For sixty-four years, computers have greeted humanity with the same demand: a secret, typed in the dark. This case file investigates the ritual — where it came from, how design shaped it, and why your face is quietly replacing it.
The password is born on the Compatible Time-Sharing System — one computer, thirty researchers, and Fernando Corbató's simple fix for shared files. Within about a year, a PhD student named Allan Scherr printed the entire password file to get more computer time. The password and the password breach are practically twins.
A NIST manager named Bill Burr writes the guidance that haunts you still: uppercase, number, symbol, rotate every 90 days. The result was predictable — literally. Humanity converged on P@ssw0rd1! and incremented the digit every quarter. Attackers noticed.
Burr, retired, tells the Wall Street Journal: "I regret much of what I did." NIST rewrites the rules: length beats complexity, no more forced expiry, check against breached lists instead. One of the rare moments an industry admitted its ritual was theater.
Authentication grows a second question: not just who are you but are you even a person. CAPTCHA arrives — and reCAPTCHA turns your squinting into free labor, digitizing decades of old books and newspapers one wobbly word at a time. Tap the checkbox. It's load-bearing.
The second factor goes mainstream: a code, texted to the phone in your pocket. Better than nothing — meaningfully — but the phone number turned out to be stealable too. SIM-swapping made "something you have" into "something someone else briefly has," and NIST started backing away from SMS codes in 2016.
Touch ID (2013), then Face ID (2017), moved the secret into your skin. Design-wise it's the century's biggest authentication upgrade: the ceremony disappeared. Security-wise it's a trade: a fingerprint can't be guessed — and can't be rotated either. You only get ten.
Push approval seemed perfect: no codes, just a tap. Then attackers realized the button could be spammed until a human gives up. In 2022, Uber's network fell to exactly this — prompt after prompt until one exhausted contractor tapped Approve. You'll experience it yourself in a minute.
Passkeys: a cryptographic key pair instead of a shared secret. Nothing to type, nothing to phish, nothing to reuse. As of 2026 there are an estimated five billion of them in use. The password isn't dead — but for the first time in sixty-four years, it has a working successor.
Every password is a bet about arithmetic: how long would a machine take to try everything? Here's the bet, at roughly ten billion guesses per second — with 2025's actual most-common password included for scale.
"123456" has been the world's most common password in nearly every leak analysis since counting began. A quarter of the top 1,000 are pure digits.
For two decades, the backup plan for forgotten passwords was a quiz about your life — on the theory that only you knew the answers. The theory was wrong in a specific, researchable way: the answers were facts, and facts leak. Tap each exhibit to see where an attacker actually finds it.
In 2022, an attacker with a stolen Uber password couldn't pass the push-approval step. So they didn't try to. They sent prompt after prompt after prompt — then messaged the contractor pretending to be IT — until the human did the human thing. Your turn: all you have to do is read one paragraph. Deny anything that interrupts.
Push notifications were designed for consent — a doorbell for your account. But a doorbell that never stops isn't asking anymore; it's wearing you down. Security people call the result "MFA fatigue," and the name is honest: the attack isn't against your cryptography, it's against your patience. The defense that works isn't discipline. It's design — number matching, rate limits, and prompts that make "something is wrong" the easy conclusion instead of the paranoid one.
Users in 2026 are not confused about passwords being bad — they're exhausted. Before the numbers, calibrate yourself: which of each pair is safer?
Now the field data, from the FIDO Alliance's 2026 global survey:
That last number is the design brief hiding in a statistic: authentication isn't a security screen users pass through. It's a checkout, a front door, and a mood — and half your users have walked away from money rather than face it.
Sixty-four years of evolution, side by side. Press start; both lanes attempt the same login.
The ending isn't that passwords die — the ending is that the ceremony does. Authentication is dissolving into things you already do: holding your phone, looking at a screen, being where you usually are. The next design problem is already visible: when proving-it's-you becomes invisible, how does anyone know they're safe? Sixty-four years in, the answer is still being designed. Some of it by the person who wrote this case file.