Archives for April 2026

We’ve been discussing passkeys a fair bit here in recent weeks, and by coincidence last week the UK’s National Cyber Security Centre released a new paper and guidance on the topic.

• General guidance document: Passkeys: what you need to know
• Press release: NCSC: Leave passwords in the past – passkeys are the future
• Technical paper: Comparing the security properties of traditional user credentials and FIDO2 credentials for personal use

Below are a handful of quotes from the publications. Please note how strongly worded these statements are. And these are from a governmental cybersecurity organization, which is presumably being very intentional with its wording.

From the “what you need to know” document:

“Passkeys are a more secure alternative to passwords that you don’t need to remember as they are created and managed safely by the software on your device(s). […] The NCSC supports the public adoption of passkeys and recommends using passkeys over passwords wherever available.”

From the press release:

“Passwords are no longer resilient enough for the contemporary world.”

“Passkeys should now be consumers’ first choice of login across all digital services, the UK government’s technical authority on cyber security has announced today (Thursday).

Overhauling decades of security practice, the National Cyber Security Centre […] has taken the decision to no longer recommend individuals use passwords where passkeys are available because passwords lack the relative resilience to modern cyber threats.”

From the paper:

“At all stages of a credential’s lifecycle, and against all commonly observed attacks, FIDO2 credentials including passkeys are as secure or more secure than all forms of traditional MFA for individuals.”

Also of note (from the press release):

“Where a particular service does not support passkeys, the NCSC’s advice to consumers is to use a password manager to create stronger passwords and keep using two-step verification.”

If you want to read the paper (or even just the “Summary and recommendations” section at the end of the paper), a few points on terminology might be helpful:

• The word passkey itself is a colloquial term, and its exact usage varies a bit from one case to another.
• FIDO2 credential is a technical term for what would often colloquially be called passkeys.
• When this paper uses the term passkey it is specifically referring to passkeys synced via the cloud. It uses the terms single-device passkey or device-bound FIDO2 credential to refer to what we might think of as passkeys stored on a single device, not synced to the cloud.
• Sync fabric refers to whatever system is being used to store your passkeys in the cloud and sync them across devices (e.g., Apple Passwords, Google Password Manager, etc.).
• Relying party refers to whatever website or app you’re logging into when using a passkey.

Other Recommended Reading/Viewing/Listening

• Causes We Love: Turning Students into Investors (Bogleheads Conference session, in which I interviewed Cole Mattox and and Dylan Ingerman of First Generation Investors)
• Analyzing the Analysis: How Do AI Portfolio Recommendations Hold Up? from Allan Roth
• Can Millennials Count on Social Security? (in which I was interviewed for the How to Money podcast)
• Why Social Security Faces a Financial Reckoning Just a Few Years From Now from Alicia Munnell
• Social Security is Slowing Down. Here’s How to Get Your Benefits On Time from Mark Miller
• 2 Ways to Actually Reduce Smartphone Use from Cal Newport
• Private Assets May Be Coming to Your 401(k). You Should Know the Risks. from Tara Siegel Bernard (NYT)
• IRS Finalizes Deduction Rules for Tips, Adds 3 Eligible Jobs from Martha Waggoner
• Russia Hacked Routers to Steal Microsoft Office Tokens from Brian Krebs (Don’t use an old router!)

Thanks for reading!

We discussed some weeks ago that using an authenticator app is a more secure method of multi-factor authentication than SMS or email. An even more secure option is using a physical security key, such as a YubiKey. For anybody unfamiliar with security keys, they are small devices, which you insert into a USB port (or in some cases tap against your mobile device) to verify your identity when logging in.

To be clear, there are other brands of security keys, such as the Titan Security Key from Google. I’ll be referring to YubiKeys in this article though simply because that’s what I’m most familiar with.

With multi-factor authentication via email, SMS, or authenticator app, a major threat is that the user can be tricked into giving the multi-factor authentication code to a malicious party.

Another threat with such multi-factor options is the possibility of the code being somehow intercepted (e.g., through SIM swap fraud, as we’ve discussed).

If you have an account for which the only way to log in is with a physical security key, those types of threats are largely eliminated. For a malicious party who is not able to get physical possession of your security key (i.e., almost any remote threat actor), their menu of options for trying to access your accounts is dramatically reduced.

User Experience

The user experience with a security key is going to vary from one website to another. In part that’s because there are, broadly, two different ways in which a security key can be used to log in.

Firstly, there’s the traditional/older method, in which you’d still use a username and password, and the security key would be your method of multi-factor authentication. If using your security key in this manner, to log into a website you would:

• Enter your username and password,
• Connect your security key to your device, then touch the key to activate it.

