The End of Passwords

Summary

The Wirecutter Show: "The End of Passwords"

Date: August 4, 2026
Hosts: Rosie Guerin (Host/Producer), Max Eddy (Guest/Staff Writer)

---

Overview

This episode of The Wirecutter Show dives into the ever-evolving world of online security with a focus on passwords: the risks of bad password habits, the practical steps to better protect yourself, and the emerging technologies that might finally let us ditch passwords altogether. Staff writer Max Eddy, who covers privacy and security for Wirecutter, joins host Rosie Guerin to discuss everything from password managers and two-factor authentication to passkeys. The conversation aims to demystify security best practices and encourage listeners to take manageable steps toward safer online habits.

---

Key Discussion Points & Insights

Why Passwords Matter—And Why We Struggle

• The biggest risk without good password hygiene: Account takeovers
  • “The biggest risk...is that your accounts could be taken over by somebody else. That's what it comes down to. The main thing between you and your accounts online is passwords and other technologies around that.” —Max Eddy [04:32]
• Password fatigue is real; advice has constantly changed over 20 years
  • Passwords are hard for humans to create and remember, while computers are good at guessing them
  • “Passwords are a fundamental problem because we're bad at making them. And computers are great at guessing them.” —Max Eddy [06:42]
  • Password reuse makes you vulnerable: one breached site can expose all linked accounts

The Real World Consequences of Weak Passwords

• Using the same password everywhere is a huge risk
  • Example: Max used the same password on a news site and Facebook; a breach led to his Facebook account being hijacked [07:26]
  • Even non-famous users can endanger friends and family if accounts are hacked
  • Emphasis: security isn’t just personal—it protects your contacts, too

Password Managers: The Best First Step

• What is a password manager?

  • “A password manager is an application that saves, replays, and creates passwords for you. It does everything with passwords that we are bad at.” —Max Eddy [09:06]
  • They generate complex, unique passwords, autofill logins, and reduce cognitive load
  • Some can alert you to phishing if the password isn’t offered on a site
  • Also useful for securely storing other sensitive data (credit cards, travel info, etc.)

• Wirecutter’s Top Picks

  1. 1Password (Best overall): “...very easy to use, almost a pleasure to use... just the simplest, friendliest way to use a password manager.” —Max Eddy [12:53]
  2. Bitwarden (Best free/open-source): Good, less flashy than 1Password, still reliable.
  3. Built-in managers (Apple/Google): Decent, use them if they work for you, but dedicated managers are often more robust.

• Switching managers is easier than you think

  • “Every password manager will let you import and export passwords... you hit export, it spits out a spreadsheet... You drag and drop it on the new one and it does the rest. Delete that file afterward!” —Max Eddy [14:30]

• You don’t need to update all passwords at once

  • Start with your most critical accounts: email, banking, social media
  • Let new logins prompt the password manager to capture and store credentials
  • Use the password manager’s “weak/reused/breached” password tools to prioritize updates

• Flexible use: possible to use multiple managers, but simpler is better for organization

  • Cloud-based managers ensure your passwords are accessible everywhere

Tips for Getting the Most Out of Password Managers

• Make passwords as long and complex as sites allow—your manager handles remembering them

  • “In general, make it as long as you can because you don't have to worry about it.” —Max Eddy [18:48]

• Use manager tools to securely share passwords (with trusted users—look for family plan/inheritance features)

• Protect your master password and manager with two-factor authentication

  • Set frequent re-authentication intervals, use device tracking and loss-prevention tools
  • When traveling or in risky situations, consider logging out or limiting data available in the app

• Regularly review which passwords are weakest or have been exposed in breaches and update them

Two-Factor Authentication (2FA): Your Second Line of Defense

• 2FA requires you to use two of three authentication types:

  • Something you know (password)
  • Something you have (phone, security key)
  • Something you are (biometric)

• Strongly recommended—any 2FA is better than none

  • “If you take nothing from this, please just get a password manager and turn on 2fa.” —Max Eddy [26:49]

• Main drawbacks:

  • Lost access to your 2FA method (e.g., lose your phone) can lock you out
  • SMS-based 2FA can be intercepted; use authenticator apps (Google Authenticator, Authy, Duo, etc.) where possible
  • Some 2FA can still be phished—always check authenticity of sites

• Create and store backup codes safely (in your password manager or printed securely)

Passkeys: The Future Beyond Passwords

• Passkeys use asymmetric encryption for secure, passwordless authentication

  • “A passkey is a lot like a password. It's intangible, lives in your devices and on the cloud. But unlike a password, you don't interact with it at all anymore.” —Max Eddy [29:20]
  • Cannot be phished, reused, or stolen via site breaches (each passkey is unique to its website)
  • Already supported on platforms like Google, Apple, and Microsoft

• User experience:

  • When logging in, your device recognizes the site and logs you in with a prompt (possibly with a PIN or biometric)
  • “It just logs in. You'll have to sometimes enter a pin number, but that's it.” —Max Eddy [31:25]

