Passwords Are Still Failing Us (World Password Day 2026)

Despite World Password Day 2026 and years of advocacy for better authentication, compromised credentials remain the root cause of 88% of web app breaches — a staggering statistic that underscores a systemic failure in cybersecurity. The hosts of Shared Security Podcast argue that the real problem isn’t users, but the organizations that continue to deploy weak, outdated, or non-existent multi-factor authentication (MFA) controls. They call out major financial platforms like Bill.com for only recently adding MFA options and still defaulting to SMS — a method known to be vulnerable to SIM-swapping attacks. The episode exposes a troubling truth: most applications still don’t require strong MFA by default, and regulators are failing to enforce stronger standards. The hosts advocate for a 'name and shame' approach to pressure companies into action, while also highlighting a growing, overlooked crisis: digital legacy planning. They reveal that even legal documents like wills and power of attorney are insufficient for accessing digital accounts after death, and that sharing password vault folders doesn’t solve MFA or device access issues. The episode concludes with a call to action: organizations must stop prioritizing convenience over security, and individuals must start preparing for digital afterlife scenarios — before it’s too late.