But security keys (at least modern ones) can also be used for passwordless login (i.e., they can be used to store a passkey or similar FIDO2 credential). In that case, in order to log in you would:

• Enter your username or select an account, if prompted to do so,
• Connect your security key to your device,
• Touch the key to activate it and (if the website requires such) enter the security key’s PIN (discussed below).

With passkeys stored on a security key, you get all the various benefits of passkeys (i.e., phishing protection because they only work on the legitimate domain they were created for, no need for the institution to store a password, easier to use, etc.) and you make the passkeys themselves as secure as possible (i.e., making it as unlikely as possible for a malicious party to be able to use them).

Get More Than One!

If you’re going to use a security key for logging into anything, be sure to buy more than one. If you only have one, and you lose it or it gets damaged, you could be locked out of a bunch of important accounts — permanently in some cases.

Often, three (or possibly even more) is a good idea. One that you use regularly at home, another in a safe at home, and a third in a secure off-site location (e.g., safe deposit box at a bank). That way, even if the two at your home are destroyed (e.g., due to a fire or natural disaster), you still have a backup.

Set Up a PIN (via Yubico Authenticator App)

When using a key for passwordless login, many websites require you to verify yourself on the key (e.g., by entering a PIN). If you haven’t yet set a PIN, you’ll typically be prompted to create one the first time it’s needed.

Personally, after buying a YubiKey, I would encourage you to download the desktop Yubico Authenticator app, so that you can set a PIN (“FIDO2 PIN”) for your key as soon as it arrives at your home.

With regard to selecting a PIN, Yubico notes the following:

“For those combining a hardware authenticator with a PIN, it’s important to note that PINs do not demand the same security requirement as a password. A PIN and a password are different. Since a PIN is not part of the security context for remotely authenticating the user (the PIN is not sent over the network for verification), it can be much simpler and less complex than a password, and does not need to be changed with the same frequency (or at all).”

Point being, a PIN doesn’t need password-level complexity. (But still, don’t set it to 123456 or something quite so simple and guessable.)

Generally you’d want to set the same PIN on each of your keys, to reduce the likelihood of getting locked out in an emergency (e.g., you’ve lost your main key, go to the bank to get your backup key, and because it has a different PIN that you rarely use, you can’t remember it). The additional risk from using the same PIN on each is minimal. If a malicious party has one of the keys and has your PIN, the fact that it’s also the PIN to your other keys doesn’t make the situation any worse. Don’t give anybody else your security key or the PIN for your security key.

One last point about setting a PIN: when logging in with the PIN,  you’re attempt-limited, for security’s sake (i.e., so that if somebody manages to get a hold of your key, they can’t simply try over and over to get the correct PIN). If you enter the incorrect PIN 3 times, you’ll have to remove and reconnect the key. After 8 incorrect attempts in a row, the key itself is locked. You don’t have to throw it away, but it will have to be factory reset, in which case all the passkeys stored on the device will be deleted.

Security Keys + Password Managers

When we discussed password managers, we also discussed the common “passwords in a physical notebook” approach to password management. The whole idea behind that approach is that it’s pretty unlikely that somebody is going to get into your house and steal that notebook. And that’s likely true. For most of us, our homes aren’t broken into on a regular basis.

But if you use a password manager and you secure your password manager account with a security key (i.e., your security key is required to log into your password manager), you still have that “somebody would have to steal this physical thing in order to access my passwords” -type of security. Plus, now they’d not only have to steal the physical thing, they’d also have to know the PIN to unlock the security key.

And in addition you get:

• Improved data integrity (i.e., no risk of a coffee spill destroying your record of passwords).
• Improved data availability (i.e., no need to remember to take the notebook with you when traveling).
• The anti-phishing security that results from the password manager not providing a password if you accidentally end up on a fake/malicious lookalike website.
• Secure password sharing for a family.
• The convenience of password auto-fill.
• A secure place to store backup codes for websites.
• A secure place to store fictional answers to “security” questions. (For example, for your auto insurer’s website, when they ask the name of your favorite food, you can store in the password manager that the required answer is “kCbc$A4qjmto4” rather than the true but quite guessable answer of “pizza.”)

What Happens if a Security Key is Stolen?

You should take the physical security of your security keys seriously. Treat them as if they were, very literally, the keys to your accounts. And if you lose one, you should promptly remove that key as a sign-in option from your various accounts (i.e., by signing in via some other method, navigating to your security/sign-in options, and removing the security key that is no longer in your possession).

That said, if one of your security keys is stolen, the thief will probably not be accessing all of your accounts immediately.

