Understanding Passwordless Authentication

Background

Passwords have been the primary method of authentication for decades, but they remain a common target for threat actors. Password theft through phishing, credential stuffing and data breaches continues to contribute to account compromise.

Passwordless authentication offers an alternative by reducing or eliminating reliance on passwords and using cryptographic credentials or trusted devices to verify users’ identities. They can be implemented using different technologies, each offering varying levels of security and user convenience. FIDO-based authentication, including passkeys and hardware security keys, provides the strongest protection against phishing attacks.

Why Move Beyond Passwords?

There are several well-known challenges when using passwords to secure devices and online accounts. Common threats faced are:

• Phishing websites that steal passwords

• Credential stuffing using passwords leaked from previous data breaches

• Credential-stealing malware installed on a device may capture passwords stored in browsers, record keystrokes or harvest saved credentials

• Weak or predictable passwords

• Password reuse across multiple services

• Password fatigue leading to unsafe behaviours

Even when combined with Multi-Factor Authentication (MFA), passwords remain vulnerable to sophisticated phishing attacks that can trick users into revealing both their password and one-time passcodes.

Passwordless authentication significantly reduces these risks as it does not rely on the use of passwords as part of the authentication process.

What is Passwordless Authentication?

Passwordless authentication refers to methods of verifying users’ identities without requiring them to enter a traditional password during sign-in.

Instead of relying on something a user knows (a password), passwordless authentication relies on one or more of the following:

• Something the user has (e.g. a trusted device or security key)

• Something the user is (e.g. fingerprint or facial recognition)

• Cryptographic credentials securely stored on a trusted device

These methods reduce many of the risks associated with passwords while improving usability.

Types of Passwordless Authentication

There are several passwordless technologies available in the market today but not all passwordless authentication methods provide the same level of protection.

 Although several passwordless methods exist, passkeys are increasingly being adopted because they combine strong security with ease of use across consumer and enterprise services.

What are Passkeys?

The use of passkeys is a modern authentication method based on the FIDO2 and WebAuthn standards.

When a passkey is created, a unique public-private key pair is generated.

• The private key remains securely stored on the user's device.

• The public key is stored by the online service.

Because the passkey is cryptographically bound to the legitimate website, users cannot unknowingly submit their authentication credential to a phishing website.

Benefits of Passwordless Authentication

For Individuals

• Easier sign-in experience

• No passwords to remember

• Reduced risk of phishing

• Reduced impact of password leaks

• Less password reuse

• Faster authentication

For Organisations

• Reduced risk of account compromise

• Improved resistance to phishing attacks

• Lower password reset requests and associated helpdesk costs

• Better user experience

• Supports modern identity and Zero Trust strategies

• Simplifies user authentication while strengthening security

Residual Risks

Although passkeys significantly improve authentication security, they do not eliminate every cyber risk as attackers can still hijack authenticated sessions and exploit processes that occur after legitimate authentication has been completed. Therefore, passkeys should be combined with other security measures to provide stronger overall protection.

For example:

• Malware on a compromised device may abuse an authenticated session.

• Attackers may steal session cookies after successful authentication and use them to gain unauthorised access.

• Weak account recovery processes may be exploited to bypass the protections provided by passkeys.

• Users may still be deceived through social engineering techniques that manipulate them into revealing sensitive information or performing actions that compromise their accounts.

What is Required to Implement Passwordless Authentication?

For Individuals

Before enabling passkeys, ensure that:

• Your device supports passkeys (e.g. recent versions of iOS, Android, Windows or macOS)

• Your preferred online service offers passkey support

• You have configured a device PIN or biometric authentication

• You have a recovery method available in case your primary device is unavailable

For Organisations

Before deployment, organisations should consider:

• Whether their identity provider supports passwordless authentication (e.g. passkeys, FIDO2 or Windows Hello)

• Compatibility with existing applications and services

• Secure account recovery procedures

• User awareness and training

• Support for legacy systems during migration

Key Takeaway

Passwordless authentication represents a significant improvement over traditional password-based authentication but it should not be viewed as a standalone security solution.

By combining passkeys with good cybersecurity practices, individuals and organisations can substantially strengthen their resilience against modern cyber threats while benefiting from a more secure and convenient authentication experience.

Frequently Asked Questions

Does passwordless authentication eliminate passwords completely?

Not always. Some services retain passwords for account recovery or compatibility purposes. However, users should not need to enter them during routine sign-in.

Are passkeys more secure than passwords?

Passkeys provide stronger protection against phishing and credential theft because there is no password for attackers to steal or trick users into revealing.

Can attackers steal a passkey?

The private key remains securely stored on the user's device and is not transmitted to the website. Attackers cannot obtain the private key simply by intercepting authentication traffic.

Are passkeys vulnerable to phishing?

Passkeys are highly resistant to phishing because they are cryptographically bound to the legitimate website. Authentication requests from fake websites cannot successfully use passkeys registered for another domain.

What happens if I lose my device?

Most services provide recovery options, such as synchronised passkeys across trusted devices or account recovery procedures. Users should register multiple trusted devices where supported.

Do passkeys eliminate all cyber risks?

No. Organisations and individuals should continue implementing layered cybersecurity measures, as threats such as malware, session hijacking, insider misuse and social engineering remain relevant.

References

https://www.tech.gov.sg/media/singpass-launches-passkeys-a-safer-login-method/

https://www.ncsc.gov.uk/passkeys

https://fidoalliance.org/passkeys/

https://learn.microsoft.com/en-us/entra/identify/authentication/concept-authentication-passkeys-fido2?utm

https://cloudsecurityalliance.org/blog/2023/06/22/passkeys-zero-trust