Microsoft ditches password-based authentication tomorrow – Edge browser switches to Windows Hello access

Microsoft is retiring the Edge master password feature
Access keys and biometrics replace old authentication
Users may contact third-party administrators

Microsoft is killing the master password feature in Edge and moving to newer, more secure solutions.

Edge is Microsoft’s internet browser, based on Chromium. Among other things, it has a built-in password manager that allows users to store not only passwords, but also other secrets, such as usernames, payment information or, in some cases, addresses.

Until now, users who wanted to log into the tool and manage their secrets could do so via a password, but Microsoft has been pushing to replace the old authentication method with access keys. In a press release shared with TechRadar Pro, NordVPN said that as of June 4, the master password feature in Edge is finally retiring, to be replaced by device-based authentication methods such as Windows Hello (PIN, fingerprint, or face recognition).

A step in the right direction

For Ignas Valancius, VP of engineering at NordPass, this is a logical step forward, as biometrics and access keys are “considered more convenient and secure than passwords”.

“When people manage too many passwords, they tend to reuse them or create simple variations, such as changing a single letter or number,” Valancius emphasized. “This practice creates significant vulnerabilities – if one of these accounts is breached, all other accounts that share the same or a similar password are compromised.”

Still, he expects at least some backlash, because people are “creatures of habit” and old habits die hard. Such people may find solace in alternative third-party password managers, which still allow users to log in with a master password. “But personally, I think a push towards passwordless authentication is a positive development,” he stressed.

Passwords have long been considered one of the weakest links in the cyber security chain, mostly because people don’t bother to create and securely store strong ones. Instead, they end up using simple, easy-to-guess passwords across a wide range of services and risk losing access to several services at once.