Firstly, a thief who has stolen your key would not know, for example, that the key could be used as the multi-factor option for your Vanguard account with username HotBob1972. Even with passkeys stored on the device, access to those credentials is typically gated by user verification (such as a PIN).

Secondly, to use the security key to log into an account, the thief would generally still need either your password (if you were using the key for traditional multi-factor authentication) or the key’s PIN (if you were using the key to store a passkey).

But again, keep those security keys secure (i.e., never give them to anybody else, always be aware of where they’re located rather than leaving them randomly lying around the house). And if you do lose one, promptly remove it as a sign-in option from your various accounts.

Security Key Limitations

Firstly, not all websites allow security keys as a multi-factor authentication method or for passwordless login.

Second, as always, your accounts are only as secure as the least-secure method of accessing the account.

An authenticator app is more secure than SMS or email as a multi-factor authentication method. And a security key is more secure than an authenticator app.

After setting up secure methods, you generally want to remove the less-secure methods of signing in, if the website allows you to do so. (Though again, be sure you have multiple options. If the only way to sign into an important account is with a single physical security key, you’re setting yourself up to be locked out of the account someday.)

Be sure to also examine the account-recovery process for each of your accounts (as distinct from the normal method for signing in). If it’s some insecure method (e.g., a phone call to your mobile phone), the account is still insecure.

Additional Reading

For readers who want additional reading, the following articles from Yubico (the company that makes YubiKeys) may be helpful:

• 10 Things You’ve Been Wondering About a Passwordless World
• A Technical Guide to FIDO2 and Passkeys

I hadn’t expected it, but interest in the recent cybersecurity-related articles has been absolutely off the charts, based on the volume of incoming questions, comments, and frequency with which readers are sharing the articles with other people.

I only have two more articles planned for the series (hardware security keys and an overall plan to keep yourself and vulnerable loved ones safe), and then we’ll be back to more typical content (though mixing in cybersecurity-related topics here and there, as it really is a core part of personal finance).

In any case, here’s the series so far:

• What Does a Thief Need to Access Your Financial Accounts? It’s Likely Less Than You Think
• It Can Be Easier to Fall Victim to Fraud on Mobile than Desktop
• Authenticator Apps: a Better Multi-Factor Option than Text or Email
• Stop Trying to Remember Your Passwords (And Use a Password Manager Instead.)
• What the Heck are Passkeys? And Should I Be Using Them?

From 2018-2024, losses from cybercrime for people age 60+ went from $649 million to $4.8 billion — a seven-fold increase. (And it’s generally accepted as fact that actual losses are much higher than the reported figures, given that many people never report their losses due to simply not bothering with it or due to feeling embarrassed.)

Last week, the FBI released their annual report with the figure for 2025: $7.748 billion. That’s an increase of roughly 60% in just one year. Here’s what it looks like visually:

And with AI tools being dramatically more powerful this year than last year, I have to imagine the 2026 figure is going to be even worse.

• Cryptocurrency and AI Scams Bilk Americans of Billions from the FBI
• FBI 2025 Internet Crime Report
• Prior years’ reports here, if you’re interested

Other Recommended Reading

• Talking to Mike Piper, Christine Benz about the Pressure of Being Right (and Dealing with Their Own Imposter Syndrome) from Josh Katzowitz
• Wall Street Watchdogs Pull Back Amid Trump’s Deregulatory Push from Nicola White, Katanga Johnson, and J.J. McCorvey
• The Upper Middle Class Trap from Nick Maggiulli
• Creating A Flexible Retirement Date ‘Window’ To Mitigate Sequence And Cohort Risk from Georgios Argyris
• Breakeven Real Rates for Delayed Social Security Claiming from Nathan Dutzmann
• It’s Time to Review Your Beneficiary Designations from Daniel Michaelsen
• Tips for Choosing the Best Healthcare Proxy from Diana Cabrices
• Scott Bessent and Jay Powell Call Meeting with Big Banks to Discuss Cyber Threats from Anthropic’s Latest Model from Samantha Subin and Hugh Son

Thanks for reading!

In the world of information security, the “CIA triad” is often used as a framework of objectives that must be met. (To be clear, it’s a mnemonic device and has nothing to do with the Central Intelligence Agency.)

• Confidentiality: access to data should be limited to the appropriate parties.
• Integrity: your data is accurate and has not been tampered with.
• Availability: you have access to the data when you need it.

When most of us think of cybersecurity, confidentiality is primarily what we’re thinking about, but integrity and availability are mission-critical also.

For many people, using a password manager is going to be an upgrade in all three categories, relative to what they’re currently doing.

