More from this creator
Other episodes by Liam Blaine.
More like this
If you liked this, try these.
Transcript
The full episode, in writing.
Passwordless authentication is a digital security method where a user is verified without entering a traditional password. Instead of requiring a secret string of characters, passwordless authentication relies on different categories of proof: something you have, something you are, or a combination of both. Popular mechanisms include biometrics like fingerprints and facial recognition, hardware tokens such as USB security keys, one-time codes sent to a mobile device or email, and cryptographic passkeys stored securely on devices. In practice, a typical passwordless flow asks a user for their username or email, then prompts a secure interaction—like a fingerprint scan or tapping a hardware key—to confirm their identity.
These systems often use public-key cryptography, where a unique key pair is generated during registration. The private key stays on the user’s device, protected by a biometric check or device authentication, while the public key is stored by the service. When logging in, the server sends a challenge that the device answers by signing it with the private key. The server verifies the signature using the public key, granting access only if this cryptographic proof matches what was registered. Because there’s no password to enter or transmit, attackers have nothing to steal, intercept, or phish in the traditional sense.
Biometric systems, such as those using fingerprints or facial recognition, rely on inherent user characteristics—“something you are.” Hardware tokens and smart cards represent “something you have.” One-time passcodes, commonly sent via SMS or email, are also categorized as something you have, though they are less secure than hardware tokens due to the risk of interception. Some systems combine these methods, offering multi-factor passwordless authentication for additional security.
Traditional passwords have dominated digital authentication since the earliest days of networked computing. For decades, users were required to create, memorize, and periodically update passwords to access everything from email to banking services. By 2012, the average person managed around 25 passwords, split between personal and work accounts. This proliferation led to widespread password fatigue. Many people resorted to weak passwords, reused the same ones across multiple sites, or scribbled them down in insecure places. Attackers exploited this behavior using tactics like credential stuffing, dictionary attacks, and phishing.
Major password-related data breaches revealed the scale of the problem. In 2013, Adobe suffered a breach affecting 36 million user accounts. The following year, eBay lost control of databases containing information on 145 million users. In that same period, JP Morgan Chase faced a breach that exposed data on 76 million households and 7 million small businesses. Each of these events demonstrated how attackers could compromise millions of accounts by targeting poorly protected passwords, often relying on reused or easily guessed credentials.
To help users manage the explosion of required passwords, password managers like Dashlane and LastPass grew in popularity. These tools store and encrypt passwords, generate strong random credentials, and autofill them on websites or apps. Yet password managers themselves became lucrative targets. In 2015, LastPass was breached, exposing encrypted user vaults. Attackers focused their brute-force efforts not just on individual accounts, but on these central repositories, betting that a single successful crack would yield access to hundreds of credentials.
In June 2026, Dashlane responded to a surge in brute-force attacks by suspending customer accounts. The move aimed to protect users from compromise, but it also highlighted an ongoing risk: even as the industry shifts away from passwords, legacy systems and support tools remain vulnerable. Attackers keep adapting, pivoting to exploit whatever password-based weaknesses persist in modern security ecosystems.
Interest in moving beyond passwords has deep roots in the technology sector. In 2004, Microsoft founder Bill Gates predicted at the RSA Security Conference that passwords could not “meet the challenge” of securing critical information. His statement came years before some of the largest breaches, yet accurately foreshadowed the growing doubts about password-based security. By 2020, the Wikipedia article on passwordless authentication reflected this momentum, documenting a growing wave of adoption and research into alternatives across both consumer and enterprise platforms.
The FIDO2 WebAuthn standard, adopted by Apple, Microsoft, and Google in 2022, marked a key industry turning point. FIDO2 enables passwordless sign-ins through secure device-based authentication, using biometrics or security keys to generate cryptographic proofs. Companies rapidly integrated this standard into their products and operating systems. Windows Hello, Apple Face ID, and Google’s security key integrations all rely on FIDO2 to provide secure and convenient login experiences.
Passwordless systems offer three main advantages over traditional passwords. First, they reduce the risk of phishing. Without passwords to steal, attackers cannot trick users into handing over access credentials. Second, passwordless authentication streamlines the user experience. People no longer need to remember or manage dozens of passwords, nor deal with frequent reset prompts and complex password policies. Third, these systems shift authentication to highly secure factors, such as a biometric scan or possession of a hardware token, which are much harder for attackers to replicate or intercept.
Despite the promise, passwordless adoption brings new challenges. Device loss is a major concern: if a user loses their phone or hardware token, they may become locked out of their accounts. Recovery processes must be carefully designed to avoid introducing new security holes while remaining user-friendly. Biometric spoofing is another risk. Attackers have demonstrated the ability to trick some fingerprint or facial recognition systems using high-resolution images or synthetic fingerprints, though modern sensors and anti-spoofing technologies continue to improve.
Implementation costs also represent a barrier to entry for organizations. Deploying new authentication hardware, updating legacy systems, and training staff require upfront investment. Some companies choose hybrid models, keeping passwords as a fallback while offering passwordless options for users ready to make the switch. This transitional phase is necessary to accommodate diverse user needs and legacy applications, but it creates complexity for IT administrators and security teams.
Reduced IT costs are a major motivation for organizations considering passwordless systems. Without the need to reset forgotten passwords, enforce ever-changing password policies, or store large databases of sensitive password hashes, companies can reduce help desk workloads and the risk of costly breaches. Credentials tied to a specific device or biometric become much harder to abuse at scale, tightening access control and reducing the window of vulnerability when someone leaves a company or changes roles.
User education remains a hurdle. Many people are unfamiliar with concepts like cryptographic passkeys or the security benefits of hardware tokens. For widespread adoption, companies must guide users through new authentication flows and address concerns about privacy, especially with biometrics. Some users have reservations about storing fingerprint or facial data, even when it never leaves their personal device.
The move away from passwords is a gradual, iterative process. As of the most recent reporting on record, both password-based and passwordless systems coexist—sometimes protecting the same accounts. The industry continues debating the best approaches, weighing the upsides of security and convenience against the operational risks and costs of new technology. But each high-profile breach and each round of brute-force attacks pushes more organizations and individuals to reconsider the reliance on passwords.
The passwordless future is not without friction. In June 2026, Dashlane’s account suspensions in response to brute-force attacks underscored the reality that legacy password-based systems and the tools built to manage them are still in the crosshairs. Even as tech giants adopt open standards like FIDO2 and push for device-based authentication, persistent risks in password management remain, creating a patchwork of security practices across the digital landscape.