• Limitations:

  • Not all sites support passkeys (yet)
  • Still usually asked to create a password as backup
  • As adoption widens, will become smoother and more reliable

• Advice:

  • Try creating your first passkey on a Google account to get comfortable
  • Check for passkey support in site account settings or at Fido Alliance’s passkey site list

---

Notable Quotes & Memorable Moments

• On security advice fatigue:
  “Over the last, let's say, 20 years, I think people have been feeling very jerked around by the advice that they're given about how to be safe on the Internet. First it was like, don't tell anyone or write down your passwords. Then it was, use a password manager...then it was, you gotta change your passwords all the time. And now we actually don't think that's a very good practice.” —Max Eddy [05:53]

• On the benefit to others:
  “If your Facebook account gets hacked, it will be used against the people you care the most about.” —Max Eddy [08:40]

• Password manager simplicity:
  “...there's not an offline system that I can imagine...that is easier than a password manager.” —Max Eddy [10:10]

• On extreme password habits:
  “...for that How to Disappear story I discovered I have, like, 360 passwords.” —Max Eddy [05:15]

• Max’s secret (joke) master password:
  “Cool guy59” —[37:33]

---

Timestamps for Important Segments

• 04:08 — Three main ways to improve safety: password managers, 2FA, passkeys
• 05:34 — Security fatigue and how advice has changed over time
• 06:42 — Why passwords are fundamentally flawed
• 07:26 — Personal story: password reuse leads to account breach
• 09:06 — What is a password manager? (and why use one)
• 12:53 — Wirecutter’s recommended password managers: 1Password, Bitwarden
• 14:30 — How to migrate between password managers
• 16:32 — You don't need to change all your passwords at once—prioritize
• 18:48 — Tips for getting more from your password manager
• 25:33 — Two-factor authentication explained
• 29:13 — Passkeys: what they are and why they’re better
• 31:25 — What using a passkey feels like for end users
• 34:19 — Limitations and future of passkeys
• 35:55 — Max’s take: “If you encounter a passkey, try it out.”
• 37:33 — (Joke) Max’s master password: “Cool guy59”

---

Actionable Advice & Takeaways

• Use a dedicated password manager (1Password or Bitwarden recommended)
• Start with your most valuable accounts; don’t overwhelm yourself doing everything at once
• Make passwords long, unique, and complex—let the manager handle the work
• Turn on two-factor authentication for all important accounts
• Experiment with passkeys as they become available—this is the direction the web is going
• Think of security not just as a personal defense but as a way to protect family and friends
• Don’t panic if you face setbacks or fatigue; small, consistent steps make a big difference

---

Resources

• [Wirecutter guide to password managers]
• [Wirecutter guide to passkeys and how to use them]
• [FIDO Alliance site list for passkeys]

(References available via Wirecutter and in episode show notes.)

---

Summary created by The Wirecutter Show’s expert team, based on episode transcript. For more, subscribe or visit the Wirecutter website.

Transcript

[Apple Card Announcer]

This message is brought to you by AppleCard. Shave Ice by the beach, a trip to the state fair, and a throwback flick at the local drive in. They're more than just items to check off the summer bucket list. They're also opportunities to earn 2% daily cash back when you use your Apple Card with Apple Pay. Apply for Apple Card now and use in minutes with Apple Pay. Subject to credit approval. Apple Card is issued by Goldman Sachs Bank USA, Salt Lake City branch terms and [e-mail].

[Max Eddy]

First it was like, don't tell anyone or write down your passwords. They all need to live in your mind. And then it was use a password manager. You know, if you're trying to keep them in your mind, you're doing it wrong. And then it was like, you gotta change your passwords all the time. And now we actually don't think that's a very good practice.

[Rosie Guerin]

I'm Rosie Guerin and you're listening to the Wirecutter Show. Hey, it's Rosie. Today we're talking about passwords. Wait, wait, wait, wait, wait, wait. Before you skip this episode, because how could a conversation about passwords possibly be interesting, I will say number one, my guest Max Eddy is. He's a staff writer here at Wirecutter and he writes about Daniel data privacy, security and how to stay safe online. And number two, yes, this is one of those things that you can tell yourself it's okay to ignore. But our lives are online. We bank online, we date online, we shop online, we share our credit card information, Social Security numbers. You get the picture. So if you're going out of your way to retain your privacy, getting started with a password manager is a good start. More about those and a primer on pass keys with Max Addy after the break.

