care to; they reuse passwords because they underrate the risk, and education and enforcement can change behaviour, as seatbelt laws did. There is something to this, and some users do respond to clear advice. But the scale of the demand is the problem. Dozens of unrelated random strings, each changed on a schedule, is a burden no one can meet without help, and a design that works only if people behave against the grain of their minds is a design that fails at scale. Seatbelts were made easy to wear before they were made compulsory.

What it means today

The lesson is to design within the limits of memory, not against them. Ask for fewer secrets. Allow long passphrases, which are easy to remember and hard to guess, and screen out common ones. Support password managers rather than blocking them from pasting. Better still, remove the need to remember at all where the alternative is stronger, as passkeys do. When users keep breaking a rule, treat it as evidence about the rule.

3. The truth default

The idea in plain terms

Most attacks on identity today do not break cryptography. They persuade a person: a user to type a password into a fake page, a help-desk worker to reset an account, a finance clerk to send money on a video call. These attacks work because people are built to believe one another most of the time. That tendency is not a defect. It is what makes social life possible, and it is exactly what an impostor exploits.

The tradition

Research on lie detection has a sobering central finding. In 2006 Charles Bond and Bella DePaulo combined results from hundreds of experiments and found that people judged whether statements were truthful or false correctly about 54 percent of the time, only a little better than chance. In 2014 the communication scholar Timothy Levine proposed truth-default theory to explain why. People presume that others are honest unless something specific triggers suspicion, because in ordinary life most communication is honest and the presumption is usually right. Suspicion is the exception, and it needs a trigger.

Robert Cialdini’s Influence (1984) catalogued the cues that make people comply: authority, urgency and scarcity, social proof, liking and reciprocity. Daniel Kahneman’s account of two modes of thinking, summarised in Thinking, Fast and Slow (2011), explains why these cues work. Fast, automatic judgement handles most decisions, and it responds to surface features: a familiar logo, a confident voice, a manager’s name. Slow, deliberate checking is effortful and is used sparingly. Some of the social-priming results Kahneman reported have not replicated, but the broader picture of fast and slow judgement, and the reliance on cues, is well supported.

Where it shows up

Dhamija’s participants judged websites by their look, and the best fake fooled nine in ten. The MGM attackers relied on a help desk whose job was to believe callers and get them working again. The Arup fraud supplied every cue of authority at once: the chief financial officer’s face and voice, colleagues on the call, an urgent confidential matter. Even the security warnings meant to trigger suspicion lose their force. In 2018 Anthony Vance and colleagues, using brain imaging and eye tracking, showed that people’s responses to repeated security warnings declined sharply over a week, and that warnings that changed their appearance held attention better.

The strongest objection

There is a reply: people can be trained. Organisations run phishing simulations and teach staff to check addresses and call back on a known number, and some studies report fewer clicks after training. Suspicion can be cultivated where it is needed, as it is among bank tellers and border officials. This is partly true, but the effects of training tend to fade, and an organisation full of suspicious people pays a price in friction and lost trust. Levine’s point is that the truth default exists because it serves people well almost all the time. Asking employees to abandon it in every email and call asks them to work against the condition that makes cooperation cheap.

What it means today

The practical lesson is to remove decisions that depend on someone spotting a lie. Passkeys help because they will not sign in to a fake site whatever the user believes. Payment and reset processes should require a second channel that an impostor cannot control, such as a call back to a number already on file, so that a convincing voice is not enough. Help desks should be designed on the assumption that the most persuasive caller may be the attacker. Training has a place, but a system that relies on people being suspicious all the time will eventually find the moment they are not.

4. Who pays for security

The idea in plain terms

Security is often treated as a technical problem, solved by better algorithms. Much of the history of passwords is better explained by economics: who bears the cost of a failure, who pays for prevention, and who can tell good security from bad. When the party that chooses the protection is not the party that suffers the loss, protection will be too weak.

The tradition

In 2001 Ross Anderson, a security engineer at Cambridge, presented a paper titled “Why Information Security is Hard: An Economic Perspective.” He pointed to cash machines. In the United States, banks bore the burden of proof when a customer disputed a withdrawal. In Britain, banks could often claim their systems were secure and leave customers to bear the loss. Britain’s banks, under less pressure, ended up with more fraud, because staff knew complaints would not be taken seriously. Anderson argued that security failures came as often from misaligned incentives as from bad technology, and the paper helped found the field of security economics.

