Microsoft readies passwordless logins

Microsoft is making good on its long-held promise of eliminating passwords for user accounts, since the company believes logging on in that fashion is inconvenient and insecure.

Starting today, users can remove password authentication from their personal Microsoft accounts.

Instead, users can get login codes from the Microsoft Authenticator time-based one-time password (TOTP) app, which must be linked to their personal accounts.

Once Authenticator is linked to the personal Microsoft account, users can opt to set their logins to become passwordless.

Over the next few weeks, Microsoft will also let users login with Windows Hello facial recognition, verification codes sent to their phones and email accounts, and hardware keys.

Passwordless sign-in will be available for Microsoft Outlook, OneDrive, Family Safety and other services.

For enterprise users, Microsoft said it will start developing passwordless logins for Azure Active Directory accounts as well.

Managing passwords has become increasingly difficult for users, who have to remember several different ones across multiple sites and services.

The company said this has led to insecure user behaviour such as using and reusing easily guessable passwords, and even stopping using a service rather than dealing with a forgotten passphrase.

Attackers, meanwhile, have built up a large store of captured passphrases and built powerful tools that can crack, or guess, more common passwords.