Password authentication uses a secret sequence of characters to authenticate a person or account. Passwords remain familiar, but password-only access provides poor security and usability: credential stuffing threatens security, while registration, memorization, and recovery burden users. section 3.7.2
Compare password authentication with stronger or complementary methods:
- Passwords alone are vulnerable to credential stuffing. section 3.7.2
- SMS or email one-time passwords improve security but remain vulnerable to phishing and SIM swapping. section 3.7.2
- Authentication-app codes and push notifications improve resistance or usability, yet phishing and MFA fatigue remain concerns. section 3.7.2
- Passkeys provide phishing resistance and avoid MFA fatigue, while lost devices and malware remain risks. section 3.7.2
Figure 3.9 The strength and usability pyramid for authentication methods. As you ascend the pyramid, authentication mechanisms become more resistant to phishing, replay attacks, and credential theft, though some may require a more technical setup or infrastructure. Passwords, located at the base, offer poor security and usability, while challenge–response methods such as passkeys and PKI provide high assurance with an improved user experience. Multifactor approaches (MFA) are positioned across the middle tiers, balancing security and usability by combining various types of factors.
Use the strength-and-usability pyramid to compare passwords, multifactor methods, passkeys, and PKI by phishing resistance, credential-theft exposure, usability, and infrastructure demands. section 3.7.2