Two older economic ideas sharpen the point. An externality is a cost one party imposes on others without paying for it, as a factory polluting a river does. A company that stores passwords carelessly imposes an externality on every other site where its users reused them. And in 1970 George Akerlof described the “market for lemons”: when buyers cannot judge quality, sellers of good products cannot charge for it, and quality falls. Users cannot see how a site stores their password, so a site that stores it well gains nothing for the expense. This site discusses the idea as When Buyers Cannot Judge Quality.

Where it shows up

RockYou and LinkedIn stored passwords badly because the cost of doing so fell mostly on others, users and the other sites their passwords opened. Herley’s paper inverted the usual blame: users rejected advice because they bore its full cost and only a fraction of its benefit, much of which went to banks and providers. Complexity rules shifted the cost of weak storage and weak design onto user memory and help desks. Microsoft’s 2020 figures show the opposite case. When a provider could see the losses across millions of accounts, it pushed multi-factor authentication hard, because the benefit was visible to it. Snowflake required stronger logins only after its customers’ losses became its own.

The strongest objection

A sceptic would say that markets do reward security over time. Companies that leak data suffer fines, lawsuits and lost customers; LastPass paid settlements and lost users, and security has become a selling point for phones and browsers. Regulation, from breach notification laws to data protection rules, has made carelessness expensive. All of that is true, and it shows that the incentive problem can be partly fixed. But the costs arrive late, are uncertain and are often small next to the losses of everyone affected. Most companies that leaked passwords in the 2000s survived. The market corrected slowly, and users paid in the meantime.

What it means today

Leaders should ask, of every security decision, who pays if it fails and who decides. Where those are different people, expect underinvestment and correct for it: count the harm to users alongside the harm to the company, and treat reuse by users as a fact of life that makes your security everyone’s concern. Regulators should keep placing liability on the party best able to prevent the loss, which is usually the provider, not the customer.

5. Trusting the one who vouches

The idea in plain terms

As logins moved to sign-in buttons, synced passkeys and digital wallets, people stopped proving themselves to each service directly. A few platforms and states now vouch for them. This makes life easier and logins stronger, and it means that much of a person’s access to the world depends on staying in good standing with a few organisations whose systems they cannot inspect.

The tradition

The German sociologist Niklas Luhmann argued in Trust (1968) that trust is a way of reducing complexity. No one can check everything, so people extend confidence to others and to systems, which lets them act without endless verification. In The Consequences of Modernity (1990), the British sociologist Anthony Giddens described modern life as dependent on “expert systems,” such as banking, medicine and engineering, that people trust without understanding. Ordinary people meet these systems at “access points,” encounters with counter staff or interfaces, where their trust is won or lost. In 1995 Francis Fukuyama argued in Trust that societies with high levels of trust among strangers have lower transaction costs and can build larger organisations. In her 2002 Reith Lectures, the philosopher Onora O’Neill warned that demands for transparency and audit do not create trust, and that what matters is whether trust is placed in those who are trustworthy, which requires being able to judge them.

The legal scholar Lawrence Lessig added a warning in Code and Other Laws of Cyberspace (1999): in digital spaces, the design of software regulates behaviour as law does. Whoever writes the code that decides who can enter decides a great deal about what people can do, often with less accountability than a legislature.

Where it shows up

Kerberos made a central server the voucher for a campus. Passport tried to do the same for the web and failed because the sites it needed did not trust a rival, which is O’Neill’s point that trust has to be placed where it is warranted. Sign-in buttons succeeded on a different footing: users already trusted Google and Facebook with their mail and friends, and sites wanted the convenience. Shoshana Zuboff’s The Age of Surveillance Capitalism (2019) describes the side effect: the voucher sees where people go. Passkeys made Apple, Google and Microsoft the custodians of people’s keys and the judges of recovery. The login screen is Giddens’s access point, and the help desk that MGM’s attackers called is another.

The strongest objection

Defenders reply that concentration is the price of security, and worth paying. Large platforms defend accounts better than small sites can, through security teams, fraud detection and hardware. The record is clear: accounts protected by the large providers’ passkeys and multi-factor systems are far harder to take over than accounts protected by a small site’s password database. Users choose these services freely, and open standards such as FIDO and OAuth mean no single company controls the protocol. The argument is strong. Its limit is what happens at the edges: when an account is suspended in error, or a person loses their devices, the voucher’s judgement is final in practice, and there is often no one to appeal to.

