RIP Passwords: Why the Future Is Passwordless – Source: securityboulevard.com

Almost every website, app, and user platform now requires usernames and passwords. And for user data to remain secure, passwords must be strong—most platforms require a mix of upper and lower case letters, numbers, and special characters. 

Many users now employ passphrases so they won’t have to remember different passwords to protect their accounts from cyber threats and hackers. 

Keeping track of multiple passwords or generating endless passphrases becomes quite unwieldy after a while. Fortunately, we are on the path to a bright future of passwordless technology. 

What Is Passwordless Technology?

Passwordless technology is a type of user authentication that does not require the use of a password. 

This is being done in different ways:

Biometrics

Biometric authentication refers to the automated capture of an individual’s unique characteristics, which are then saved and encrypted into a security system. When the user logs in, their biometrics will be recaptured to verify their identity and provide access. 

Biometric authentication can use any of the following body parts:

• Fingerprint
• Palm print
• Face
• Voice

This technology is being leveraged in place of or to supplement simple passwords on smart devices, transport, banking, and more. 

Credentials

Possession-based authentication leverages personal credentials that are unique to the user. They are usually information saved on hardware that only the owner controls. 

Some examples of possession-based credentials include:

• Software tokens
• Soft Token Software Development Kits or SDKs
• Smart cards
• Security keys
• Mobile credentials

Credential authentication is complex and more difficult to compromise. However, malware attacks may lead to access to the hardware where the unique keys are found. 

Email OTPs and SMS

Most websites or apps require users to register an email address or mobile number, often both. Whenever you try to access your account, two-factor authentication will be triggered, and a one-time pin (OTP) will be sent to your mobile number or email address. You must enter the OTP into the login system within a certain period.

Some sites send multiple OTPs or use authentication apps to generate random codes. It should be noted that these methods are discouraged by the OMB, CISA and other agencies as they are susceptible to phishing and interception.

Magic Links

Similar to OTPs, if you have a registered email address or mobile number, the site or app will send a magic link that will give you access to your account. Similar to OTPs, these can pose security risks.

Push Notification

Users receive a push notification to their device, which serves as verification of their identity. When the user clicks the notification, they will gain access to their account.

Benefits of Using Passwordless Technology

According to a study, 90% of internet users are worried that their accounts will be hacked due to weak passwords. Weak passwords have been identified as a leading cause of data breaches in numerous studies.

While a reliable VPN or Cloud DLP can help curb security breaches, protection and security can be improved with passwordless authentication. 

It’s about time sites and apps leverage passwordless technology to protect user data. Here are the benefits of such methods of authentication:

Better Security Protection

Most users only have one password for every site and app that they use. This is a well-known security risk, but many still do it as the alternative is more complicated for them to attempt. 

With hackers becoming more sophisticated by the day, simple or complex passwords are no longer dependable as protection. When a cyber attacker breaches one password, multiple accounts become vulnerable. An individual can lose money or their identity in an instant. And when it happens to a company, it can lead to millions of dollars in losses. 

Reduced Long-Term Costs

Passwords are expensive to manage, according to Microsoft. Why? Because users often forget them, and constantly resetting them leads to a loss of productivity when the user can’t sign in. Based on Microsoft’s experience, there are associated hard costs for every hour the Microsoft Helpdesk administrator helps a single user figure out or reset a password. 

Since rolling out passwordless technology, Microsoft experienced an 87% reduction in soft and hard costs, estimated at $6 million and $3 million, respectively. 

Better User Experience

Most passwordless technologies provide better user experiences. Biometrics, for example, is easy to accomplish each time, with just a touch of a finger or a glance at a camera. Users gain access to their accounts in no time. 

Compliance With Regulatory Bodies

Regulatory bodies like the National Institute of Standards and Technology (NIST) have a set of standards that industry players must satisfy when it comes to access controls in a bid to protect sensitive data. 

The most common requirements are multi-factor authentication, encryption, and hashing. Passwordless authentication will achieve all these and more. When complemented with automatic bot detection and secure session management, it can prevent broken authentication attacks. 

What To Look for in Passwordless Authentication Technology

Now that you know how important passwordless authentication is in the digital age, let’s look at the basic requirements when shopping for solutions. 

MFA for Desktop Login

While much passwordless authentication is used for mobile apps, it is best to look for vendors with multi-factor authentication (MFA) for desktop logins. For one, most employees work with desktops in the office. This is also a legal requirement of the Executive Order on Improving the Nation’s Cybersecurity. 

The work login must be complemented with offline capabilities so employees can maintain access while traveling or working remotely. 

Certifications

Passwordless technology providers obtain specific certifications as proof of their efficacy and credibility. Some of the top certifications for the technology include:

• NIST Authenticator Assurance Level – a NIST authentication process with three levels: AAL1 provides some assurance, AAL2 provides high confidence, and AAL3 provides very high confidence. 

• FIDO Certification – the Fast Identity Online (FIDO) alliance grants certification to validate a product’s conformance and interoperability.

• CISA Certification – the Certified Information Systems Auditor (CISA) certifies companies that audit, control, monitor, and assess an organization’s IT and business systems.

Easy to Deploy

Using brand-new technology could disrupt productivity and may even intimidate employees. Find solutions that are easy to integrate into your operations so you can launch the system as soon as possible. 

Passwordless technology with a robust SDK is easy to integrate. It should have built-in security controls for optimal functionality. 

Are Passwords a Thing of the Past?

Not quite yet, as passwords are still used in many sites and applications. But they are no longer dependable on their own as cybercriminals become more creative and sophisticated in breaching passwords. 

Passwordless technology is no longer a luxury; it is the present. Elevated authentication technology will be the future.

*** This is a Security Bloggers Network syndicated blog from HYPR Blog authored by Guest Post. Read the original post at: https://blog.hypr.com/rip-passwords-why-the-future-is-passwordless