[Apple Card Announcer]

This message is brought to you by Apple Card. Shave ice by the beach, a trip to the state fair and a throwback flick at the local drive in. They're more than just items to check off the summer bucket list. There are also opportunities to earn 2% daily cash back when you use your Apple Card with Apple Payments. Apply for Apple Card now and use in minutes with Apple Pay. Subject to credit approval. Apple Card is issued by Goldman Sachs Bank USA Salt Lake City Branch terms and more at applecard.com if you're a

[Advertisement Narrator]

parent of a teen or have teens in your life, it can be hard to figure out the right way to approach social media and technology. Ultimately, if you feel like your teens are ready, there are tools to help Instagram teen accounts have automatic protections for what your teens see and who can contact them. Plus time management tools like daily time limits and sleep mode and and Instagram will continue adding built in safety features to help create age appropriate experiences. Learn more about teen accounts and Instagram's ongoing work to protect teens [e-mail] teenaccounts that's instagram.com teenaccounts a better help Ad after my session and talking to my therapist and really feeling seen and heard for the first time, I just felt like a weight just was lifted off of my shoulders and I felt like it was a good match. From the first time we talked, I could tell people from lived experience that they should try therapy. I could really be myself again and I have this continued support with better

[Rosie Guerin]

help wherever you are. That's where BetterHelp begins. Visit betterhelp.com New York Times to get started. Pay testimonials Results may vary. Welcome back. My guest today is Max Eddy. Max is a staff writer here at Wirecutter who covers privacy and security. Max has been on the show twice now talking about the importance of traveling with a vpn. Check that episode out if you haven't. And another time to talk through an article published last year that I really loved called I Tried and Failed to Disappear on the Internet. That was a banger. Welcome.

[Max Eddy]

Thank you. Always happy to be here.

[Rosie Guerin]

Good to see you. Today we're going to talk about three main ways to increase your online safety. So password managers, two factor authentication and pass keys. I think people maybe generally know why passwords are important, but can you just top line, what is the biggest risk you face if you don't have good password hygiene?

[Max Eddy]

I really like the way you put that because like hygiene is a habit. It's something that you do all the time.

[Rosie Guerin]

Yeah.

[Max Eddy]

And I think that that's kind of what you need to think about with security. Like you're changing habits, you're changing the way you live your life. And that sounds huge and complicated. But the nice thing about passwords, password managers and passkeys, like what we're talking about here, like this stuff actually makes your life eas. So the biggest risk that you face if you don't have good password hygiene is that your accounts could be taken over by somebody else. That's what it comes down to. The main thing between you and your accounts online is passwords and other technologies around that.

[Rosie Guerin]

And that could be anything from your bank to your whatever. I mean, anything.

[Max Eddy]

I admit my job makes my password usage a little insane for that. How to disappear Story I discovered I have, like, 360 passwords.

[Rosie Guerin]

That's a lot of passwords.

[Max Eddy]

Most people aren't like that. But most people probably have, like, dozens of passwords that you use for everything from banking to online shopping to your job.

[Rosie Guerin]

So we talk about hygiene habit forming. We also probably should talk about fatigue. I mean, there's this thing you talk about security fatigue. And I think it's real and it's risky, but it's also very relatable. Can you talk a little bit about it?

[Max Eddy]

Over the last, let's say, 20 years, I think people have been feeling very jerked around by the advice that they're given about how to be safe on the Internet. First it was like, don't tell anyone or write down your passwords. They all need to live in your mind. And then it was, use a password manager. You know, if you're trying to keep them in your mind, you're doing it wrong. And then it was like, you gotta change your passwords all the time. And now we actually don't think that's a very good practice. And then it was, you have to add two factor authentication to everything. And then people are like, what's 2fa? What are all these other systems you're now asking me to learn? And now we've got passkeys and even newer technology. I really empathize with people who are burnt out on this. From my perspective as someone who covers this, like, it's exciting because we're fixing a fundamental problem about technology. Like, passwords are a fundamental problem.

[Rosie Guerin]

And talk about why they're a fundamental problem.

[Max Eddy]

Well, passwords are a fundamental problem because we're bad at making them. And computers are great at guessing them. And if they are exposed, they cause all sorts of problems. And because we're really bad at making them, we've come up with all sorts of shortcuts around that. So, like, a lot of people have told me, it's like, oh, I don't have a problem with passwords. I have one good password that I use everywhere. And I was like this. Like, I. I remember when I was college, like, I'm so smart. I've got, like, a crappy password that I use for crappy sites and a good password I use for good sites. And if you plug either of those now into, like, the. There are calculators that'll tell you how long it takes for that password to be guessed. It's like seconds and minutes. Like, it's.

[Rosie Guerin]

It's bad.

[Max Eddy]

That is the problem.

[Rosie Guerin]

What is it about reusing passwords, that's not good.