What it means today

Product leaders who rely on platform sign-in should keep their own path back to a user, so that their customers are not lost if the platform withdraws its vouching. Platforms that hold keys should treat recovery and appeal as part of their responsibility, with human review for people locked out. And anyone designing an identity system should ask Lessig’s question: what rules is this code making, and who would a person complain to if they were wrong?

6. Making people legible

The idea in plain terms

A state or company that wants to serve, tax or protect people at scale needs to tell them apart. Names, addresses and faces are messy and local; numbers and biometrics are uniform and searchable. Digital identity makes people readable by institutions. That brings real benefits, and it changes the relationship between the people and those who read them.

The tradition

In Seeing Like a State (1998), the political scientist James C. Scott described how modern states made their territories and populations “legible”: surveyed land into uniform plots, imposed permanent surnames, standardised measures, and built registers and maps. With Tehranian and Mathias, he traced how permanent family names were imposed by governments that needed to tax and conscript. Legibility let states do things they could not do before, but Scott’s examples also show the costs when the simplified picture replaced local knowledge, which he called mētis, and when officials trusted the register over the person in front of them. This site discusses the idea as Legibility and Mētis. John Torpey’s history of the passport shows the same process applied to movement across borders.

Where it shows up

Aadhaar is the clearest modern case. It made more than a billion people legible to the Indian state through a single number and their bodies, and the gains were large: people without documents gained an accepted identity, and services could check identity instantly and cheaply. Scott’s warning appears in the Jharkhand study. When the fingerprint scanner failed, the record overruled the person, and a ration-shop owner who knew a family for years could not hand over grain without the machine’s approval. India’s Supreme Court, in upholding the system while limiting its use, was weighing exactly this trade between what legibility allows and what it overrides. Corporate identity systems make people legible too, to advertisers and fraud models, in ways the people rarely see.

The strongest objection

Against this, illegibility hurts the poor most of all. People without documents cannot open bank accounts, claim benefits or prove ownership, and they are the easiest to exploit. Ghost and duplicate beneficiaries divert money from real ones. A universal identity is a precondition for many rights, and the United Nations’ development goals include legal identity for all. Scott himself acknowledged that legibility underpins public health and welfare. This is a powerful argument, and Aadhaar’s record of inclusion supports it. The question is not whether to make people legible but how to keep the record from overruling them when it is wrong.

What it means today

Designers of identity systems should judge them by their failure cases: who is not recognised, how often, and what happens next. Every automated check needs a human override with clear authority, close to the person, and fallback methods that do not depend on the same technology. Organisations should collect only the identity data a service needs, because what makes people legible to the service also makes them legible to anyone who later gets the data.

7. Many selves, many audiences

The idea in plain terms

People are not one identity presented the same way to everyone. They are a colleague at work, a parent at home, a pseudonymous voice in a forum and a customer at a shop, and they keep these roles apart for good reasons. A digital identity system that links every role to one verified name changes something about how people can live.

The tradition

In The Presentation of Self in Everyday Life (1956, published in the United States in 1959), the sociologist Erving Goffman described social life as a series of performances for different audiences. People manage the impression they give, keep a “front stage” and a “back stage,” and rely on audience segregation, keeping different audiences apart so that each sees a consistent self. This is not deception. It is how people manage relationships with different expectations. When audiences collide, the performances become impossible, and people experience it as embarrassment or exposure.

Philosophers of privacy built on this. James Rachels argued in 1975 that privacy matters because it lets people maintain different kinds of relationships, which require sharing different things with different people. Pseudonymity has a long and respectable history: authors publishing under pen names, the authors of the Federalist Papers writing as “Publius,” whistleblowers and dissidents writing under assumed names.

Where it shows up

Steiner’s dog captured the early web’s promise that a person could present a self free of their offline identity. Single sign-on and the “Sign in with” buttons pulled in the other direction, joining a person’s accounts under one provider who could see them all. Apple’s per-site email addresses were an engineered form of audience segregation, letting a user be one person to Apple and a different, unlinkable one to each site. Cameron’s laws of identity asked for the same thing in principle: different identifiers for different contexts. The European wallet’s promise to prove one fact, such as age, without revealing a name is a design for Goffman’s world, in which each audience sees only what it needs.