Confidentiality

Just think of all the different accounts you have, which you would really not want accessed by a malicious party:

• Email accounts,
• Bank accounts,
• Brokerage accounts,
• Credit cards, mortgage lender, or other financial services,
• Credit bureaus,
• MyChart (or other patient portals) for your health care system(s),
• Login.gov,
• Venmo,
• Your providers of health insurance, car insurance, homeowners/renters insurance, umbrella insurance, etc.

The list just goes on and on. And there are probably 100+ other websites with less critical information, but which you’d still prefer somebody else not to access.

For anybody with normal memory capabilities, it’s impossible to remember a unique password for each of those websites.

So, many people resort to one password that gets reused across a bunch of different accounts. This is a train wreck waiting to happen. Credential stuffing is a common form of cyberattack, in which thieves use previously stolen credentials (username/password) on various other accounts. Once your password is stolen, it will be tried on a very long list of other websites. If you reuse the same password on many websites, you now have thieves accessing a whole bunch of your accounts all at once. This is an entirely avoidable scenario, so please don’t let it happen to you.

Alternatively, many people resort to short, easy to remember passwords (e.g., Boglehead123 for their Vanguard account or MagellanLynch1 for their Fidelity account). The problem is that easily remembered passwords are often easily guessed passwords.

The reality that you have to accept at this point is that you aren’t supposed to be able to remember all of your passwords. If you’re still trying to remember them all in your brain, you are almost certainly making major security compromises in order to make that happen.

A password manager allows you to create strong (lengthy and randomly-generated) passwords for each account, which are unique to each account, and it remembers them for you.

Another benefit with respect to confidentiality: a password manager will usually not offer to fill your password if the domain doesn’t match exactly. For instance, if you have a saved username/password for Schwab.com, and someday you accidentally find yourself on a different domain, which is designed to look exactly like Schwab’s website (and thus collect and maliciously reuse your credentials after you enter them), your password manager should not offer to fill your password (because it doesn’t see a saved password associated with the domain you’re currently on).

Integrity and Availability

Some people’s approach to password security is to record all of their passwords in a physical notebook, which is kept in their home. Assuming that the notebook is kept secure, that can do a reasonable job with respect to confidentiality. But that approach often falls short with respect to data integrity. At some point, ink becomes smeared. Or passwords get crossed out with new ones scrunched into the spare space nearby. Legibility declines and we can no longer read the password in question. Or something physically happens to the notebook itself: there’s a fire or natural disaster, or more likely, a beverage is spilled directly onto the notebook.

I’ve also seen that approach fail with respect to availability: whoops, we forgot to bring the notebook with us on vacation. Or your spouse just can’t read your handwriting.

Similarly, I’ve seen people take a post-it note approach to password management (i.e., just sticking post-its on or near their computer with various important passwords). While that approach has confidentiality problems if anybody else ends up near your computer, that approach also can easily fail the availability test if a post-it falls off and gets thrown away.

With a password manager, your passwords will be synced across your devices. As long as you can sign into your password manager, you will have access to your passwords. And no need to worry about your or your spouse’s handwriting.

Password Sharing

Password managers also allow for secure sharing between multiple people (e.g., two spouses on a shared family plan), which has benefits for confidentiality, integrity, and availability.

• Confidentiality: sharing passwords via a password manager is much more secure than sharing them with each other by text, for example.
• Integrity: if one of you updates the password, it will be automatically updated for the other.
• Availability: you can be in different physical locations, while both still having access to your shared passwords.

Which Password Manager?

I’m not going to officially recommend one password manager as opposed to another. Most all-Mac households seem to be happy with Apple’s built-in password manager (known as Apple Passwords on newer devices). 1Password or Bitwarden are also popular and well respected.

LastPass was also very popular, but due to a major breach in 2022, many of the top experts in the field recommend using a different provider. (And if you were using LastPass at the time, you should change every password that was stored in your vault. And if you are still using LastPass even after that breach, you should absolutely change your master password as well.)

As far as the password managers built into Chrome and Edge, opinions vary. Many people consider them to be somewhat of a tradeoff, providing convenience but less security (and fewer features) than a dedicated password manager. Other people argue that the latest versions are meaningfully improved and now essentially as secure as 1Password or Bitwarden.

