Passwordless Authentication

The Problem

Passwords are the weakest link in security:

• 80% of data breaches involve stolen or weak passwords (Verizon DBIR, 2026)
• Phishing works: Users tricked into entering passwords on fake login pages—attacker gets credential, logs in as victim
• Credential stuffing: Users reuse passwords across sites—one breach exposes accounts everywhere
• Password resets cost $70 each (Gartner, 2025)—enterprises with 10,000 employees spend $2.1M/year on helpdesk password support
• Shared passwords: Healthcare shifts share passwords, contractors share accounts—no attribution when breach occurs

Even “strong” authentication is vulnerable:

• 2FA (OTP, SMS): Phishable via man-in-the-middle attacks—attacker intercepts OTP, uses it immediately
• Password managers: Master password is still a password—phish that, access vault
• Biometrics: Server stores template—if breached, user can’t “change” their fingerprint

Why It Matters Now

• Zero Trust Architecture requires cryptographic proof of identity at every access—passwords don’t provide that
• GDPR/CCPA: Storing usernames + passwords = PII risk—passwordless reduces liability
• Cyber insurance: Premiums skyrocket for orgs without phishing-proof authentication
• Remote work: Employees log in from untrusted networks—password phishing attacks surge

The infrastructure exists: W3C Verifiable Credentials for identity attributes, OpenID4VP for presentation flows, Affinidi Vault for secure key storage. The platforms that adopt passwordless authentication first will eliminate their #1 attack vector.

---

How Affinidi Enables Passwordless Authentication

The key shift: Instead of users entering passwords (reusable secrets), they present verifiable credentials (cryptographic proofs):

1. Credential issuance - Organization (employer, university, government) issues W3C Verifiable Credential to user: “This person is an employee with role X”
2. Credential storage - User stores credential in Affinidi Vault on their device—private keys never leave secure enclave
3. Login flow - User visits app, app requests: “Prove you’re an employee.” User presents credential (signed by issuer), app verifies signature
4. No password - App never sees password, doesn’t store password hash. Phishing impossible: attacker can’t steal private key from secure enclave.

All of this works cross-device (credential synced via encrypted backup, not exposed to sync service) and supports selective disclosure (prove “I’m over 21” without revealing birthdate).

Technical Foundation

• Elements Services issues W3C Verifiable Credentials for identity attributes:

  • Employee credentials (role, department, start date)
  • Age credentials (over 18, over 21, etc.)
  • Professional licenses (verified by issuing authority)
  • Access credentials (authorized for system X, expires date Y)

• Affinidi Vault stores credentials on user’s device—private keys in hardware secure enclave (iOS Keychain, Android Keystore, Windows TPM)

• OpenID4VP (Verifiable Presentations) provides login flow:

  • App: “Prove you’re an employee”
  • User: Presents credential (signed by employer)
  • App: Verifies signature + checks issuer via Trust Registry

• Trust Registry (TRQP) validates credential issuers in real-time:

  • “Is this employer authorized to issue employee credentials?”
  • “Is this credential still valid (not revoked)?”

• BBS+ Selective Disclosure lets users reveal only needed attributes:

  • Prove “over 21” without revealing exact birthdate
  • Prove “employee” without revealing salary or department

Example Flow: Enterprise SaaS Login

[User Alice wants to log into Slack]
  ↓
Alice's employer issued credential (stored in Affinidi Vault):
  - Issuer: Company XYZ (did:webvh:company-xyz)
  - Subject: Alice (did:webvh:alice)
  - Role: Engineer
  - Department: Platform
  - Valid until: 2027-07-22
  ↓
Slack login page: "Sign in with verifiable credential"
  ↓
Slack requests: "Prove you're an employee of Company XYZ"
  ↓
Alice's Vault prompts: "Share employee credential with Slack?"
  ↓
Alice approves → Vault creates Verifiable Presentation:
  - Credential: [employee credential]
  - Proof: [cryptographic signature using Alice's DID private key]
  ↓
Slack receives presentation, verifies:
  ✓ Signature valid (Alice's DID signed this)
  ✓ Credential signature valid (Company XYZ issued this)
  ✓ Issuer trusted (TRQP query: Company XYZ authorized to issue employee credentials)
  ✓ Credential not revoked (TRQP query)
  ✓ Credential not expired (valid until 2027-07-22)
  ↓
Alice logged in—no password entered, no password stored
  ↓
Audit log: "User did:webvh:alice (employee credential from Company XYZ) logged in at 2026-07-22T09:15:00Z"

What this means:

• Phishing impossible: Attacker can’t steal Alice’s private key from secure enclave
• Credential stuffing blocked: No password to reuse across sites
• Zero password resets: No password forgotten = no helpdesk calls
• Audit trail: Slack can prove “User Alice, employee of Company XYZ (verified), logged in at timestamp X”
• Real-time revocation: Company XYZ fires Alice → revokes credential → next login blocked instantly

---

Real-World Applications

Enterprise SaaS: Zero Phishing Risk

Problem: Employees use weak passwords or reuse passwords across apps. Credential stuffing attacks succeed—attacker logs into Slack, GitHub, AWS Console with same password.