The strongest objection

Critics counter that anonymity and pseudonymity shelter abuse. Fraudsters, harassers and propagandists rely on identities that cannot be traced, and many people want platforms and services to know who they are dealing with. Verified identity raises the cost of abuse, and in banking it is required by law to fight money laundering. This is a real tension, and the answer differs by context: a bank must know its customer, a forum need not. The danger lies in systems built for one context spreading into all of them, so that the identity a person must present to a bank becomes the identity they must present everywhere.

What it means today

Product teams should ask what a service actually needs to know about a person and design for the minimum, using pseudonymous identifiers where they suffice and verified identity only where the law or the stakes demand it. Selective disclosure, proving an attribute without revealing the person, should become the default for age checks and eligibility. People should be able to keep their audiences apart, because that is part of what it means to have a self.

8. The body as a key

The idea in plain terms

A fingerprint or face is a convenient key: always present, impossible to forget, hard to share. It is also unlike any other key, because it cannot be changed, it can be read without consent, and it identifies a person in every context at once. Whether the body is a good key depends almost entirely on where the data lives and who can compare it.

The tradition

Philosophers of identity have long debated whether we are our minds or our bodies. Locke located the person in consciousness. Philosophers known as animalists, such as Eric Olson in The Human Animal (1997), argue that each of us simply is a human organism, and that personal identity follows the body. Biometric systems take the animalist side in practice: the person is whoever has this finger and this face, whatever they remember.

Critics of biometrics have focused on what this does to the relationship between people and the state. In a 1999 article, the philosopher Irma van der Ploeg argued that turning bodies into machine-readable data changes what a body is in law and politics, making it a document that institutions can read without the person’s participation. In January 2004 the Italian philosopher Giorgio Agamben cancelled a course in the United States rather than submit to fingerprinting at the border, writing that treating every citizen as a potential suspect in this way had become a normal practice of governments. Many find Agamben’s comparison of fingerprinting to tattooing overstated, but the concern beneath it, that biometric capture changes the terms on which people meet the state, is widely shared.

Where it shows up

Apple’s design for Touch ID took the safest path: the body unlocks a key on the person’s own device, and no central record exists to steal or search. The OPM breach showed the opposite path, a central store of fingerprints that, once stolen, are stolen for life. Aadhaar matches bodies against a central database to grant entitlements, which is why worn fingerprints can mean missed rations. Passkeys inherit Apple’s approach, using the body only as a local check. The same finger, in other words, can be a private convenience or a public credential, and the difference lies wholly in the architecture. This site discusses why hard-to-reverse choices deserve special care as Irreversibility and the Value of Waiting.

The strongest objection

One answer is that biometrics are simply better than the alternatives for most people. They cannot be phished or forgotten, they work for people who struggle with literacy or numbers, and the fears of central databases apply equally to records of names and numbers. Aadhaar enrolled people no document system had reached. The danger of a stolen fingerprint is also smaller than it sounds when systems check that a live finger is present. These points are fair, and for unlocking a phone the case for biometrics is overwhelming. The objection is weakest where it matters most: in central systems that compare bodies at scale and gate essential services, where a failure cannot be fixed by choosing a new key.

What it means today

Use biometrics locally, to unlock keys held by the person, and avoid central stores of biometric data wherever an alternative exists. Where a central system is necessary, as in national identity, provide non-biometric fallbacks and human review, and never make a biometric match the only way to obtain something a person needs to live. Treat the decision to collect a body’s data as irreversible, because for the person it is.

Bringing the threads together

The password made Locke’s theory of identity into an engineering rule: you are whoever remembers the secret. Human memory could not carry that rule across dozens of accounts, so people did what bounded minds do, and the rules written to correct them made things worse. Attackers found that it was easier to persuade a trusting person than to break a cipher, and companies left the cost of their careless storage on users who could not see it. The answer moved identity into devices and bodies, vouched for by a few platforms and states. That shift made logins much harder to steal, made people more legible to the organisations that vouch for them, and made it harder to keep separate selves for separate audiences. It also placed the body in a role that cannot be undone. The thread running through it is the question the password first answered badly: who carries the burden of proving that a person is themselves, and what happens to those who cannot.

Something only you know

When Scherr printed the password file in 1962, the people at MIT were sharing a machine and a community. The password was a light fence among colleagues, and its failure cost an hour of computer time. The fence was carried into a world of strangers and became the main barrier between billions of people and the people who would rob, impersonate or spy on them. It held as long as it did because it asked for nothing but memory, and it failed because it asked for too much of it. The engineers who salted the Unix file, the bank that chose four digits, the researchers who told security departments that users were not the enemy and the companies that finally built keys into phones each made the burden more bearable for ordinary people. Others, by storing secrets carelessly or writing rules without evidence, made it heavier.

