Planning for a "Passwordless" future

Passwords have been effectively obsolete for decades, yet remain widely used and heavily exploited, with credential lists traded cheaply on the dark web. Beyond security weaknesses, passwords impose substantial operational cost: password resets are estimated at $50–$70 each, and password-related issues can account for up to 80% of help desk interactions. Because password authentication is largely binary—once accepted, the user is simply “in”—traditional systems often fail to incorporate risk, context, or device health into access decisions, regardless of system sensitivity. Passwordless authentication is presented as a viable way to reduce user friction while improving security, enabling stronger trust signals about the user-device link and supporting broader initiatives such as Zero Trust, Software Defined Networking, and work-from-anywhere strategies.

Passwordless works by avoiding static shared secrets that can be captured or replayed, relying instead on possession factors, inherent (biometric/behavioral) factors, and device-protected keys unlocked locally (PIN/biometric). Crucially, the person-to-device authentication does not traverse the network, and implementations can add contextual intelligence such as geolocation, patch level, AV status, rooting/jailbreak signals, and running processes. The document emphasizes adaptive and continuous authentication—combining context (what/when/where/why), behavioral patterns, and device signals—to trigger step-up checks only when risk warrants, and to downgrade or revoke access when conditions become anomalous.

Strategically, success depends on retiring legacy methods rather than adding “one more” factor, planning staged rollouts across on-prem and cloud systems, addressing BYOD realities, training, third-party access, onboarding/offboarding integration, resilience (single point of failure), and “break-glass” recovery. It also cautions against passwordless hype, SMS weaknesses, and vendor lock-in (“locus-of-control”) approaches.

• Password resets are estimated to cost between $50 and $70 each.
• Up to 80% of help desk interactions can involve a password issue.
• Credential lists containing usernames and passwords are traded for a few cents on the dark web.
• Password authentication is generally binary: once accepted, the user is treated as fully authenticated.
• Many consumer biometric logins still fall back to a password.
• Adaptive authentication can use location and time anomalies as indicators of potential identity compromise.
• Fingerprints do not guarantee a 1:1 match to a particular person; they match against stored prints.
• A smartphone-based passwordless approach can depend on an always-on data connection, which may be unavailable when roaming or in coverage “not-spots.”
• In 2018, 17% of organisations provided mobile phones to all employees, 52% provided them to some, and 31% relied entirely on BYOD.
• The UK NCSC warns of critical failings and exploits in SMS messages used in critical business processes.

• “The whole notion of passwords is based on an oxymoron. The idea is to have a random string that is easy to remember. Unfortunately, if it's easy to remember, it's something non-random like 'Susan.' And if it's random, like 'r7U2*Qnp,' then it's not easy to remember.”
• “Context is key!”
• “I changed all my passwords. I have no two passwords that are the same for any service online. I have two-step verification enabled on all my devices...so yeah, I did take some extra steps that I hadn't taken before being exposed to this world.”
• “The danger is that all the existing authentication methods remain and the result is just ‘one-more’ authentication system into the mix for you to manage and for people to interact with!”
• “Step-up authentication only requests a further level of security check when the risk-tolerance for the transaction being undertaken demands it.”
• “If we're going to remove the shared secret (password) then it is critical that we have higher levels of both trust in, and visibility of, the authentication ecosystem.”
• “Users want to take the path of least resistance.”
• “The aim should be to remove/retire (and thus save money) the disparate MFA systems currently in use.”
• “What is your ‘break-glass’ strategy; in the event of complete failure, how will you gain access to your systems?”
• “Finally, be critical of the ‘Passwordless’ hype - it is critical to ensure a vendor's solution is a good fit for your organisation.”