Solution: HR issues employee credential to each employee (stored in Affinidi Vault). Login to any SaaS app: app requests “prove you’re an employee,” user presents credential, app verifies signature + checks Trust Registry.

Outcome:

• Zero passwords stored—phishing impossible (no password to steal)
• Credential stuffing blocked—no password to reuse across sites
• Password resets eliminated—10,000 employees, $70/reset, 30% reset annually = $210k saved

---

Healthcare (HIPAA): No Shared Passwords

Problem: Clinicians access PHI with passwords. Shared passwords between shifts (written on sticky notes), never rotated. HIPAA audit: “Who accessed this patient record?”—answer: “The shared ‘nurse-station-3’ account.”

Solution: Hospital issues clinician credential with role + department (stored in Affinidi Vault). Login to EHR: present credential with selective disclosure—prove “Nurse in Cardiology” without revealing name.

Outcome:

• PHI access requires cryptographic proof of role—no shared passwords
• HIPAA audit trail: Clinician DID + credential hash + timestamp (prove which clinician, when)
• Real-time revocation: Clinician leaves hospital → credential revoked → next EHR login blocked instantly

---

Remote Workforce (VPN): Phishing-Proof Access

Problem: VPN login with password + 2FA (OTP). Attackers phish both factors—fake VPN login page, victim enters password + OTP, attacker uses both immediately. Account compromised despite “strong” 2FA.

Solution: Company issues employee credential. VPN login: present credential (stored in Vault on device). Cryptographic challenge-response—attacker can’t replay, can’t steal private key.

Outcome:

• Phishing attacks fail: Attacker can’t steal private key from secure enclave
• Zero VPN account compromises—cryptographic proof, not reusable secrets
• IT overhead reduced: No password resets, no “I forgot my VPN password” tickets

---

Age-Restricted Services: Privacy-Preserving Verification

Problem: User proves age by uploading driver’s license to website. Service sees full license: name, address, birthdate, photo, license number. Privacy nightmare—PII stored on server, GDPR liability.

Solution: Government issues age credential with BBS+ selective disclosure. Login to age-restricted service: user proves “over 21” without revealing birthdate, name, or address.

Outcome:

• Service verifies age cryptographically—zero PII stored (no name, no birthdate, no address)
• User privacy preserved—only reveals “over 21” boolean, nothing else
• Compliance with GDPR/CCPA—service doesn’t process PII, no data breach risk

---

Why Affinidi

	Affinidi Passwordless	Passwords + 2FA	Password Managers	Biometrics
Phishing-proof	✓ Cryptographic challenge	✗ 2FA phishable (OTP interception)	✗ Master password phishable	⚠ Depends on implementation
No shared secrets	✓ Private keys never leave device	✗ Password stored on server	✗ Vault syncs (cloud exposure)	⚠ Template on server
User privacy	✓ Selective disclosure	✗ Username = identifier	✗ Vault provider sees metadata	✗ Biometric = identifier
Revocation	✓ Real-time TRQP	⚠ Manual password change	⚠ Manual vault lock	⚠ Device-level only
Standards-based	✓ OpenID4VP + W3C VCs	✗ Proprietary	✗ Proprietary	⚠ FIDO2 (device-bound)

What this means:

• Passwords + 2FA: Still phishable—OTP interception, password reuse, stored on server (breach risk)
• Password managers: Master password is still a password—phish that, access vault. Vault sync exposes to cloud provider.
• Biometrics: Server stores template (if breached, user can’t change fingerprint). No selective disclosure—biometric identifies user, can’t prove “over 21” without full identity.

Affinidi provides cryptographic challenge-response + no server-stored secrets + selective disclosure + real-time revocation—the only architecture that eliminates passwords AND protects user privacy.

Proof It Works

• OpenID4VP - Industry-standard presentation protocol (adopted by EU Digital Identity Wallet)
• W3C Verifiable Credentials - Standard credential format (no proprietary lock-in)
• BBS+ Selective Disclosure - Production-ready zero-knowledge proofs (prove “over 21” without revealing birthdate)
• Affinidi Vault - Open-source wallet with hardware secure enclave (iOS/Android/Windows)

---

Get Started

For Developers

Add passwordless login to your app

Replace username/password form with OpenID4VP flow—credential verification in under an hour.

Start building →

---

For IT Teams

See a live demo of passwordless authentication

Watch employee log in with verifiable credential, see real-time revocation, compare to password flow.

Schedule demo →

---

For Enterprises

Custom deployment consultation

Issue employee credentials at scale, integrate with existing identity providers (Okta, Azure AD), configure Trust Registry.

Talk to an expert →

---

Related Resources

Technical Deep Dives

• Verifiable Credentials - How cryptographically signed credentials work
• Verifiable Presentations - How credentials are shared during login (OpenID4VP)
• Zero-Knowledge Proofs - BBS+ selective disclosure explained

Related Solutions

• Reusable KYC - Verify once, present anywhere—similar credential flow
• Per-Agent Attribution - Audit trails that prove who did what
• Cross-Org Agent Trust - How agents prove identity across organizations

Case Studies

(Coming soon: Enterprise SaaS passwordless deployment)