Go Passwordless for Seamless, Zero-Trust Access

A passkey is a phishing-resistant authentication method based on public-key cryptography (FIDO2/WebAuthn). Unlike passwords, passkeys do not rely on shared secrets. A private key is securely stored on the user’s device, while OpenVPN stores only a public key for verification. Since the private key never leaves the device, it cannot be phished, reused, or stolen.

Yes, passkeys can be used to access both your CloudConnexa Portal account and your WPC when CloudConnexa is configured for local authentication. This allows users to authenticate using their biometrics or a device PIN instead of a password when managing their WPC settings and connecting to their business VPN.

No. If a WPC is configured to use external SAML or LDAP authentication, Admins and other users cannot enroll in or use passwordless authentication.

No. Passwordless authentication is optional and requires individual user enrollment. To enroll:

• Log in to your CloudConnexa Admin or User Portal
• Go to My Account > Security & Privacy tab > Passwordless Authentication section
• Click Add a Passkey

Zero Trust frameworks emphasize strong, phishing-resistant identity verification and minimizing attack surface. Passkeys eliminate passwords—the most commonly exploited identity vector—and provide phishing-resistant MFA rooted in public-key cryptography. This directly supports Zero Trust principles such as verify explicitly and assume breach, and aligns with guidance from NIST SP 800-207 and CISA’s Zero Trust Maturity Model.

Passkeys eliminate or significantly reduce:

• Phishing and credential theft
• Credential stuffing and password reuse attacks
• Brute-force attacks
• MFA fatigue and push phishing
• Man-in-the-middle credential interception

Users can log in from their new device using their existing credentials (username and password), remove their old passkey, and register a new passkey for their existing device.