A lot of vendors in the cybersecurity industry offer passwordless solutions. “Passwordless” has become a new keyword, right next to IoT, machine learning, or blockchain. As with any other buzzword, people tend to use it without considering its real meaning. But what does it really mean? Will logins and passwords disappear? What will replace passwords? And how to protect data without passwords?
Plenty of marketing copies have been written about the passwordless future, promising that the time we had to remember complex combinations of words and digits is coming to an end. Is this really the case? Will we switch to an alternative form of authentication? Will biometrics from sci-fi movies replace passwords? Or will some other authenticators create yet another form of passwordless experience for us?
Before we examine the concept of passwordless authentication, let us briefly discuss the first thing people usually have in mind when they think about authenticating without a password: biometric authentication.
While being completely frictionless for the user and probably the most comfortable from all authentication methods, biometrics is very far from being safe. Most biometric authentication methods can be stolen, copied, and abused.
People leave fingerprints on everything. It is extremely easy for a cybercriminal to follow a person, take any object that the victim was using, such as a glass, a pen, or a cellphone, and then copy the fingerprints.
Just like fingerprints, iris patterns can too be copied. In fact, it can be even easier to do, especially if the person has blue eyes. Taking a high-resolution photo of the person can be used to copy their iris patterns and pass the authentication process.
Biometric features used for authentication are unchangeable. This means that if somebody copies your fingerprint or eye pattern, they will be able to use them forever. After all, unlike passwords, fingerprints cannot be reset and changed.
What is more, biometric recognition is not a deterministic authentication method, and, unlike passwords, it cannot be simply right or wrong. Instead, it may be 70% or 99% correct, but a deviation from the baseline is always guaranteed. Therefore, the method is based on probability.
Biometric authentication systems are designed to allow some leeway and accept authentication results that deviate from the perfect result. This means a user will be authenticated even if the system is not 100% sure their biometric data matches that of the authorized user.
Despite its flaws, biometric authentication is very common. However, it is mainly limited to smartphones, where it appears in the form of either fingerprint or face recognition. It is not used in ATMs or POS terminals, as it would not provide sufficient security on these stationary devices. After all, smartphone users are additionally protected by the fact that any potential attacker who wants to pass biometric authentication on their device needs to obtain the device in the first place.
The FIDO2 standard is an exceptional solution, a real breakthrough in the world of strong authentication. Most online vendors and big technology companies have already adopted this standard, which was developed by an international organization called the World Wide Web Consortium (W3C). FIDO2 is an open web authentication standard that enables users to authenticate with local authenticators, such as smartphones and laptops with biometric scanners, or cryptographic security keys. It safeguards access to your operating system, phone, or email without sharing your password with anybody. You just tap your security key or touch your biometric sensor and that is it. But keep in mind that most of the time FIDO2 works in combination with a password or some other authentication factor. That is because two-factor authentication is always better than even the strongest single-factor authentication.
The question about the passwordless future is really the question of how we understand passwords. Is PIN a password? Does tapping a device to authenticate constitute as providing a password? If passwordless means authenticating with something more convenient than a memorized, complex string of characters, then we already live in the passwordless future.
The big benefit of passwordless authentication based on two separate factors is that you do not really need to think that much about making your password (as one of two factors) strong because the second factor will provide enough security.
Many vendors offer implementation of the FIDO2 standard or some kind of 2FA solution. Some of them will allow you to keep credentials in your own infrastructure (no need to share any data with a third-party vendor). However, in most cases, the deployment of passwordless authentication across the entire company is challenging or even impossible. What is more, if an organization decides to go with one standard and then wants or needs to change it, some vendors may find it difficult to assist with such a transition. The best approach to solve this problem is to use User Access Security Broker. Secfense broker allows organizations to deploy and scale any authentication method on any number of applications. The deployment is frictionless, and the chosen authentication method can be changed to another at any time.
Deploying 2FA with User Access Security Broker
Before investing in Secfense, we had the opportunity to talk to its existing clients. Their reactions were unanimous: wow, it’s so easy to use. We were particularly impressed by the fact that implementing their solution does not require the involvement of IT developers. It gives Secfense a huge advantage over the competition, and at the same time opens the door to potential customers who so far were afraid of changes related to the implementation of multi-factor authentication solutions.
Even when the network and infrastructure are secured enough, social engineering and passwords can be used to gain control of the system by attackers. Multifactor authentication is the current trend. Secfense addresses this and allows you to build zero trust security and upgrade your current systems to passwordless applications within minutes, solving this problem right away,” said Eduard Kučera, Partner at Presto Ventures and cybersecurity expert – former Director in hugely successful Czech multinational cyber security firm Avast.
One of the biggest challenges the world is facing today is securing our identity online. That’s why we were so keen to have Secfense in our portfolio. They make it possible to introduce strong authentication in an automated way. Until now, organizations had to selectively protect applications because the deployment of new technology was very hard, or even impossible. With Secfense, the implementation of multi-factor authentication is no longer a problem, and all organizations can use the highest standards of authentication security.
We are faced with new challenges every day. We must always be one step ahead of the attackers and know what they are going to do before they do it. We are convinced that the User Access Security Broker will bring security to a new level, both for those working at the office and from home. For us, working with Secfense is an opportunity to exchange experience with developers who put great value on out-of-the-box thinking.
Business Continuity and Computer Security Officer
BNP Paribas Bank Poland
Two-factor authentication is known to be one of the best ways to protect against phishing; however, its implementation has always been difficult. Secfense helped us solve that problem. With their security broker, we were able to introduce various 2FA methods on our web applications at once.
Head of IT