Page 243 - Cyber Defense eMagazine September 2025
P. 243
Passwordless, but Not Riskless
Passwordless Authentication
By Sudhakar Tiwari, Principal Solutions Architect, Zurich
Modern enterprises are racing toward passwordless authentication, especially passkeys built on
FIDO2/WebAuthn, to end the pain of passwords: fewer resets, far less reuse, and strong resistance to
classic phishing. It’s a worthy goal. But as any seasoned CISO will tell you, no authentication scheme is
a magic shield. Passwordless dramatically shifts risk it doesn’t eliminate it. Done right, it raises the
security bar and improves UX. Done casually, it opens new blind spots. This piece explains why
passwordless ≠ panacea, highlights the new attack surfaces, and offers practical safeguards so you can
reap the benefits without inheriting avoidable risk.
The Allure and the Reality of Passwordless
Passwords remain a top cause of breaches; attackers monetize guessable, reused, and phished secrets
at scale. Passkeys replace shared secrets with public-key cryptography: a device-bound private key stays
Cyber Defense eMagazine – September 2025 Edition 243
Copyright © 2025, Cyber Defense Magazine. All rights reserved worldwide.
