Passwordless authentication: how it works, methods, and limits
What passwordless authentication is, how it works, the main methods from passkeys to magic links, its benefits and limits, and where device signals fit.
Pavel Nuryieu is Head of Research at ShieldLabs, where he studies how anti-detect browsers, proxies, and other anonymity tools work, and how detection keeps pace. He has spent close to a decade researching device fingerprinting and online fraud techniques.
Pavel Nuryieu's articles
Account recovery fraud: how attackers take over accounts through the reset flow
Account recovery fraud is how attackers bypass strong login by abusing the reset flow. How it works, why recovery is the weak point, and how to defend it.
Trial farming and credit farming on AI products: how one operator drains your free credits
What trial farming and credit farming mean on an AI product, not the gaming kind: how one operator drains free compute credits, and where it is caught.
Device-based authentication: recognizing the trusted device behind a login
What device-based authentication is, how recognizing a trusted device makes login transparent, how it differs from passkeys and cookies, and where it fits.
Adaptive authentication: the device signal that decides when to step up
How adaptive (risk-based) authentication works, the signals it weighs, and how a recognized device decides when to step up and when to let a user through.
How to prevent free-trial abuse without losing real customers
How to prevent free-trial abuse: what it costs you, the signals that flag a recycled trial, and a playbook to stop it at signup without blocking real users.
How ban evasion detection works: re-identifying returning banned users
How ban evasion detection works: why account-only bans fail, and the signals that re-identify a returning banned user behind a brand-new signup.
How to detect anti-fingerprint browsers (2026)
Anti-fingerprint browsers spoof canvas, WebGL, fonts, and TLS to break recognition. How to detect them in 2026, and the tells they leave behind.
Browser spoofing: what it is and how spoofed browsers give themselves away
What browser spoofing is, what attackers fake (user agent, OS, screen, timezone), and how a spoofed browser betrays itself through signals that disagree.
How to detect Tor traffic without blocking real users
Detecting Tor traffic is easy because exit nodes are public. The hard part is acting on it without blocking real users. How web detection actually works.
What is WebGL fingerprinting? How the GPU gives a device away
WebGL fingerprinting identifies a device by how its GPU renders 3D graphics. How it works, what it reveals, and how it differs from canvas.
What is font fingerprinting? How your installed fonts identify you
Font fingerprinting identifies a device by which fonts are installed, read from how text renders. How it works, what it reveals, and how stable it is.