Could Passwordless be Worse than Passwords?

The talk asks whether passwordless login, including WebAuthn-based passkeys, security keys and biometrics, can end up less secure than the passwords it replaces. It begins with background on what passwordless means, how magic links and one-time codes differ from it, and why large vendors are pushing it. The speaker then argues that the protocol is rarely the weak point; the surrounding web application is.

Several real flaws are walked through. In one case the server accepted a username in a registration request that the client could change, letting an attacker attach a new device to another account, including an executive's. A magic-link flow exposed admin access through a simple change to the URL, and a multi-step challenge flow allowed parameter tampering that logged a user in as someone else. A demo application also let attackers register devices to existing accounts because it never checked whether a user already existed.

The closing advice targets developers, testers, enterprises and end users. Developers should validate every value server-side rather than trusting what the specification passes through, and protect every endpoint. Testers should focus on parameter tampering and unauthenticated APIs instead of the cryptography. Organizations should question vendors about testing, bug bounty programs and disclosure. Users have little defence against device-adding attacks, and account recovery often still falls back to passwords, a gap that remains open.