Passwordless authentication does not mean "no factor". It means the factor is no longer a user-supplied shared secret. The model replaces stored hashes with hardware-bound credentials and biometrics that never leave the user's device — convenient for the user, but more importantly, structurally harder to phish.
What is Passwordless Authentication?
A passwordless authentication system is one that swaps the use of a traditional password with more secure factors. These extra-security methods may include a magic link, fingerprint, PIN, or a token delivered via email or text message.
Why Do We Need Passwordless Authentication?
Secure authentication is the need of the hour due to a whopping increase in data breaches. Passwords are dying a natural death as they aren't able to provide secure authentication as promised. The report "The World Will Need to Protect 300 Billion Passwords by 2020", produced by Thycotic, concludes that humans will be using over 100 billion passwords. Connected machines themselves will utilize in excess of 200 billion passwords.
A passwordless authentication is a form of authentication which allows users to log in without the hassle of typing passwords or in most cases without human intervention at all. These extra-secure methods include sending links or secret tokens via an email, Single-Sign-On, PIN, Finger-Print, or use of Hardware security tokens like Smart Cards.
Building further on the need to go passwordless, several tech companies got together to launch the Fast Identity Online (FIDO) Alliance in 2012. The FIDO alliance publishes an open standard with a mission to empower less difficult and more grounded user authentication.
The standards provide a framework for removing common attacks against passwords such as credential stuffing, password reuse, phishing, and man-in-the-middle (MITM) attacks. The most recent, FIDO2, enables passwordless authentication based on public-key cryptography.
FIDO2 specifications include WebAuthn and Client to Authenticator Protocol (CTAP). WebAuthn makes hacking harder by enabling online services to use FIDO Authentication through a standard web API that can be built into browsers and related web platform infrastructure. It is currently supported in Google Chrome, Mozilla Firefox, Microsoft Edge, and Apple Safari, as well as Windows 10 and Android platforms.
CTAP enables an external authenticator – such as a physical FIDO security key or a mobile phone – to work with browsers that support WebAuthn for easy authentication to online services.
The aim of Passwordless Authentication is to prevent
- Password Spraying — hackers try to log in to all accounts with the same password
- Brute Force Attacks — trying combinations until one succeeds
- Spear Phishing — email spoofing for sensitive information
- Social Engineering — psychological manipulation to obtain credentials
The bottom line: Passwordless Authentication should be one of the most important New Year's Resolutions. Removing passwords helps Enterprises, businesses, and Individuals to reduce costs and attack risks.
- Password Spraying: It’s a type of cyber-attack where hackers try to log in to all the accounts possessing the same password credentials
- Brute Force Attacks: It’s a commonly used method by hackers where they try to guess the user’s login credential using the trial and error method. They try all the possible combinations until they successfully hack the account
- Spear Phishing: It’s an email spoofing attack to get sensitive information for financial or trade gains
- Social Engineering: It’s a psychological manipulation used by hackers to get into user’s sensitive information and critical resources
Going beyond passwords
FIDO2 simplifies and secures user authentication. It uses public-key cryptography and origin binding to resist phishing: the authenticator only signs for the origin the credential was registered to. That makes FIDO2 phishing-resistant — one of several such factors, alongside certificate-based credentials like PIV. AmbiSecure cards and keys combine hardware-based authentication with public-key cryptography, keeping the private key inside the secure element where it cannot be exported.
AmbiSecure helps organizations accelerate to a password-less future by providing support for the FIDO2 protocol. The OnePass USB Key and OnePass Card do not require a battery or network connectivity, making authentication always accessible.
About Ambimat Electronics
Close to 4 decades of design experience. Ambimat Electronics is a single-stop solution enabler to leading PSUs, private sector companies, and start-ups. Solutions include AmbiPay, AmbiPower, AmbiCon, AmbiSecure, AmbiSense, AmbiAutomation.
References
- https://www.inc.com/joseph-steinberg/300-billion-thats-how-many-passwords-may-be-in-use-by-2020.html
- https://www.zoho.com/blog/vault/5-reasons-to-adopt-passwordless-authentication-in-2021.html
- https://blog.shi.com/solutions/demystifying-fido-and-the-path-to-passwordless-authentication/
- https://www.loginradius.com/blog/start-with-identity/2019/10/passwordless-authentication-the-future-of-identity-and-security/
- https://enterprise.verizon.com/en-au/resources/articles/analyzing-covid-19-data-breach-landscape/
A simple explanation for passwordless
We often talk about passwordless, and of course, some of us may wonder how going passwordless is more secure than having a password? Isn’t it like removing the combination to the safe for the sake of convenience? It is all about asymmetric cryptography, and for those who aren’t familiar with that term, this article is an easy explanation.
The purpose of passwords
Before we move to another alternative to passwords, we need to understand why we have passwords in the first place. Password is meant to identify an individual. They establish that a person is exactly who they claim to be. Unfortunately, there are several reasons why a password cannot be called a unique identifier.
What is Wrong with Passwords?
Passwords are generally stored in a service database. When a user enters their login credentials, it is cross-referenced and verified by the service — hence, the term “symmetric secret” as it shared on both sides. Most users can memorize their passwords while some may use password managers, sticky notes, or other means to remember them. When we hear about breaches and huge password leaks, that is because some malicious person intentionally accessed all the passwords stored within the database. Because of the symmetry, the password being known to both sides and having it stored is the primary reason why passwords are a major security challenge.
Another password issue is that it doesn’t identify you as a person, it identifies what the user knows. Still, a user knowing something doesn’t necessarily mean that it cannot be known to others. For example, a user entering a password can become a victim of shoulder surfing without their knowledge. Anyone can look over a user’s shoulder and get hold of the password they are entering. On the other hand, if a user has something that they own, such as a hardware security key which is hard to replicate by others unless they have it in their possession. So why would anyone put their trust in passwords to protect their most critical and vital information? Password can easily be compromised.
Passwordless Logins
Rather than using a password that is a shared secret or “symmetric secret”, users should switch to “asymmetric secret”. In this method, the secret lies with the user trying to access a service and is never known to the service granting access
Two keys
Despite its name, the public key acts more as a keyhole rather than a key. The public key is unlocked with a digital signature, known as a certificate, created using the user’s private key,
and whether the digital certificate can unlock it or not is determined by the public key. The public key is incapable of viewing the user’s private key, and the private key cannot be replicated or obtained from the public key.
With this method, the user password is never stored in a database for someone to access it. It is only stored locally on the user’s device. There is no way that someone can log in to the application unless they have access to the user’s device and can unlock the same.
Additionally with “asymmetric secret” there is nothing to write down or accidentally reveal the same to others, which would allow them to access an individual account. An asymmetric secret is nothing like a password.
A reliable solution
As an approach to security verification, this method is known by the name of PKI (Public Key Infrastructure) and is nothing new. PKI is used to verify user identity and is a form to replace
passwords. However, the concept has been around for quite something as SSL/TLS certificates for secure online transactions.
A TLS certificate and a PKI validate that the site, a user is visiting, is what it claims to be and is not a fraud. The same technology is applied with the use of hardware security to verify
that a user accessing a service or application is actually who they say they are.
Which is a better identifier?
So, the difference between a password and hardware security is that passwords are required to be stored, or need to be memorized by a user to identify themselves. On the other hand, the hardware security key is stored on a local device belonging to the user and nowhere else. It cannot be removed or viewed by others. Therefore, it can be established that not having a password is safe and secure than having one.