Authentication is changing, but risk is not disappearing
On August 26, 2026, Singapore’s Cyber Security Agency published guidance on passwordless authentication. Its message is clear: passwords remain a prime target for phishing, credential stuffing, and data breaches, so organisations should gradually adopt more resistant mechanisms.
Passkeys, FIDO2 security keys, and some Windows Hello implementations can replace password entry with a cryptographic proof tied to a device. This is an important change. It does not mean that access management, device security, and sensitive data become safe automatically.
What is passwordless authentication?
With traditional authentication, a service checks a shared secret: your password. If that secret is stolen, reused, or entered on a fake website, an attacker can often sign in.
With a passkey, the service stores a public key while the device keeps the private key. The private key should never be sent to the website. The user unlocks it locally with a PIN, fingerprint, or face recognition, depending on the device.
This architecture makes a phishing page far less useful. The browser checks the expected domain before using the key, so a fake domain cannot simply collect the same secret as it could with a password or copied code.
Three practical benefits for businesses
1. Fewer reusable secrets
Reused passwords are especially dangerous. A breach at one service can open the door to other accounts. Passwordless authentication reduces reliance on secrets that users remember and reuse across services.
2. Stronger phishing resistance
Not every passwordless method offers the same protection. FIDO- and WebAuthn-based mechanisms provide the strongest phishing resistance because authentication is bound to the legitimate domain. SMS codes and approval prompts that users can accept without checking remain more exposed.
3. A simpler user experience
A biometric gesture or local PIN can be faster than entering a complex password. Simplicity also makes it more likely that security policies will be followed in daily work.
What passwordless does not solve
Passwordless authentication mainly protects access to a service. It does not automatically protect every piece of information stored on devices or inside applications.
The device becomes critical
If a computer or phone is compromised, an attacker may try to hijack an open session, install spyware, or access other local data. Updates, disk encryption, automatic locking, and privilege separation remain essential.
Recovery accounts remain sensitive
Losing a device may trigger a recovery process. A backup email address, phone number, recovery code, and provider account must therefore be protected as carefully as the primary account.
Passwords have not disappeared yet
Many services do not support passkeys yet. Teams still need to manage credentials for legacy applications, service accounts, emergency access, and some offline environments.
A realistic five-step strategy
- Start with critical accounts: email, administration, VPN, file storage, and billing.
- Enable phishing-resistant authentication when a service supports FIDO2 or WebAuthn.
- Keep controlled recovery methods and test them before an emergency.
- Reduce privileges and regularly review authorised devices and sessions.
- Store remaining credentials in an encrypted vault available locally and controlled by the organisation.
Passwordless and local-first work together
Passkeys secure the relationship between a user, a device, and a service. A local-first approach answers a different question: where is sensitive data stored?
For a business, these choices can complement each other. Access can be protected with FIDO2, while still-needed credentials remain in an encrypted vault kept on authorised devices, without an unnecessary central copy. The result is less phishing exposure and less data exposure.
The best strategy is not to replace every tool overnight. It is to progressively remove secrets that are easy to steal, protect the devices that replace them, and retain control over the data that still needs to be stored.
