Topic starter
24/06/2026 10:49 pm
TL;DR: Passwordless authentication is presented as the next step beyond password-based MFA because phishing, OTP interception, MFA fatigue, and SIM-swap attacks still exploit the weakest factor, according to Imprivata. The practical shift is not just better user experience but phishing-resistant identity design built around device-bound keys and local verification.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Einleitung: MFA ist nicht gleich Sicherheit”.
Key questions
Q: How should security teams phase out MFA-only login strategies?
A: Start with the accounts and workflows most exposed to phishing, credential stuffing, or helpdesk abuse.
Q: Why do passwords and OTPs still create risk in MFA programmes?
A: Because both can be intercepted, reused, or coerced.
Q: What are the signs that a passwordless deployment is not actually enforcing strong authentication?
A: A weak deployment often shows up when user verification is optional, when the identity provider does not enforce it, or when the relying party has no attestation data to assess device trust.
Practitioner guidance
- Replace password-first login paths Remove password-centric primary authentication from applications that support FIDO2, passkeys, or other phishing-resistant methods.
- Eliminate weak fallback channels Review SMS, email code, and push-approval fallback paths for critical accounts, then remove or tightly restrict the ones that still allow phishing, SIM swap, or MFA fatigue abuse.
- Bind authentication to managed devices Use device-bound credentials and local verification for high-value users so the private key stays non-exportable and the relying party can verify origin-bound authentication.
Bottom line: Password-based MFA reduces risk, but it does not eliminate the attack patterns that target reusable credentials and weak fallback factors.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:39 am
Password-centric MFA is a mitigation, not a trust reset. The article shows that password plus second factor still depends on a reusable credential that attackers can phish, steal, or replay. That means the programme may improve hurdle height while preserving the same attack surface. For identity teams, the decision is no longer whether MFA exists but whether the authentication model still allows a stolen secret to remain useful.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What should IAM teams prioritise when legacy systems do not support passkeys well?
A: Prioritise the applications that matter most to security and user friction, then use phased rollout and compatibility testing to isolate where legacy constraints are unavoidable. The goal is to prevent old systems from becoming permanent exceptions that preserve password dependence. If the legacy layer cannot be modernised immediately, govern its fallback tightly and separately.
👉 Read our full editorial: Passwordless authentication exposes the limits of MFA-only strategies