Passwords are gone — magic link + mandatory TOTP is the only way in
Credential stuffing is the top attack vector against SaaS. Removing passwords eliminates the class. Magic link + mandatory TOTP is the primary flow, with passkeys and social login as alternatives. The external portals (DD room, investor portal, vendor portal) use the same passwordless model — no easier back door.
Passwordless authenticationis now the only way to sign in to vCISO Lite. Passwords are gone — not deprecated, not opt-out, gone. The primary login flow is magic link plus mandatory TOTP, with passkeys and social login (Google, GitHub, Microsoft) as alternatives.
Why we did this
Credential stuffing is the top attack vector against SaaS applications, and the platform we’re building holds a customer’s compliance posture, vendor risk register, policy library, and audit-relevant evidence. A stolen password on this platform is a bigger deal than a stolen password on most SaaS products. Removing passwords eliminates the entire attack class.
There’s also an operational argument: with no passwords, there are no password-reset flows to maintain, no forgot-my-password support tickets to triage, no bcrypt hashing infrastructure to audit, no password-complexity rules to argue about, and no leaked-password checks to run against Have I Been Pwned. It’s less code, less surface area, less to break.
What’s live
- Magic link + TOTPas the primary sign-in flow. Magic links are single-use, time-bound (10 minutes), and paired with a TOTP second factor at every sign-in. NIST SP 800-63B recognizes this pattern as multi-factor authentication with high assurance.
- Passkeysas the low-friction alternative for customers whose devices support them. WebAuthn-standard, syncable across a customer’s device fleet, phishing-resistant by construction.
- Social login(Google, GitHub, Microsoft) for customers who’d rather delegate identity to a provider they already trust. Same TOTP gate applies where the provider doesn’t already enforce a second factor.
- Passwordless external portals.The DD room portal for target companies, the investor portal for LP-facing deliverables, and the vendor portal for questionnaire completion all use the same passwordless model — there’s no gap where a less-authenticated external user could get in through an easier door.
For customers with existing password logins, migration happens transparently on next sign-in: enter your email, click the magic link, set up TOTP, done. The old password is invalidated the moment the new factor is set.