[Max Eddy]

If you are reusing your password, if that password is exposed or stolen in any way, all of those sites are now vulnerable. Because the first thing that a savvy attacker is going to do when they get their hands on credentials is to try them on multiple sites. And if it's a more targeted attack where they might have some kind of information about the sites where you might have accounts, and there's a number of different ways to get that information, then they have something to work off of. So, you know, if. Great example. Again, I'll. I'll just air my dirty laundry here. So there was this big data breach at a news site and comment section. And that password was the same one I was using on Facebook. And when that happened, when that story broke, within like a couple hours, someone was like, making posts as me on Facebook. And that's annoying. Like, people like, oh, what's the worst that could happen when someone impersonates me to my family and gets money from them? You don't need to be anyone special for that to happen too. And that's really frightening that that does a lot of damage. Not just like your personal reputation, but like, everyone you care about. And this is another, like, deep idea around security. Like, we talk about it a lot in terms of protecting yourself. And if that doesn't motivate you because of security fatigue or whatever, think about the people you love and the people you care about, because anything that affects you is going to affect them. Because if your email gets attacked, if your Facebook account gets hacked, it will be used against the people you care the most about.

[Rosie Guerin]

Okay, so to that end, we come to password managers. What is a password manager and why is it useful?

[Max Eddy]

So a password manager is an application that saves, replays, and creates passwords for you. It does everything with passwords that we are bad at. So you can use it to create really, really, really long passwords. You can create unique passwords for every site and service you have, and then you don't need to remember them when you go to those sites because the password manager pulls it up and fills it in for you. That fixes so much of the problem with passwords. It doesn't fix everything. And there's a lot of other problems that remain, but it is a very straightforward thing that people can do that will make you safer online. It's like password managers, two factor authentication. Those are the things that every security expert has been telling me my entire career. Like, if people do these things, they will be objectively safer Online.

[Rosie Guerin]

I think it changed my mom's life when I helped her get set up with a password manager because prior to that she had like an index card fraying at the edges and you couldn't read them because the ink had bled. And it was just like, there has to be a better way.

[Max Eddy]

Yeah, there's nothing wrong with having your own system, but there's not a offline system that I can imagine. Like, that that is easier than a password manager. Like, it has its advantages, right? Like, no one's going to get that card. That card is the safest thing on the planet. But a password manager is more flexible. When you go to change your password for whatever reason, the password manager should capture that information and update itself. And there's other little things that when you start using a password manager, you get the benefit of. Like, the main one, of course, is your security is better. You also don't have like as much cognitive load. Like you don't have to remember your passwords. You just need to remember the password for your password manager. But smaller things like your password manager is configured to show the password for the site that you're on. If you're on a site and you know you have a password for it and your password manager doesn't show up, you might be on a phishing site. It's a little thing like that. Like, that's not even really its intended purpose, but it's another little clue that maybe you should slow down and take a look at what you're doing.

[Rosie Guerin]

I had not thought about that. Are there things you could expect a password manager manager to do beyond just storing your passwords and helping you fill in when you're on a site?

[Max Eddy]

One of the main ones is that it can store and retrieve any sensitive information. So I put my known traveler number, the thing you're supposed to use for like pre check when you go through airport security. I keep that in my password manager because I do need to pull that out periodically and I will never remember where it is. So it just, it's in my password manager. You know, credit cards are in there too. You know, there's a lot of other ways to do this kind of autofill stuff, but a password manager is very flexible and it's always with me. So that's one thing that I use it for. One of the main things that password managers do is that they create complex, long, unique passwords. So you don't have to do any of that and you don't have to remember any of that. And you can Change the rules for how that's generated to whatever meets your needs at the time.

[Rosie Guerin]

They're very, very flexible, like letters, numbers, special characters. Extra special characters.

[Max Eddy]

Yeah, exactly. And one of the features I love is like some password managers will actually removes similar characters. So is that a lowercase l or a vertical line gets rid of that so you don't have to worry about that. Or it will create passphrases that use like whole words or there are lots of different ways that you can adjust it to your situation. Whatever makes sense. One thing I do recommend that people do is, you know, just go ahead and make it as long as the website will accept like I use 30 character passwords because why not? I'm not remembering any of this. That's the password manager. I'm paying it to do that.

[Rosie Guerin]

Yeah. Okay. So paying that is a, I think a good segue into what your picks are. What does Wirecutter recommend in terms of password managers?

[Max Eddy]

So One password is the best password manager we've tested and has been so for quite a while. 1Password is just very easy to use, almost a pleasure to use in many ways that it just blows the competition out of the water in that respect. It is just the simplest, friendliest way to use a password manager. It'll walk you through the whole process of it. It also does some very unique things with how it manage your password to access it. It's a little bit different than others, but it's still pretty intuitive and it's more secure. And by and large it seems that people are able to figure it out and work with it, which is great. We also recommend Bitwarden as a free password option. It also has a paid subscription and that's just another really good password manager. It's open source and it's not as flashy and slick as one Password, but it is very good at what it does. That's the one I use. A big truth in security in general is like even not good password manager is better than no password manager at all. And most password managers are good. So you know, if you've already been using the built in password manager in Google or in your iPhone or what have you, that's great. Stick with it if you want to stick with it. But the password manager that we recommend have more features, they're easier to use and they can just do things that those default password managers can't.

[Rosie Guerin]

I've been using Dashlane for a while. It's fine. I mean, it's a password manager and it works. Yeah, I have thought about using something else. But I've been intimidated by the idea of migrating from one password manager to another is the best I can hope for. There kind of starting over?

