Passwordless: a story of risk, protection and excellent UX
summary
ThoughtWorks runs a live experiment with 120 volunteers (now growing) replacing passwords with FIDO2/WebAuthN plus Okta Verify for step‑up, registering device private keys and using device biometrics. Implementation uses existing SaaS IDP, costs near zero, and yields almost no password reset activity — trial users report “best ever” and many say they can’t imagine going back. Gotchas include inconsistent browser support, some CLI/AWS flows still requiring passwords, and the habit of maintaining a compliant fallback password.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 1:43Context
- 2:27Outline
- 3:05Passwords
- 6:27How can I stop you
- 8:38Password managers
- 10:35What is passwordless
- 11:42How does it work
- 13:45How different is passwordless from MFA
- 14:57Benefits of passwordless
- 16:02End users
- 16:21The catch
- 17:57Our experience
- 19:43What is 502 and WebAuthen
- 21:34What is an adaptable signin policy
- 22:50Hypothesis driven design
- 23:59Test design
- 26:14Volunteers
- 27:13Things we learned
- 29:51Survey results
- 30:24Customer quotes
- 34:29Wrap up
- 35:48Where are we
- 38:06Questions
related talks
34mPasswordless: a story of risk, protection & excellent UX
38mJourney to passwordless
47mPasswordless Web
41mUsing FIDO authentication to defend against account takeover
30mGoing Beyond Passwords: The Future of User Authentication
38mPasswords Are Dead, Long Live Passwords!
47mPasswordless in PAM: Myth or Reality?
05m“You still use the password after all” – Exploring FIDO2 Security Keys in a Small