--- title: Why it is time to get rid of passwords in our infrastructure description: An opinion piece argues that passwords—including plain-text credentials, long-lived tokens, API keys, and SMS-based second factors—need to be eliminated from... canonical: https://daily.dev/posts/why-it-is-time-to-get-rid-of-passwords-in-our-infrastructure-rsum1uepd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Why it is time to get rid of passwords in our infrastructure | daily.dev og:description: An opinion piece argues that passwords—including plain-text credentials, long-lived tokens, API keys, and SMS-based second factors—need to be eliminated from... og:url: https://daily.dev/posts/why-it-is-time-to-get-rid-of-passwords-in-our-infrastructure-rsum1uepd og:image: https://api.daily.dev/og/posts/RSUm1uePd.png og:image:alt: Why it is time to get rid of passwords in our infrastructure og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Why it is time to get rid of passwords in our infrastructure **[Teleport](https://daily.dev/sources/teleport)** · 10 min read · 0 upvotes · 0 comments ## Summary An opinion piece argues that passwords—including plain-text credentials, long-lived tokens, API keys, and SMS-based second factors—need to be eliminated from infrastructure due to inherent guessability and interception risks. The author critiques password managers, vaults, and CI/CD secret stores as 'password aggregators' that centralize risk rather than eliminate it. For users, only hardware security devices combining public/private key crypto, presence verification, and biometrics (e.g., YubiKey Bio, Touch ID/FaceID) are considered adequate replacements, while one-time email links, TOTP, SMS, and pure-software facial recognition are deemed worse than passwords. For services, the author advocates replacing vaults and mounted secrets with short-lived, scoped certificates issued via PKI systems like SPIFFE, Istio, or Teleport (the author's own product). ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why are password managers and vaults not a good long-term solution for infrastructure security? Password managers and vaults consolidate many credentials behind one root password or storage system, creating a single high-value target for attackers. Once an API key or token is pulled from a vault, there is no way to track how it is copied, used, or stored afterward, and vaults still store secrets in plain text once mounted, undermining the security they promise. _Developers weighing secrets-management strategies can track evolving authentication practices on daily.dev._ ### Why are short-lived certificates considered better than API keys or passwords for service-to-service authentication? Short-lived certificates encode a unique identity per service, enabling fine-grained access control, and can expire in as little as 5 minutes without needing revocation. Certificates can also be scoped to a specific IP, container, or region, and because they use public key infrastructure, a private key never has to leave or be persisted on the service, making them far harder to steal or replay than static credentials. _Teams designing zero-trust infrastructure can follow certificate-based authentication approaches on daily.dev._ ### Why is SMS-based two-factor authentication considered a weak security method? SMS relies on insecure communication channels vulnerable to SIM swapping and social engineering, letting attackers intercept one-time codes without needing to breach the underlying service. It also fails to verify a user's physical presence or identity, making it fundamentally comparable to a plain password rather than a true second factor. _Engineers hardening login flows can compare authentication factor tradeoffs on daily.dev._ ## Similar posts on daily.dev - [Understanding Authentication Methods](https://daily.dev/posts/understanding-authentication-methods-jmj3klhzw) · Security Boulevard · 0 upvotes · 0 comments - [Passwords are dying – here’s the tech that’s replacing them](https://daily.dev/posts/passwords-are-dying-here-s-the-tech-that-s-replacing-them-3oigsvibi) · TechCentral · 1 upvotes · 0 comments - [Every day in every way, passwords are getting worse](https://daily.dev/posts/every-day-in-every-way-passwords-are-getting-worse-dzpbbkuto) · The Register · 0 upvotes · 0 comments - [Passkeys are a trap. Do not use them](https://daily.dev/posts/passkeys-are-a-trap-do-not-use-them-baofhwveg) · Hacker News · 1 upvotes · 0 comments - [39 New Methods That Compromise Passkey Authentication](https://daily.dev/posts/39-new-methods-that-compromise-passkey-authentication-z1hysnxm6) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#secrets-management](https://daily.dev/tags/secrets-management), [#pki](https://daily.dev/tags/pki) [View this post on daily.dev](https://daily.dev/posts/why-it-is-time-to-get-rid-of-passwords-in-our-infrastructure-rsum1uepd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Why it is time to get rid of passwords in our infrastructure","url":"https://daily.dev/posts/why-it-is-time-to-get-rid-of-passwords-in-our-infrastructure-rsum1uepd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/why-it-is-time-to-get-rid-of-passwords-in-our-infrastructure-rsum1uepd"},"datePublished":"2026-08-23T12:19:05.390Z","dateModified":"2026-08-23T12:31:01.631Z","description":"An opinion piece argues that passwords—including plain-text credentials, long-lived tokens, API keys, and SMS-based second factors—need to be eliminated from...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/why-it-is-time-to-get-rid-of-passwords-in-our-infrastructure-rsum1uepd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,secrets-management,pki","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Why it is time to get rid of passwords in our infrastructure"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/why-it-is-time-to-get-rid-of-passwords-in-our-infrastructure-rsum1uepd#faq","mainEntity":[{"@type":"Question","name":"Why are password managers and vaults not a good long-term solution for infrastructure security?","acceptedAnswer":{"@type":"Answer","text":"Password managers and vaults consolidate many credentials behind one root password or storage system, creating a single high-value target for attackers. Once an API key or token is pulled from a vault, there is no way to track how it is copied, used, or stored afterward, and vaults still store secrets in plain text once mounted, undermining the security they promise. Developers weighing secrets-management strategies can track evolving authentication practices on daily.dev."}},{"@type":"Question","name":"Why are short-lived certificates considered better than API keys or passwords for service-to-service authentication?","acceptedAnswer":{"@type":"Answer","text":"Short-lived certificates encode a unique identity per service, enabling fine-grained access control, and can expire in as little as 5 minutes without needing revocation. Certificates can also be scoped to a specific IP, container, or region, and because they use public key infrastructure, a private key never has to leave or be persisted on the service, making them far harder to steal or replay than static credentials. Teams designing zero-trust infrastructure can follow certificate-based authentication approaches on daily.dev."}},{"@type":"Question","name":"Why is SMS-based two-factor authentication considered a weak security method?","acceptedAnswer":{"@type":"Answer","text":"SMS relies on insecure communication channels vulnerable to SIM swapping and social engineering, letting attackers intercept one-time codes without needing to breach the underlying service. It also fails to verify a user's physical presence or identity, making it fundamentally comparable to a plain password rather than a true second factor. Engineers hardening login flows can compare authentication factor tradeoffs on daily.dev."}}]} ```