[Max Eddy]

No. To move between password managers is very straightforward. Every password manager will let you import and export passwords from another password manager. This was actually one of the things I tested in my most recent round of testing was how easy was that process? What was hard about it for these products? Most of the time how this works is you hit export, it spits out a spreadsheet of all your passwords and login information, and then you go to your new password manager, you drag and drop it on there, and it does the rest. I will take this opportunity to just remind people something, Delete that file afterward, because that file has all your passwords in it. You really don't want that.

[Rosie Guerin]

Empty the trash.

[Max Eddy]

Yes, absolutely. And then, you know, I always encourage people to take their time with stuff. It often feels like you have to make big changes really fast. If you're migrating from one password manager to another. Try it out for a while, see if it got all the stuff that you need. Do you have any problems? And then after however long you need, then you can start deleting and shutting down your old password manager. There's no reason that you gotta like dump it all and do it all at once.

[Rosie Guerin]

In addition to that, I'm wondering, because I use dashlane, but I also use the password manager that comes on the iPhone. Is there any reason I shouldn't be using more than one?

[Max Eddy]

I think that it's just easier for you to know where your passwords are organizationally. Yeah. And again, like, if it works for you, it works for you. And I'm not going to tell you otherwise. But if you're ever in a situation where you're like, I don't know where that password is, I know I have it, but I don't know where it is. That can create a problem. And all the password managers that we recommend are cloud based. When you have them stored on the cloud securely, they're available on all your devices all the time. So that sort of gets around the problem you're talking about. Right. It's in the password manager and the password manager is on all of your devices.

[Rosie Guerin]

So when we talk about migrating slowly or even just getting started from not using a password manager to using one, do you need to change all of your passwords at once?

[Max Eddy]

No, absolutely not.

[Rosie Guerin]

That's also intimidating.

[Max Eddy]

It's hugely intimidating. I actually think the best way to go about this Is to prioritize the most important things. Banking, social media. One that surprises people, your personal email or whatever email you use the most. You absolutely should be putting the most amount of security on that. The forgot my password function. On any website, if a attacker is able to get a hold of your email and then use that forgot my password tool, they can just start taking over all your accounts and there's very little to stop them. So that's like, number one, get your personal email sorted out and then I think it's fine to, you know, move slowly. Like, as you go to websites, log out, log back in, let the password manager capture it as you go. Most of the password managers that we recommend have very useful tools that can identify weak, reused, and breached passwords. So use those tools. Start with the breached passwords. Those are the ones that you know are out there somewhere. So fix those and then work down your list of stuff and maybe set a day. Like every Thursday, I update five passwords or what have you.

[Rosie Guerin]

Hygiene.

[Max Eddy]

Yeah. You know, if you tried to do it all at once, you're going to burn out. And I think the worst thing that people can do with personal security is just give up. It always feels like we're out of control and these huge forces are pushing against us. But actually, you have a lot of agency in this stuff and it can actually really empower you.

[Rosie Guerin]

Okay, quick recap. Passwords, they're a real pain. And password managers can help. They're integrated in many phones now. And Max has some great recommendations on the Wirecutter website. Online security is always evolving, and it's very, very real to feel fatigued. Baby steps. Using some measures is always better than using nothing. So try out password managers, Try out two factor authentication or two fa, and stay as safe as you can. Now, Max, in your article on password managers, you have four additional tips to help get the most out of your password manager. I want to run through those. The first you mentioned before, which is creating extra long passwords.

[Max Eddy]

Yeah. You know, your password manager's doing the heavy lifting. Why not make it as long and as crazy as you want? The caveat here is that not every website is cool about this. There are, to this day still websites that won't let you do longer than eight characters. And I cannot believe these are still in business. Like, that's insane. But in general, make it as long as you can because you don't have to worry about it. And the longer, the more complex, the better.

[Rosie Guerin]

The second tip here is about securely sharing passwords and other information. Talk about that.

[Advertisement Narrator]

Yeah.

[Max Eddy]

Password managers usually have tools built in to share passwords or any other information that you have stored in the password manager with other people, typically other users of the password manager. So you might have to get your family on a family plan if you want to do this, but not all the time. And it puts some protections around it. Now you always got to keep in mind that anytime something leaves your control, someone can do something bad with it. So like don't share it with people you don't trust. Keep tabs on it. Use the tools that they provide to limit its access. But just be aware that you know, you only want to share it with trustworthy people. An extension of this is that some password managers are set up to actually help family members inherit passwords from people that have passed on. You know, you don't want to get locked out of your parents or grandparents accounts. This is actually a very useful thing to do.

[Rosie Guerin]

You have protecting your passwords from prying eyes. What did you mean by that?