The history suggests some working principles. Design identity around what people can actually do, and treat their workarounds as evidence about the design. Store secrets on the assumption that the store will leak. Close the side doors before celebrating a stronger lock, because attackers go to the oldest method a system still accepts. Do not ask people to detect lies all day; build processes that do not depend on it. Keep bodies’ data on the device that belongs to the person. And whenever a system decides who someone is, design with equal care for the person it fails to recognise, because that person has no other way in. The password promised that a person could be known by something only they knew. Its successors know people by what they carry and what they are, and the people who build them now hold much of what used to be kept in memory.

Selected bibliography

• Polybius. The Histories, Book 6. Written c. 150 BC; English translation by W. R. Paton, Loeb Classical Library, Harvard University Press, 1923.
• Locke, John. An Essay Concerning Human Understanding, 2nd edition, Book II, chapter 27, “Of Identity and Diversity.” London, 1694.
• Miller, George A. “The Magical Number Seven, Plus or Minus Two: Some Limits on Our Capacity for Processing Information.” Psychological Review 63, no. 2 (1956): 81–97.
• Goffman, Erving. The Presentation of Self in Everyday Life. University of Edinburgh, 1956; Doubleday Anchor, 1959.
• Luhmann, Niklas. Vertrauen. Enke, 1968; English translation in Trust and Power, Wiley, 1979.
• Akerlof, George A. “The Market for ‘Lemons’: Quality Uncertainty and the Market Mechanism.” Quarterly Journal of Economics 84, no. 3 (1970): 488–500.
• Rachels, James. “Why Privacy Is Important.” Philosophy & Public Affairs 4, no. 4 (1975): 323–333.
• Diffie, Whitfield, and Martin E. Hellman. “New Directions in Cryptography.” IEEE Transactions on Information Theory 22, no. 6 (1976): 644–654.
• Morris, Robert, and Ken Thompson. “Password Security: A Case History.” Communications of the ACM 22, no. 11 (1979): 594–597.
• Cialdini, Robert B. Influence: The Psychology of Persuasion. William Morrow, 1984.
• Levy, Steven. Hackers: Heroes of the Computer Revolution. Anchor Press/Doubleday, 1984.
• Parfit, Derek. Reasons and Persons. Oxford University Press, 1984.
• Steiner, Jennifer G., Clifford Neuman and Jeffrey I. Schiller. “Kerberos: An Authentication Service for Open Network Systems.” Proceedings of the Winter 1988 USENIX Conference, 1988.
• Giddens, Anthony. The Consequences of Modernity. Stanford University Press, 1990.
• Fukuyama, Francis. Trust: The Social Virtues and the Creation of Prosperity. Free Press, 1995.
• Olson, Eric T. The Human Animal: Personal Identity without Psychology. Oxford University Press, 1997.
• Scott, James C. Seeing Like a State. Yale University Press, 1998.
• Adams, Anne, and Martina Angela Sasse. “Users Are Not the Enemy.” Communications of the ACM 42, no. 12 (1999): 40–46.
• Lessig, Lawrence. Code and Other Laws of Cyberspace. Basic Books, 1999.
• van der Ploeg, Irma. “The Illegal Body: ‘Eurodac’ and the Politics of Biometric Identification.” Ethics and Information Technology 1, no. 4 (1999): 295–302.
• Torpey, John. The Invention of the Passport: Surveillance, Citizenship and the State. Cambridge University Press, 2000.
• Anderson, Ross. “Why Information Security is Hard: An Economic Perspective.” Proceedings of the 17th Annual Computer Security Applications Conference, 2001.
• Cowan, Nelson. “The Magical Number 4 in Short-Term Memory: A Reconsideration of Mental Storage Capacity.” Behavioral and Brain Sciences 24, no. 1 (2001): 87–114.
• O’Neill, Onora. A Question of Trust: The BBC Reith Lectures 2002. Cambridge University Press, 2002.
• Scott, James C., John Tehranian and Jeremy Mathias. “The Production of Legal Identities Proper to States: The Case of the Permanent Family Surname.” Comparative Studies in Society and History 44, no. 1 (2002): 4–44.
• Cameron, Kim. “The Laws of Identity.” Microsoft, May 2005.
• Bond, Charles F., Jr., and Bella M. DePaulo. “Accuracy of Deception Judgments.” Personality and Social Psychology Review 10, no. 3 (2006): 214–234.
• Dhamija, Rachna, J. D. Tygar and Marti Hearst. “Why Phishing Works.” Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (2006): 581–590.
• Florêncio, Dinei, and Cormac Herley. “A Large-Scale Study of Web Password Habits.” Proceedings of the 16th International World Wide Web Conference (2007): 657–666.
• Herley, Cormac. “So Long, and No Thanks for the Externalities: The Rational Rejection of Security Advice by Users.” Proceedings of the New Security Paradigms Workshop (2009): 133–144.
• Kahneman, Daniel. Thinking, Fast and Slow. Farrar, Straus and Giroux, 2011.
• Sparrow, Betsy, Jenny Liu and Daniel M. Wegner. “Google Effects on Memory: Cognitive Consequences of Having Information at Our Fingertips.” Science 333, no. 6043 (2011): 776–778.
• Bonneau, Joseph, Cormac Herley, Paul C. van Oorschot and Frank Stajano. “The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes.” IEEE Symposium on Security and Privacy, 2012.
• Hardt, Dick, ed. “The OAuth 2.0 Authorization Framework.” RFC 6749, Internet Engineering Task Force, October 2012.
• Levine, Timothy R. “Truth-Default Theory (TDT): A Theory of Human Deception and Deception Detection.” Journal of Language and Social Psychology 33, no. 4 (2014): 378–392.
• Justice K. S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1 (privacy).
• Vance, Anthony, Jeffrey L. Jenkins, Bonnie Brinton Anderson, Daniel K. Bjornn and C. Brock Kirwan. “Tuning Out Security Warnings: A Longitudinal Examination of Habituation through fMRI, Eye Tracking, and Field Experiments.” MIS Quarterly 42, no. 2 (2018): 355–380.
• Justice K. S. Puttaswamy (Retd.) v. Union of India (Aadhaar), judgment of 26 September 2018.
• Zuboff, Shoshana. The Age of Surveillance Capitalism. PublicAffairs, 2019.
• Muralidharan, Karthik, Paul Niehaus and Sandip Sukhtankar. “Identity Verification Standards in Welfare Programs: Experimental Evidence from India.” NBER Working Paper 26744, 2020.
• National Institute of Standards and Technology. Digital Identity Guidelines: Authentication and Authenticator Management, SP 800-63B-4, 2025.
• FIDO Alliance. Passkey Index 2026. October 2026.

