Why Your Next Login Won’t Even Need a Password
As cyberattacks grow more sophisticated and costly, enterprises are reassessing one of the weakest links in digital security: passwords. A recent whitepaper by Richard Greene, accepted by the SANS Institute in November 2024, explores how passkeys - based on public key cryptography - offer a promising replacement for traditional passwords, delivering superior security, better user experience, and regulatory advantages.
A new era of authentication
Passkeys are a modern authentication method grounded in public key infrastructure (PKI), where users authenticate via a private key stored securely on their device and a public key held by the service provider. Unlike passwords, these keys are never reused, never transmitted, and never stored in centralized databases vulnerable to leaks. This makes passkeys highly resistant to phishing, brute-force password attacks, and credential stuffing.
Major players, including Apple, Google, and Microsoft, support the technology under the FIDO2 and WebAuthn standards. With cross-platform support growing, passkeys are becoming a viable enterprise-wide solution, not just a consumer convenience.
Major benefits over passwords
Passwords remain vulnerable to a range of threats like phishing, credential reuse, weak password selection, and storage breaches. Greene's paper outlines how passkeys mitigate these issues by eliminating shared secrets. During authentication, the user's device signs a unique challenge using their private key, which is never exposed. Even if an attacker clones a login page, the cryptographic process makes replay or reuse attacks infeasible.
Passkeys also cut operational costs. Password-related help desk tickets are among the most common in enterprise IT. By removing passwords entirely, companies can reduce both user frustration and support overhead. This also supports compliance with regulations like GDPR and CCPA, which penalize the mishandling of personal data like stored credentials.
Real-world use cases and testing
Greene cites enterprise use cases where passkeys can improve phishing protection, especially in sectors with high security stakes like finance and healthcare. In one demonstration, a cloned Google login page harvested credentials from users, even when password managers generated those credentials. Passkeys rendered this attack ineffective, since no private key leaves the user’s device or can be phished.
They also help prevent insider threats and unauthorized access. Because passkeys are tied to a user's device and often require biometric input, they’re nearly impossible to share or misuse.
The challenges that remain
Even with clear benefits, switching to passkeys can be a challenge. Greene points to three main hurdles: teaching users how they work, connecting them to older systems, and finding ways to recover accounts if something goes wrong.
Many employees have never used passkeys before. They typically type passwords or getting codes by text. To help with the change, companies need to explain how passkey authentication work and why passkeys are safer and easier.
There are also technical issues. Some older systems don’t support passkeys. Places where people share devices, like hospitals or call centers, might need extra tools or rules to make passkeys work smoothly.
Recovering a lost account is another concern. You can’t just reset a passkey with an email like you can with a password. If someone loses their device, they’ll need to use cloud backups or a hardware key. This recovery process must be secure but also simple enough for people to use.
The path forward
Greene recommends phased rollouts and hybrid environments as a pragmatic path to full adoption of passwordless logins. Enterprises might begin by introducing passkeys to high-risk departments or select applications, while maintaining traditional login options for older systems.
t’s also important to watch for problems. Companies should add passkey logs into their existing security systems. This helps catch unusual behavior, like too many failed login attempts or logins from strange places.
There are many tools to help. Hardware keys from companies like Yubico and free tools like WebAuthn libraries can support a passkey rollout. But success isn’t just about having the right tools; it also takes good planning and strong support from leadership.
A passwordless future
Passkeys offer more than just improved security; they represent a fundamental shift in how enterprises authenticate users. By removing passwords from the equation entirely, businesses can reduce risk, streamline access, and improve compliance. But the road to widespread adoption requires more than technical upgrades - it demands thoughtful implementation, robust education, and long-term commitment.
As Greene concludes, the passwordless future isn’t hypothetical. It’s already underway, and enterprises that act now will be the first to reap the rewards.
Want to read more about the latest upgrades in the technology sector? Check out this article on how Chrome just fixed annoying pop-ups.
