Alrite, Bruv! Quick quiz. What is the most common password in 2026? If you guessed “123456,” you are close. If you guessed “password,” you are also close. If you guessed “a complex mix of your pet’s name, your birth year, and an exclamation point because the website demanded a special character” — congratulations, you are every human on Earth.
We have facial recognition. Fingerprint scanners. Hardware security keys. Passkeys that use cryptographic magic to log you in without you ever typing anything. And yet, somewhere out there, someone is still using “password123” for their banking app. Why? Because passwords are terrible, but everything else is either inconvenient, expensive, or not universally supported. Let us dive into the mess.
The Password Paradox
Security experts have been telling us for years: use a unique password for every account. Make it long. Make it random. Use a password manager. Do not reuse passwords. Enable two-factor authentication. This is excellent advice that almost nobody follows because humans have approximately 150 online accounts and a brain that evolved to remember where the berry bushes are, not 150 unique strings of random characters.
The result: we reuse passwords. We use variations of the same password. We write them down on sticky notes. We store them in unencrypted Notes apps. We do everything the security experts tell us not to do, not because we are stupid, but because the system is fundamentally at odds with human psychology. Asking a human to memorise 150 unique complex passwords is like asking a cat to file your taxes. It is not going to happen.
The Alternatives (and Why They Have Not Won)
Biometrics? Your face and fingerprint are great — until you need to log in on someone else’s device, or share an account with a family member, or access something after you have been swimming and your fingers are pruney. Passkeys? Brilliant technology, but they require both the website and your device to support them, and in 2026 we are still in the awkward transition phase where half the internet supports passkeys and half still demands you create a password with “at least one uppercase letter, one number, and the blood of a unicorn.”
Hardware keys like YubiKey are secure but cost money and can be lost. SMS two-factor codes are better than nothing but can be intercepted. Authentication apps are good but add friction. Every alternative to passwords is either less convenient, more expensive, or less universal. And convenience always wins.
The Malaysian Edition: TAC Codes and the Maybank2u Experience
Malaysians have a special relationship with authentication. If you have ever tried to log into a Malaysian banking website, you know the ritual: username, password, TAC code sent to your phone, security image verification, answer a security question you set up in 2014 and have completely forgotten the answer to, and then — maybe — you are allowed to see your account balance. It is secure. It is also the digital equivalent of passing through 17 security checkpoints to enter your own house.
And yet, despite all these layers, the weakest link remains the same: the human who will click on a phishing link, who will share their TAC code with a scammer pretending to be bank support, who will reuse their nasi lemak-themed password across 47 different websites. The technology gets better every year. The humans stay the same. This is not a technology problem. This is a human nature problem. And human nature does not get security patches.
