Microsoft and Passkeys

They've been pushing the passkeys barrow since for some time now and Microsoft will soon be taking the next step of removing 2FA from all microsoft accounts.

​

​If you log into a personal Microsoft account—whether that’s for Outlook email, Xbox, or OneDrive—you’ve probably relied on a quick text message to verify your identity. You type in your password, a six-digit code gets texted to your phone, you enter it, and you’re in. It's incredibly convenient. But Microsoft is officially preparing to pull the plug on SMS text codes for two-factor authentication and account recovery. Why? Because Microsoft explicitly stated that text-based codes have become a leading source of digital fraud.  Now, it sounds counterintuitive. We’ve been told for years that text-message codes keep us safe. And they were a great stepping stone. But text messages travel across mobile networks in plaintext. Cybercriminals have gotten highly sophisticated at intercepting them through tactics like "SIM swapping"—where they trick your mobile carrier into moving your phone number over to their SIM card. If they have your password and your phone number, your account is compromised.  

So, what is the alternative? Microsoft is aggressively pushing us toward Passkeys.  If you haven't used one yet, think of a passkey like a digital handprint that proves who you are without ever needing a password. Instead of typing a long string of characters and waiting for a text code, a passkey links your account directly to a physical device you already own—like your smartphone or your computer.  

When you try to log in, your computer sends a secure, encrypted digital puzzle to your phone. To solve it, you just unlock your phone the way you always do—using your fingerprint, your face scan, or your device PIN.  The magic here is security. That biometric data never leaves your personal device, so hackers can't intercept it over the airwaves. Even better, passkeys are completely immune to fake phishing websites. If a scammer creates a fake Microsoft login page and you try to use your passkey, it simply won't work, because the passkey knows exactly which real web domain it belongs to. 

Microsoft hasn't given a final drop-dead date for dropping SMS codes entirely, but they are already rolling out the changes, and you'll start seeing prompts to upgrade soon.  If you want to get ahead of the curve, it only takes a couple of minutes to set up. Just head over to account.microsoft.com, go to your Advanced Security Options, and click "Add a new way to sign in." From there, choose face, fingerprint, or PIN, and let your device guide you through the save process.  It's an easy switch that offers massive protection.

Ep358

Image created by AI