Research limitations

The earliest history of computer passwords rests largely on participants’ recollections given decades later, notably Allan Scherr’s account to Wired and Fernando Corbató’s interviews; the date of the first CTSS passwords is not firmly established, and the date of Scherr’s printing is reported as 1962 by Wired and differently elsewhere. The episode of the password file shown at login is taken from Robert Morris’s own account in the 1979 paper, which places it in the early 1960s. Accounts of Richard Stallman’s campaign against passwords differ on its date and methods. The account of Roman watchwords follows a translation of Polybius’s sixth book and secondary descriptions. John Shepherd-Barron’s explanation of the four-digit PIN is his own recollection, and credit for the first cash machine and the PIN is disputed between him and James Goodfellow. The 2003 NIST appendix’s origins are described from press reports of Bill Burr’s 2017 interview, since the original Wall Street Journal article was not consulted directly. Figures for breaches come from company disclosures and press reports and were often revised upward over time. The account of the MGM help-desk call rests on the attackers’ claims and press reporting, not on a company disclosure. Passkey adoption figures come from the FIDO Alliance, an industry body that promotes passkeys and has not published how its total was calculated. Aadhaar enrolment figures come from UIDAI’s dashboard, and the size of the costs found in the Jharkhand study remains disputed among economists. The status of national digital identity wallets in the EU was changing at the time of writing and is described from secondary reports. Some psychological findings cited here have mixed replication records, particularly the 2011 study of memory and search engines. The philosophical connections to Locke, Reid, Parfit, Olson, Miller, Cowan, Sparrow and her colleagues, Simon, Levine, Bond and DePaulo, Cialdini, Kahneman, Vance and his colleagues, Anderson, Akerlof, Herley, Luhmann, Giddens, Fukuyama, O’Neill, Lessig, Zuboff, Scott, Torpey, Goffman, Rachels, van der Ploeg and Agamben are the author’s interpretation; their works are paraphrased apart from short, attributed phrases. The decisions in the decisions box are judged by the author, separating what could be known at the time (process) from what happened (call).