[Max Eddy]

A very understandable concern about password managers is that it's like a single point of failure. Like if someone can get your password manager, they get everything. And that's very understandable. There's a lot of things you can do to keep that from happening. You're going to put 2fa on your password manager so that even if someone gets your password, they're not getting into your password manager. All the password managers that we recommend use end to end encryption so they can't even access your data. Like these are the things that are out there to protect, protect your information. Now what happens when it's on your phone and then your phone is not in your hands anymore? That's a big problem. So if your phone is confiscated or you know it's not properly secured, you want to make sure you're doing something about that. So look at how often your password manager requires you to re authenticate. Set that to something low that works for you. Maybe it's every day, maybe it's every 44 hours. Whatever works for you. So that every now and again you do actually have to put your password into your password manager to prove that you're you. Learn how to use the tools that help you track and secure stolen or lost phones. Both Apple and Google have this for their devices. They're very powerful. They're very useful when you're traveling. Consider logging out of your password manager altogether and logging back in when you get to a safe location. If you lose your phone or your phone is stolen while it's unlocked, that can expose a lot of your information. So just don't even have that on there. 1Password has a similar tool called Travel Mode that lets you limit what passwords are available in what circumstances. We also recommend learning how to temporarily disable biometrics on your phone. So biometrics are really convenient and great. It saves you a lot of time and they're very secure, but it can be done against your will. Like someone could snatch your phone, hold it up to your face and then that could open your phone. Or someone can put your finger on the fingerprint reader. So most phones now do have a way to deactivate biometrics temporarily. Any situation where you think your phone is going to leave your person. So like airport security, you're in like a really long line in a place you don't know, like you're at a concert or something. Why not just take a minute to disable biometrics temporarily and once you put in the passcode, biometrics are back on. Okay, so it's very, very simple. But it's always important to think about what happens to your devices. And this is beyond password managers. So excuse me, but you always want to think about what is happening to your devices when you don't have control of them.

[Rosie Guerin]

The last piece of advice here is enabling two factor authentication, two fa as you have referred to it, and passkeys on your accounts as you go through and upgrade your passwords. I want to pause before you explain those because you wrote another great article on the site called Passkeys are the new passwords. You should start using them now and that goes into detail about what passkeys are and why they're important. So I want to take a quick break and dig deeper into that on the other side. We'll be right back.

[Apple Card Announcer]

This message is brought to you by Apple Card. Shave ice by the beach, a trip to the state fair and a throwback flick at the local drive in. They're more than just items to check off the summer bucket list. They're also opportunities to earn 2% daily cash back when you use your Apple Card with Apple Pay. Apply for Apple Card now and use in minutes with Apple Pay. Subject to credit approval. Apple Card is issued by Goldman Sachs Bank USA Salt Lake City Branch terms and more at applecard.com the Wirecutter show

[Advertisement Narrator]

is supported by Egg Life. Back to school has parents managing a lot more moving pieces and meals quickly become one more problem to solve. Egg Life Egg White wraps make it easy to sneak high quality protein into your favorite meals and snacks. These wraps, made from egg whites, not flour, are a total game changer. They're high in protein and low in carbs. Find Egg Life wraps chilling in the fridge at Aldi, Whole Foods, Kroger, Target, Walmart and more. Visit egglifefoods.com to find a retailer near you. Your new grad is taking their next step. Help them find their footing with the gift of one year of wireless from Visible. The Visible annual plan lets you pay once for a year of wireless. No monthly reminders, no surprise add ons. Visible is powered by the reliable Verizon network, meaning one fewer extensions excuse to avoid calls from home. Get unlimited 5G from Visible starting at $275 for a full year of coverage. Head to visible.com for more info. Terms apply. For network management details, see visible.com.

[Rosie Guerin]

Welcome back. My guest today is Max Eddy, a staff writer here at Wirecutter who covers privacy and security. This episode is about password hygiene and how to keep yourself a bit safer online. So before the break, Max, we discussed the importance of using a password manager and all of the ways it can help you organize your passwords to stay safer online. Now I want to talk about two factor authentication to FA and a new tool I've been seeing and hearing about more and more pass keys. So tell me everything you know about two factor authentication and why it's useful. Or maybe not everything because you know a lot of stuff.

[Max Eddy]

So for most people, 2fa is like another thing that you do after you enter your password. So you'll have to enter a code that's sent to you on your phone or generated by an app or you'll have to do some other thing. So a lot of people look at it as like, oh, two factor. It's your second thing you have to do. And this is where it gets that's philosophical to actually from this sort of theory of authentication where there's three different ways to authenticate yourself to anything else. There's something you know, something you have, and something you are. So something you know is a password. It lives in your brain. You know it. Something you have is like your phone when you are using a 2fa app on your phone like Duo or Google Authenticator or Authy, that is proving that you have your phone. That's the thing you have. And something you are is biometrics, like a fingerprint scanner, face scan. So when we take two of those three and put them together, they're different kinds of authentication. And it's really unlikely that an attacker would be able to get both of them. And that's two factor authentication, two different factors to secure your accounts.

