The End of Passwords Has Finally Arrived

Why passwords have become the problem

Most attacks do not start with sophisticated hacking. They start with a stolen username and password.

The Australian Cyber Security Centre (ACSC) notes that compromised credentials remain one of the most common ways attackers get into business systems — through phishing, fake login pages, malware or data breaches.

The real weakness is human behaviour. Employees often:

• reuse the same password across many services

• choose passwords that are easy to remember

• save them in browsers or spreadsheets

• type them into convincing fake sites

Even multi-factor authentication (MFA) can fail when attackers trick users into approving prompts or steal one-time codes. Something fundamentally different was needed.

Enter passkeys

A passkey replaces the password with cryptography that is already built into modern devices.

Users unlock their phone or computer with face recognition, a fingerprint or a PIN. The device then performs a secure cryptographic exchange that proves identity — without ever sending a reusable secret over the internet.

There is nothing for an attacker to steal. A convincing fake Microsoft 365 page has no password to capture, and the authentication simply fails.

In plain English

A password is like a house key that can be copied. Photograph it once and an attacker can let themselves in whenever they like.

A passkey is more like a secure electronic garage remote. It proves it is genuine every time, yet never reveals its internal secret — and watching someone use it still does not let you make a working copy.

That is why passkeys are described as phishing-resistant.

Why Microsoft, Google and Apple are all backing passkeys

The major platforms have agreed on a common standard: FIDO2, developed by the FIDO Alliance.

Passkeys already work across:

• Microsoft 365

• Google Workspace

• Apple iCloud

• Windows 11, macOS, iOS and Android

• most modern web browsers

Staff can move between devices without learning new methods, and for businesses the rollout is far simpler than expected.

Why this matters for Australian businesses

For many small and medium businesses, identity is the new perimeter. Staff work from home, use cloud services on mobile devices and collaborate across Teams, SharePoint and other SaaS apps. The traditional network boundary has effectively vanished.

Compromise one Microsoft 365 account and an attacker can reach email, OneDrive, Teams chats, SharePoint files, financial data and customer records.

Phishing-resistant authentication sharply reduces that risk because there is no password to steal. Microsoft’s Secure Future Initiative prioritises stronger identity protection, and cyber security agencies increasingly recommend phishing-resistant methods wherever practical.

What about multi-factor authentication?

MFA remains essential — enable it everywhere if you have not already.

But not all MFA is equal. SMS codes can be intercepted, and authenticator approvals can be worn down by “MFA fatigue” attacks.

Passkeys remove these routes. In many cases they combine the password and the second factor into a single phishing-resistant step.

Is this the end of passwords?

Not overnight. Older applications and legacy systems will still need usernames and passwords for years, so most organisations will run a hybrid model while vendors modernise.

The direction, though, is clear. Microsoft is making many new consumer accounts passwordless by default, while Google and Apple keep expanding support. Passwords are becoming the exception, not the rule.

A practical example

An employee receives an email claiming their Microsoft 365 account has expired. The link leads to a perfect-looking login page.

With a password, they type it in and hand their credentials straight to the attacker. With a passkey there is nothing to type — the fake site cannot use the cryptographic credentials that only work with the real Microsoft service, and the attack fails.

One of today’s most successful attack techniques is neutralised.

What you should do next

You do not need to replace every system at once — but it is worth starting to plan now. A practical roadmap looks like this:

• Enable MFA everywhere it is available.

• Check whether Microsoft 365 or Google Workspace supports passkeys for your plan.

• Pilot passkeys with IT or a small group of users.

• Educate staff on phishing-resistant authentication.

• Treat identity security as part of your broader cyber strategy, not a standalone password problem.

For many SMEs, adopting passkeys will be one of the simplest high-impact security upgrades of the next few years.

Final thoughts

The passwordless shift has been talked about for years. It is now genuinely happening. As Microsoft, Google and Apple converge on passkeys, businesses gain a rare chance to improve both security and the everyday experience of signing in.

For Australian organisations the question is no longer whether passwordless authentication is coming — it is how quickly they can adopt it. Those who start now will be better protected against phishing, free of password-management headaches, and ready as identity security continues to evolve.

Hardrock Cyber encourages treating passkeys as part of a wider identity and cyber-resilience strategy. The goal is not simply to replace passwords — it is to make unauthorised access far harder while keeping everyday work simple for staff.