Footnotes

1. “The World’s First Computer Password? It Was Useless Too,” Gizmodo, January 2012, summarising Robert McMillan’s report for Wired; on Scherr’s later confession, Slashdot. ↩ ↩²

2. Dinei Florêncio and Cormac Herley, “A Large-Scale Study of Web Password Habits,” WWW 2007, pp. 657–666. ↩ ↩²

3. Verizon, “2025 Data Breach Investigations Report,” April 2025; on the 22 percent figure, Infosecurity Magazine. ↩

4. “FIDO Alliance counts 7 billion passkeys as adoption gains momentum,” Biometric Update, October 2026; “FIDO Passkey Index 2026: passkeys now carry 36% of sign-ins,” Start With Identity, 15 October 2026. ↩ ↩²

5. Polybius, Histories, Book 6, in the translation at Roman Britain; Wikipedia, “Tesserarius”. ↩

6. John Torpey, The Invention of the Passport: Surveillance, Citizenship and the State (Cambridge University Press, 2000). ↩

7. “Password inventor says creation now a nightmare,” WeLiveSecurity, 23 May 2014, reporting the Wall Street Journal interview; “The Man Who Invented The Computer Password Admits That It’s Become A Nightmare,” Business Insider, May 2014. ↩

8. Robert Morris and Ken Thompson, “Password Security: A Case History,” Communications of the ACM 22, no. 11 (November 1979): 594–597. ↩ ↩²

9. Wikipedia, “Richard Stallman”; “Richard Stallman: Last of the True Hackers?,” MONDO 2000, 1989 interview. ↩

10. IEEE Computer Society, “Roger M. Needham”; Karen Spärck Jones, “Roger Needham: an informal memoir”, University of Cambridge Computer Laboratory. ↩

11. “How did a Cornell graduate student’s program infect roughly 6,000 machines,” Make Tech Easier; Chalmers University of Technology, lecture on malicious code, 2015. ↩

12. “James Goodfellow: The Scot Who Invented the PIN and ATM,” History Hit; “Glasgow 850: pioneers of the ATM,” Marks & Clerk. ↩

13. Wikipedia, “John Shepherd-Barron”, quoting his interview with the BBC; Bruce Schneier, “Why an ATM PIN Has Four Digits”. ↩

14. Whitfield Diffie and Martin E. Hellman, “New Directions in Cryptography,” IEEE Transactions on Information Theory 22, no. 6 (1976): 644–654. ↩

15. Jennifer G. Steiner, Clifford Neuman and Jeffrey I. Schiller, “Kerberos: An Authentication Service for Open Network Systems,” 1988; on Windows 2000, USENIX, 2000. ↩

16. Wikipedia, “On the Internet, nobody knows you’re a dog”. ↩

17. Anne Adams and Martina Angela Sasse, “Users Are Not the Enemy,” Communications of the ACM 42, no. 12 (1999): 40–46. ↩

18. US Federal Trade Commission, “Microsoft Settles FTC Charges Alleging False Security and Privacy Promises,” August 2002; FTC, Analysis of Proposed Consent Order. ↩

19. Wikipedia, “Windows CardSpace”; “Kim Cameron”, Start With Identity. ↩

20. Nat Sakimura, “History of OpenID (1),” March 2012; Wikipedia, “Brad Fitzpatrick”. ↩

21. “OAuth 2.0 standard editor quits, takes name off spec,” The Register, 28 July 2012; Wikipedia, “OAuth”. ↩

22. Wikipedia, “Sign in with Apple”; “Sign In with Apple launched at WWDC 2019,” ITPro. ↩

23. “The man behind those annoying password rules now says he was wrong,” CTV News, August 2017; Gizmodo, August 2017. ↩

24. National Institute of Standards and Technology, SP 800-63B-4, 2025; on the changes, Enzoic. ↩

25. “RockYou hack reveals most common password: ‘123456’,” SC Media, January 2010; “Imperva releases detailed analysis of 32 million breached consumer passwords,” Global Security Mag. ↩

26. “Scrub 6.5 million, it was 117 million passwords stolen from LinkedIn in 2012,” SecurityWeek, May 2016; “Millions of LinkedIn passwords stolen in 2012 surface online,” Engadget, 19 May 2016. ↩

27. “Yahoo now thinks all 3B accounts were impacted by 2013 breach,” TechCrunch, 3 October 2017. ↩