[Rosie Guerin]

Professor eddy so does 2fa have any limitations then to bear in mind? Because it sounds very, very secure.

[Max Eddy]

It is very, very secure. And I really want to emphasize, like I said with password managers, you know, we're going to start talking about the drawbacks of 2fa, which are real and important to understand, but any 2fa is better than no. 2fa in the same way that even a mediocre password manager is better than no password manager. So really want to underline. If you take nothing from this, please just get a password manager and turn on 2fa. I will sleep so much better if just one of you does it. So the big drawback of 2fa is that if you don't have your second factor, if that other thing is not available to you, you're not going to be able to easily log in. So if you are, for example, using an app on your phone to generate two FA codes and you don't have your phone, then you will not very easily be able to log into your account. A lot of caveats to this. One of the easiest ways to prevent this from happening is to create what are called backup codes. These are a list of numbers and letters, typically that are generated on whatever site it is you have an account, and you store them somepl safe, print them off, put them in your password manager someplace very safe, because you can enter these codes in an emergency, prove who you are, and get past a lot of the extra layers of security. Another big concern with 2fa is that some kinds of 2fa can be intercepted. So, for example, if you're getting a code sent to your phone, it is possible that someone could intercept that and then use it before you can use it. So in general, we tell people not to use two FA over sms. That's by text message whenever possible. For better or for worse, it is probably the most common kind of 2fa. And again, bad 2fa is better than no. 2fa at all. Along with a 2fa that can be intercepted, some 2fa can be phished, right? So if I'm generating codes on my phone, if I put that into a phishing site, doesn't matter now, the bad guy has it, they can use it. There's a time limit on these, but these attacks have been very well conceived, they will probably work. So always be very careful about where you're putting in this information. We said this earlier, but sometimes A2FA could be done without your knowledge or consent. Like if it's biometrics, your face could be red or your fingerprint could be red without you necessarily wanting or knowing that that was happening.

[Rosie Guerin]

I've seen that in the movies.

[Max Eddy]

Yeah.

[Rosie Guerin]

Moving over to passkeys, I've been hearing about passkeys. I admittedly have not really waded into this yet. What is a passkey? How are they developed?

[Max Eddy]

On a technical level, a passkey is a digital credential that uses asymmetric key encryption to securely identify you to a website. You don't need to know.

[Rosie Guerin]

Well, that I. But, like, what else is it?

[Max Eddy]

Yeah, yeah. And this is where it gets kind of tricky because much like the matrix, no one can be told what a passkey is. You kind of have to see it for yourself. So go to Google where you probably already have an account, create a passkey, try it out. Go to our story on Wirecutter, take a look at the screenshots. We walk you through the whole process so you can see what it's like. I really think that once people see it and get any kind of familiarity with it, the value becomes immediately obvious. A passkey is a lot like a password. It's intangible lives in your devices and on the cloud. But unlike a password, you don't interact with it at all anymore. So it is a way to authenticate yourself to a website without using a password. It has a lot of benefits. The first and most obvious one is that it is a secure exchange. That passkey can't be forgotten. It's very difficult for that to be breached. If the website gets breached, they're not going to be able to get your passkey. You've got that, that's yours. It requires additional authentication. You put your PIN in, you do a scan or something. So it's more layers security around it. And importantly, each passkey only works with the site where you created it. So it makes it very difficult for that to be phished. It makes it very difficult for that to be cloned in any way.

[Rosie Guerin]

So you are going to theoretically have many, many, many different passkeys. You have the same number of passkeys as you would passwords.

[Max Eddy]

Yeah, like you're going to have as many passkeys as you have websites, at minimum. And it is just this way to have a completely secure exchange. Like the goal here, the thing that I think people need to take from it. Bottom line, passkeys replace passwords. You don't do passwords anymore. We leverage the technology that we have that is very, very good at creating secure exchanges. And we use that Instead of passwords, we cut out all of the gooey stuff in the middle that's been causing us problems for as long as we've had passwords.

[Rosie Guerin]

What is it going to look like when I'm on my phone or online and I encounter a passkey?

[Max Eddy]

So if you have a passkey already on your device, when you start the login process, either when you land on the login site or when you enter just like your username, a little thing pops up and says, hey, you've got a passkey for this. Let's use that instead. Or you might have to click a button and say, I have a passkey, and then it'll use that instead. And then it just logs in. You'll have to sometimes enter a pin number, but that's it. I wish there were more steps because it would feel so much more, like, tangible. But again, it just works. It's kind of great.

[Rosie Guerin]

So how do you get started using them? Because that example, I already have a passkey for whatever website. How do I get my passkey? How do I get started?

