Perhaps you wouldn’t expect the CEO of a password-management provider to say they want a future without passwords—isn’t that like the Container Store wishing for a future without boxes?—but that’s what Dashlane’s chief exec John Bennett said when he visited Morning Brew HQ this month.
“We’ve always been about wanting to eliminate passwords,” Bennett told us during a Dec. 4 meeting, “because we recognize inherently, just how insecure they are.”
While password behaviors have improved, according to the company’s own password health scores, classic bad habits continue. The National Cybersecurity Alliance, in its annual study, found that 35% of 7,012 global respondents said they did not use separate, unique passwords all or most of the time. (Also: 46% admitted to never using a password manager.)
So, if passwords disappear on the Post-it note they came in on, what’s left for a credential manager to manage? Bennett spoke with us about the emergence of another authenticator: the passkey.
Below are edited responses from the 30-minute conversation.
How have authentication habits changed since the company was founded in 2009?
In the last three years, there is really this emergence of this new cryptography, which is passkeys. These passkeys are bound to a specific site. They’re very, very hard to phish. The second authentication is through this biometric component that’s done on the device. I see the change now: On the consumer side and on the business side, people recognize that they want an easier and more secure way [to authenticate]. Passkeys are showing up in mainstream publications. I think it’s still nascent, though.
Do you have an example of a Dashlane feature that responds to this change to passkeys?
We’re a member of what’s called the FIDO Alliance, a nonprofit in the industry that is all about promoting passwordless technologies and access. What’s important for passkeys is they have to work across all the devices and operating systems you use. And so within Dashlane, we support all the different browsers, and we support Android and iOS.
Top insights for IT pros
From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.
How does a world without passwords change Dashlane’s identity?
We really view ourselves as a credential manager. And so just as you manage and share your passwords, you’re going to want to be able to share and manage and provide context on passkeys and other types of credentials and secure notes that you want to keep in the vault.
Do you envision that future, where no one is using passwords?
I think there’s going to be a long tail on passwords, because I think there is still standards work that needs to be done on passkeys, and that’s a work in progress. It’s just amazing; I think we’ve seen the proliferation and growth, just within the number of passkeys that are being stored in our users’ vaults. And we’re seeing exponential growth. And that’s probably not just us, it’s everyone that has the ability to store and manage passkeys.
What will the tipping point be?
The tipping point is going to be: When does a really scaled site say, “We’re eliminating the passwords. They’re going away. This is the only way you can authenticate”? Maybe there’s also a one-time link or something of that nature…I think we’ve got to see one of these top 50 properties of web traffic say, “We’re no longer supporting passwords.” What they do will drive downstream behavior. I think passwords and passkeys are going to coexist for a while. When I talk to folks at Google and Apple and other very large companies, I’m encouraged by how passionate they are about setting these big, audacious goals of how many users they want using passkeys.