28. Cormac Herley, “So Long, and No Thanks for the Externalities: The Rational Rejection of Security Advice by Users,” NSPW 2009, pp. 133–144. ↩

29. “RSA will replace SecurID tokens in response to Lockheed Martin attack,” eWeek, June 2011; “RSA executive reveals more SecurID breach details,” eWeek. ↩

30. Google, “Advanced sign-in security for your Google account,” Google Security Blog, 10 February 2011. ↩

31. “Hacker takes over Jack Dorsey’s Twitter account using SMS,” The Hacker News, September 2019; “@jack Got Hacked,” Dark Reading, August 2019. ↩

32. “NIST and SMS restricted,” Podfeet; “NIST SP 800-63B Rev 4: SMS OTP is now a restricted authenticator,” TypingDNA. ↩

33. “99% of compromised Microsoft enterprise accounts lack MFA,” Sophos, March 2020; WeLiveSecurity, 9 March 2020. ↩

34. “Apple reveals inner workings of iPhone 5s Touch ID scanner,” ITPro; AppleInsider, “Touch ID”; “2019 security guide reviews Apple biometrics,” Biometric Update. ↩

35. US Office of Personnel Management, “Statement on the cybersecurity incidents,” 23 September 2015. ↩

36. UIDAI, “National launch of the Aadhaar project”, press note, September 2010; “Ten tribals become first Indian nationals to get UID numbers,” India TV News. ↩

37. UIDAI, Aadhaar enrolment dashboard; “UIDAI logs 231 crore Aadhaar authentications in November,” Zee Business, December 2025. ↩

38. “Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1,” The Legal Quorum; SFLC.in, privacy judgments. ↩

39. “Supreme Court refuses to strike down Aadhaar, but says private bodies can’t insist on it,” ThePrint, 26 September 2018; “Supreme Court upholds Aadhaar but strikes down required use by private sector,” Biometric Update, September 2018. ↩

40. Karthik Muralidharan, Paul Niehaus and Sandip Sukhtankar, NBER Working Paper 26744 (2020), as discussed in “Balancing corruption and exclusion: a rejoinder,” Ideas for India; Jean Drèze, Reetika Khera and Anmol Somanchi, “Balancing corruption and exclusion: comment on the response,” Ideas for India. ↩

41. Rachna Dhamija, J. D. Tygar and Marti Hearst, “Why Phishing Works,” CHI 2006, pp. 581–590. ↩

42. “MGM cyberattack outage: Scattered Spider,” TechCrunch, 14 September 2023; “MGM ransomware attack: the $100 million help desk phone call,” Adaptive Security; CISA and FBI advisory AA23-320A, November 2023. ↩

43. “Arup revealed as $25 million deepfake scam victim,” CNN, 16 May 2024. ↩

44. “More than 160 Snowflake customers hit in targeted data theft spree,” Computer Weekly, June 2024; “Snowflake recap,” LastPass blog. ↩

45. Brian Krebs, articles on the LastPass breach, Krebs on Security, 2023–2025; “LastPass breach linked to theft of $4.4 million in crypto,” BleepingComputer. ↩

46. “W3C and FIDO Alliance finalize web standard for secure, passwordless logins,” GlobeNewswire, 4 March 2019; “8 years of FIDO,” cidaas. ↩

47. Brian Krebs, “Google: security keys neutralized employee phishing,” syndicated at Security Boulevard, 23 July 2018. ↩

48. W3C, “W3C and FIDO Alliance Finalize Web Standard for Secure, Passwordless Logins,” 4 March 2019. ↩

49. “Microsoft, Google and Apple commit to a passwordless future,” Redmond Magazine, 5 May 2022. ↩

50. “Google passkeys now default login option for Google accounts,” CNBC, 10 October 2023. ↩

51. “Microsoft makes passkeys default for new accounts,” The Hacker News, May 2025. ↩

52. Abnormal AI, “iAuthFlow v2: phishing Google passkeys,” 20 August 2026; “Google passkey attack exposes credential enrollment weak spot,” Biometric Update, August 2026. ↩

53. European Commission, “European Digital Identity (EUDI) Regulation”; “EU digital identity wallet stalls in 24 member states,” Brussels Signal, September 2026. ↩

54. “AI agents authentication: passkeys for agentic logins,” Corbado, August 2026; “AI authentication: verifying people, agents, and content,” Security Boulevard, August 2026. ↩