[Max Eddy]

Yeah, I think the best way to get started is to sort of try it out and learn how to use it. Google accounts are really good for this. A Google account will let you create as many passkeys as you want for an account. You can play around with it. It's very, very simple and flexible. So you have to log into your Google account, go to your account, setup settings, create a passkey, go through that process, and then try it out, and you'll be able to work through that flow. You know, I. I feel like we're not doing a great job of explaining this, and it is just because it's very, very straightforward and simple once you do it, and we talked about security fatigue earlier, that it's hard to conceptualize this. We're so used to passwords, and this takes that away and can feel like you're losing control. It can feel confusing. It is so different. And that's scary and weird, but once you start doing it, it's like, this is so much, so much easier.

[Rosie Guerin]

Well, I've almost felt that it's too easy because at least, you know, with a password, a complicated password that exists. In my password manager, I know that there are 15, you know, dollar signs and capital letters and lower letters, and it's gonna be complex with a passkey. In my experience so far, it's like, this seems too good to be true.

[Advertisement Narrator]

Yeah.

[Max Eddy]

And it's that intangibility of it. Right. Like, there's nothing there like in your password range, you could look it up and see the big long password and feel assured that it does something. And this is just this weird contradiction with passkeys where, like, if you actually saw any part of it, it wouldn't make any sense at its technical level, but at the person level, it's as seamless as can be. And this is by design. A lot of work has gone into making this fast, seamless, reliable. It's supported by Apple, Microsoft, Google. It's hopefully going to take off and become the new password. And it's continuing to evolve. There's changes happening to it, making it a little bit more flexible, a little bit easier. The way passkeys are designed is that the sites you create passkeys on, they really don't have. They don't have a copy of your passkey. So if there's like a data breach on that site that doesn't affect you, your information is safe. This is part of why passkeys, like, as a concept just are better than passwords. For passwords to work, you know, can be breached on the site where you have them.

[Rosie Guerin]

Are there any limitations or disadvantages to using passkeys?

[Max Eddy]

So right now, the biggest limitation about passkeys is that not all sites support it. And it's a little bit frustrating because it is better for users. It's easier, it's more secure. In many ways, it's better for companies because there's going to be hopefully fewer data breaches and people not being able to log in. Like, it should iron out a lot of those problems, but it's still just not everywhere yet. Right now, I would sort of describe it when I can use a passkey, it's like a pleasant surprise, but it's not everywhere. So you have to keep an eye out. You have to go looking for it.

[Rosie Guerin]

Should we expect that it will continue to grow and become ubiquitous?

[Max Eddy]

So the people behind it certainly think so. You can just look at Apple, Google and Microsoft putting their support behind this into all of their platforms. They certainly think so. The advantages are there. Another limitation of passkeys, though, is that pretty much every site is still going to require that you create a password when you make an account. There now an idealized passkey utopia. You don't even do that. You don't even. You never touch a password anymore. But we're not there yet. This technology is still rolling out. So you're still going to be using your password manager, you're still going to be using 2fa on these accounts because you have to do that as part of the creation process.

[Rosie Guerin]

So ultimately it sounds to me like the advice is password manager. Yes. Get it asap. Use it. Use Two Factor Authentication, two fa when you can, as often as you can.

[Max Eddy]

Oh yeah.

[Rosie Guerin]

And then if you encounter a passkey, try it out.

[Max Eddy]

Yeah. The more you learn about using passkeys right now, the easier that transition will be. There's a list on the Fido alliance site of sites that do support passkeys right now. If you want to go, be proactive about it. Look at that. Go look at the account settings for the site that are most important to you. And the next time you see a little nag pop up on your phone that says, hey, do you want to create a passkey for it? Go for it. Do it.

[Rosie Guerin]

Max, thank you for the insight. Always appreciate it.

[Max Eddy]

Thank you so much.

[Rosie Guerin]

If you want to learn more about Max's reporting on data privacy security, you can check out Wirecutter's website. We will link his article goals about passkeys and about password managers in our show notes. As ever, we so appreciate you listening. Talk soon. The Wirecutter show is executive produced by me, Rosie Guerin and produced by Abigail Keel. Engineering support from Maddie Mazziello and Nick Pittman. Today's episode was mixed by Katherine Anderson, original music by Dan Powell, Marion Lozano, Elisheva Etoupe, Rowan Namisto, Katherine Anderson and Diane Wong. Cliff Levy is Wirecutter's deputy publisher and General manager. Ben Fruman is Wirecutter's Editor in chief. And I'm Rosie Guerin. Thank you for listening. The most obvious question the reason we

[Max Eddy]

created this what's my password?

[Rosie Guerin]

Yeah, what is your password? What is your master password?

[Advertisement Narrator]

Cool guy59 the Wirecutter show is supported by Egg Life. Back to School has parents managing a lot more. Moving pieces and meals quickly become one more problem to solve. Egg Life Egg White wraps make it easy to sneak high quality protein into your favorite meals and snacks. These wraps, made from egg whites, not flour, are a total game changer. They're high in protein and low in carbs. Find Egg Life wraps chilling in the fridge at Aldi, Whole Foods, Kroger, Target, Walmart and more. Visit egglifefoods.com to find a retailer near you.