Please choose a password containing at least one uppercase letter, one lowercase letter, one number, one special character, one endangered bird species, two childhood ambitions and the name of the girl you fancied in R.E.
We’ve all been here. Squinting at the rules. Adding an exclamation mark. Realising you’ve now typed a password so secure even you can’t remember it. So you click "reset". Again.
It’s become a kind of game. Except no one’s winning, and the prize is logging into your water bill.
Naturally at some point, someone in Silicon Valley decided we needed something better. So now, we have… passkeys.
What are they? Excellent question. I have absolutely no idea.
They just showed up one day and I went with it. They worked, so I smiled politely and kept walking - like a bouncer vaguely recognised my face and waved me through. Just go with it. It worked. You’re in. Don’t ask too many questions.
Apparently they’re tied to your device. Or your fingerprint. Or maybe your soul. I’m now slowly beginning to worry about what was in the Terms & Conditions that I casually approved that time1. But they feel safer, and you get in quicker, which I guess is an important thing.
Then there’s biometrics - fingerprints, face scans, retinal patterns. All very sleek. Until you remember that you only get one of each, and if someone steals it… well, you can’t exactly grow a new thumb. Maybe I’ve watched too many mid-90s science fiction movies, but I have an irrational fear that maybe one day Wesley Snipes will rock up and attempt to skewer my eyeball on the end of a pencil, in order to steal the £37.502 in my bank account.
Sometimes my face doesn’t match because I’ve put on glasses, got up the wrong way, or simply lost the will to live. Other times, I gently press my finger to the sensor, only to be told it’s not me - like my own phone is gaslighting me.
Take.
My.
Thumb.
TAKE IT.
And just when I think I’ve outsmarted the system by choosing a decent password and remembering it, I type it in… and I’m told I can’t reuse an old password.
So I did remember it. And now you’re just punishing me for it.
We’ve designed these systems like digital obstacle courses. CAPTCHAs ask us to identify motorcycles or traffic lights, except they’re as low-res as humanly possible and screenshotted from a 1980s b-movie. "Select all squares that contain a chimney." Is that a chimney or a blurry thumb? Define "chimney" please, because that sticky-uppy-bit could easily be something else. Why am I doubting my own reality? At least have the decency to stick Dick Van Dyke on top of it so I can stop guessing.
I’ve clicked things that weren’t bicycles just to get on with my day. It hurts my soul. I’ve failed humanity’s Turing test more times than I can count.
Then of course there’s the two-factor authentication code that arrives on your other device while you’re already mid-login panic. Shit, the Teams meeting’s started and it’s logged me out. You grab your phone. Open the message. Read the code. Return to the screen. It’s expired.
Try again.
Now the app has logged you out.
Start over.
All this is for what? Lindsey from accounts doesn’t mind if I don’t turn up. And does viewing my gas bill from 2021 really require military-grade encryption?
Look I get it. I do. Security is important. But the way we do it feels less like trust and more like suspicion. Every login is an interrogation. Every reset is a punishment for not remembering the elaborate riddle you invented six months ago while stressed and slightly drunk.
What’s strange is how we’ve all just accepted it. We click "I forgot my password" like we’re at confession. Then we nod when asked to verify ourselves three times, as if we’re applying for citizenship, not checking a calendar invite. And don’t even get me started on the number of times I’ve ticked "remember me on this device." I’m looking at you, Microsoft. LIARS.
It’s not that I want less security. I just want a little less hostility. I want the systems I use every day to recognise me without suspicion. To greet me like I’m a regular, not a stranger with bad intentions and a suspect browser history. Hey welcome back, pull up a seat, the usual? No problem, I’ve got you.
Maybe that’s why passkeys are quietly brilliant, even if we don’t quite understand them yet. They say: "We know it’s you. Come on in". There’s something comforting in that.
Because the truth is, most people aren’t trying to break into anyone else’s account. We’re just trying to get through the day. To pay the bills and read our emails. Live our digital lives without being asked to prove, yet again, that we can recognise a traffic light.
Every time
Optimistic estimation