\n
Each year on the first Thursday of May, cyber security professionals urge the public to strengthen their password hygiene. But in 2025, this tradition may be past its expiry date. Why? Because our over-reliance on passwords is becoming the very risk we seek to avoid.<\/p>\n
According to Verizon\u2019s Data Breach Investigations Report (2024), 81% of breaches still involve weak or stolen passwords. As threat actors evolve and AI becomes part of their toolkit, even the strongest passwords can be broken in minutes, not months. It\u2019s time we ask \u2014 are we clinging to an outdated security method that\u2019s holding us back?<\/p>\n
The Problem with Passwords Today<\/p>\n
The data is damning. According to Nordpass,<\/a> the weak password of \u201c123456\u201d persists in being used as a password, easily cracked within 1 second by hackers. An online security survey by Google and Harris Poll in February 2019 found that at least 65% of people reuse passwords across multiple, if not all, sites, exposing them to credential-stuffing attacks at scale.<\/p>\n Newer threats are only accelerating this risk. Brute-force attacks have moved from CPUs to high-speed GPUs \u2014 some capable of guessing over a million password combinations per second meaning what once took years to crack can now be done in minutes using AI-enhanced tools.<\/p>\n The Dark Side of Passwords: A Cybercrime Economy<\/p>\n The underground market for stolen credentials is vast and lucrative. It\u2019s estimated that over 24.6 billion username-password combinations<\/a> are currently circulating across cybercriminal marketplaces \u2014 although the true scale is difficult to verify due to repeated resale of stolen data. In bulk, these credentials are even cheaper \u2014 as seen in the Booking.com scam, where thousands were sold for just $2,000<\/a> with new credentials offered every month, depending on breaches and leaks. The most valuable logins include banking, email, cloud, crypto, corporate VPNs and social media accounts, which are commonly reused for phishing, identity theft, malware campaigns, and business email compromise.<\/p>\n Behind these thefts are some of the world\u2019s most sophisticated threat groups, including Kimsuky (North Korea), MuddyWater (Iran), and APT28\/29 (Russia) \u2014 often using malware like Lumma and MaaS platforms, targeting MFA tokens and crypto wallets, spreading over Telegram bots, that make infostealing scalable and profitable. It was reported that in 2024 alone, 3.9 billion credentials were compromised via malware infections across 4.3 million devices<\/a>.<\/p>\n Even multi-factor authentication (MFA), while crucial, is being challenged by tools like EvilProxy, which can intercept MFA tokens. This growing cybercrime economy is not just a technical threat \u2014 it\u2019s a geopolitical and economic ecosystem as these threats now can come from anywhere at all thanks to MaaS and Phishing-as-a-Service (PhaaS) platforms. Together with infostealer-as-a-service and phishing kits for hire, these attacks are no longer limited to state actors \u2014 they\u2019re available to anyone with a Bitcoin wallet.<\/p>\n The Rise of Passwordless Authentication<\/p>\n In contrast, passwordless security is becoming not only possible \u2014 it\u2019s practical. Companies like Google, Microsoft, and Shopify are rolling out Passkeys \u2014 encrypted cryptographic keys tied to biometric or device-based authentication.<\/p>\n Microsoft wants its more than one billion users to stop using passwords to log into their Microsoft accounts while Gartner predicts that 60% of enterprises will eliminate passwords<\/a> for most use cases by 2025.<\/p>\n In sectors like finance, healthcare, and government, hardware tokens, multi-factor logins, and biometric identification are taking over. Even in countries like Singapore and India, government-backed digital identity systems are accelerating passwordless adoption for banking, insurance, and healthcare access. This is driven by a desire to enhance security, improve user experience, and streamline digital interactions.<\/p>\n In Singapore for instance, Singapore\u2019s National Digital Identity (NDI) system built on Singpass<\/a>, connects over\u00a0700 government agencies and private businesses. Options like facial recognition, digital ID cards, and QR codes confirm user identities quickly and are more secure than traditional passwords. India\u2019s Aadhaar<\/a>, the world\u2019s largest biometric system supports secure digital identity verification via OTPs and biometrics, while Australia\u2019s Digital ID roadmap is investing in federated, passwordless frameworks<\/p>\n Behavioral Resistance: Why We Still Cling to Passwords<\/p>\n Despite security advances, people still trust what they know \u2014 and passwords feel familiar. But that familiarity comes at a price. Passwords are easily guessed, forgotten, shared, or stolen.<\/p>\n Check Point notes that poor password hygiene \u2014 such as reusing passwords, writing them down, or using personal data \u2014 continues to be a major weak link in corporate and personal security.<\/p>\n Even worse, phishing attacks \u2014 many AI-generated \u2014 continue to steal login credentials at scale, despite the presence of two-factor authentication (2FA). The rise in AI-powered phishing and deepfake attacks only makes password-based systems more vulnerable.<\/p>\n Risks of Staying with Passwords in a Post-AI World<\/p>\n The evolution of AI is making password-based authentication obsolete:<\/p>\n Deep learning models are trained on billions of leaked passwords and can predict common patterns faster than ever.<\/p>\n<\/li>\n Voice- and video-based impersonation attacks using deepfakes can bypass even multi-factor authentication if based on weak identity layers.<\/p>\n<\/li>\n Cloud-based GPUs are democratising the power to break passwords at scale, enabling ransomware groups and script kiddies alike to compromise systems rapidly.<\/p>\n<\/li>\n<\/ul>\n In short: the longer we wait to go passwordless, the more we expose ourselves.<\/p>\n What Organisations Should Do Now<\/p>\n Pilot passwordless systems using biometrics, tokens, or Passkeys.<\/p>\n<\/li>\n Use tools like Check Point Harmony to prevent password reuse and phishing.<\/p>\n<\/li>\n Enforce Privileged Access Management (PAM) solutions and Zero Trust architectures.<\/p>\n<\/li>\n Educate teams not just on stronger passwords \u2014 but on phasing them out altogether.<\/p>\n<\/li>\n<\/ul>\n Check Point emphasises password length, diversity, and uniqueness but is also aligned with the need to explore post-password approaches.<\/p>\n World Password Day shouldn\u2019t just be about creating stronger passwords. It should be a prompt to imagine a future without them. The tools exist. The threats demand it. The only thing missing is our willingness to let go.<\/p>\n Follow Check Point via:<\/p>\n LinkedIn: https:\/\/www.linkedin.com\/company\/check-point-software-technologies<\/a><\/p>\n Twitter: https:\/\/www.twitter.com\/checkpointsw<\/a><\/p>\n Facebook: https:\/\/www.facebook.com\/checkpointsoftware<\/a><\/p>\n Blog: https:\/\/blog.checkpoint.com<\/a><\/p>\n\n
\n