If you go looking for comparisons of one password manager to another, I’ll just make two observations:

• Many of the articles you’ll find are actually sales pitches in disguise. Many password managers offer “affiliate programs,” whereby they pay a commission to a referring party for each new customer that signs up. If somebody can publish an article that ranks well in search results for “best password manager” or “password manager comparison” — and then the article gets many people to sign up for one of the providers that pays a commission, that can be a substantial revenue stream.
• Among cybersecurity enthusiasts, “should I use Bitwarden or 1Password” is akin to “should I tilt to small-cap value” for Bogleheads. They can talk about it forever, and there are ardent supporters on either side. There are real pros and cons of each. But the key thing to recognize is that either is a heck of a lot better than what many people are doing with their passwords.

Staying Secure with a Password Manager

I want to be clear that simply using a password manager doesn’t in itself make you much safer. Password managers make it convenient to use strong passwords, but if you have existing weak passwords and/or passwords that are reused at a bunch of different places, you have to take the step of updating those passwords to new passwords that are stronger and unique. (The password manager should have a password generator to easily create strong passwords for you.)

It’s also extremely important to recognize that, with a bunch of passwords stored in one place, that one place becomes absolutely mission critical. You need to keep malicious parties out of it. And you need to make sure that you will not be locked out of it.

That means that for your password manager, you want to:

• Use a very strong master password.
• Turn on multi-factor authentication.
• Only use strong methods of multi-factor authentication. (The safest would be a hardware security key such as a YubiKey, of which you have multiples. Hardware security keys will be a topic for another day. But as noted previously, an authenticator app is generally a safer option than MFA by email or SMS.)

When using a password manager, device security becomes even more critical than it would otherwise be. For example, if you take your laptop around with you, and you normally keep yourself signed into your password manager on that device (e.g., via a Bitwarden or 1Password browser extension), you have a very big problem if somebody else gets their hands on that device. For devices that leave your home (or even for devices kept at home, if other people are around on a regular basis), I recommend using a very short screen-lock time, as well as configuring the password manager to lock (thus requiring your master password to be reentered) when the screen locks or the device goes to sleep.

And with respect to not getting yourself locked out, it’s important to recognize that if you forget your master password, many password managers cannot recover it for you. You would be permanently locked out. That’s by design. It’s one part of what makes the system secure. But it means that you should probably have that master password written down on paper somewhere, such as a fireproof safe or in a safe deposit box.

Similarly, your recovery code (which serves as a backup if your normal MFA method is unavailable) should be printed on paper and kept somewhere safe.

If your recovery code and master password are both printed out and kept together in a safe deposit box, this would provide you (or your heirs, when the time comes) with a way to sign into your account.

Password Managers and Passkeys

As discussed previously, passkeys are generally an improvement over traditional passwords, for a variety of reasons (e.g., they’re more resistant to phishing). And your passkeys will generally be stored in a password manager, to be synced across your devices.

As I noted in previous articles though, it’s hard to explain exactly how that works in practice, because it will vary depending on what combination of technology you’re using (i.e., which operating system(s), which browser(s), which password manager(s), and whether or not you’re using hardware security keys such as YubiKey). There are too many possible combinations to give a complete set of answers for everybody.

• Apple Passwords can store passkeys on all Apple devices — and sync them across Apple devices.
• Google Password Manager can store passkeys on any device browsing with Chrome (and sync across all such devices).
• Edge Password Manager can store/sync passkeys on any devices browsing with Edge.
• Third party password managers (e.g., Bitwarden or 1Password) can store passkeys and sync them across devices on which the software is installed (or accessible via an installed browser plugin).

Imagine for instance that you have two devices: a Windows desktop on which you browse exclusively with Chrome and an iPhone on which you browse exclusively with Safari. And you don’t use a third-party password manager. In that case, it would be Google Password Manager storing the passkeys on your desktop and Apple Passwords storing them on your iPhone. And they would not “see” each other’s passkeys. (But even that is okay, because you can just set up multiple passkeys for each website.)

Conversely, if in the above situation you browsed with Chrome on both devices, then Google Password Manager would be syncing the passkeys across the two devices.

Or let’s say you have a desktop Mac and an iPhone. And you use Chrome on both. Then either Apple Passwords or Google Password Manager could be used to store and sync your passkeys. Google Password Manager seems to try to make itself the default when browsing with Chrome, but you can adjust your settings to turn that off (and thus use Apple Passwords) if desired.

And in any of the above cases, if you have a third party password manager (e.g., Bitwarden or 1Password) that you use on all devices, that password manager could instead be used to store/sync passkeys.

But the key things to know are that:

1. It’s okay if you have some passkeys stored in one place and others stored in another place (as in the first example), because you can have multiple passkeys for each website.
2. Anywhere you are storing passkeys and/or passwords should be kept as secure as possible (i.e., using a strong password that is not used elsewhere and using strong multi-factor authentication).