Topic starter
07/03/2026 1:04 am
TL;DR: Bot traffic accounted for over 25% of all website traffic in 2020, while 28% of bots self-reported as mobile users, according to Beyond Identity. The core security shift is that removing passwords closes a major automation path, but only if recovery and fallback flows also avoid reusable secrets.
Editorial analysis by NHI Mgmt Group, based on content published by Beyond Identity: “Stop Bot-Executed Credential Attacks with Passwordless Authentication”.
By the numbers:
- Bad bot traffic accounted for over 25% of all website traffic in 2020.
- Over 28% of bots self-report as mobile users.
Key questions
Q: What breaks when a passwordless login still relies on fallback secrets?
A: A passwordless label becomes misleading if recovery still depends on passwords, reset tokens, OTPs, or magic links that bots can replay or predict.
Q: Why do password-based logins remain attractive to bot operators?
A: Passwords are reusable, testable at scale, and easy to automate against with stolen or generated credentials.
Q: What signs show that bot controls are not enough on their own?
A: High login success against known-risk flows, repeated credential guessing, and abuse concentrated in account recovery are signs that automation is finding a valid identity path.
Practitioner guidance
- Eliminate reusable secrets from recovery Remove passwords from recovery, reset, and fallback workflows so the account cannot be re-secured through a secret that bots can replay or guess.
- Test the full passwordless journey Review sign-in, account recovery, and exception paths together to confirm that no hidden password field, OTP fallback, or magic-link reset reintroduces the same attack surface.
- Add device posture to login decisions Use rooted or jailbroken status, patch level, and similar signals to deny access or require step-up when mobile device trust is low.
Bottom line: Passwordless authentication reduces bot-driven takeover only when it removes the reusable secret from both sign-in and recovery.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 5:04 pm
Passwordless only changes the risk model when it removes the secret, not when it hides it. The article's core security claim is that credential stuffing and brute force lose their primary target when the password disappears from both authentication and recovery. That distinction matters because many organisations brand a flow as passwordless while preserving the same dependency behind reset links, fallback factors, or account recovery. The practitioner conclusion is that the control boundary must include the full credential lifecycle, not just the login page.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
A: Security teams should treat passwordless access as one control in a broader decision layer, not as proof that access is safe. Real-time risk signaling should continuously evaluate device, user, and session context, then trigger step-up checks or block actions when behavior changes. This is especially important on shared devices, where workflow speed and identity assurance must stay aligned.
👉 Read our full editorial: Passwordless authentication reduces bot-driven account takeover risk