探花大神

You鈥檝e likely heard of the passwordless concept before, and you may have heard predictions that passwordless environments would become a reality in our near future. However, the password hasn鈥檛 gone extinct quite yet 鈥� in fact, you鈥檝e probably typed in at least one today to access your resources. So, is passwordless authentication a coming reality or an elusive pipe dream?

In this blog, we鈥檒l explore the possibility of a passwordless world, what鈥檚 driving the passwordless push, barriers to its adoption, developments in technologies like FIDO2 and WebAuthn powering passwordless authentication, and business environment changes that are bringing it closer to reality. 

Have Rumors of the Password鈥檚 Death Been Greatly Exaggerated?

The passwordless world isn鈥檛 a new concept. The IT community has been discussing the death of the password , when Bill Gates predicted it at an RSA Security conference.

, IBM echoed Gates鈥� prediction, assigning the password鈥檚 extinction a five-year timeline 鈥� but, just like Y2K and the 2012 Mayan doomsday, the password鈥檚 death date came and went, and we continue to type our passwords in (or forget and reset them) day in and day out. 

This brings us to the question: Is passwordless authentication even possible?

Is Passwordless Authentication Possible?

In short, yes. Essentially, passwordless authentication is multi-factor authentication (MFA) where a password isn鈥檛 one of the factors. Typically, logging into a resource requires a username and password, and with MFA, it usually requires a username/password combination plus one other authentication factor, like a time-based one-time password (TOTP). With a passwordless login, the password would be replaced with another MFA factor, like a push notification, biometric, or security token. This way, the user could simply scan their fingerprint and tap a button on their phone 鈥� or complete another combination of simple passwordless MFA steps 鈥� to log in securely. 

But just because something is possible doesn鈥檛 mean it鈥檚 desirable, which brings us to our next question: Is passwordless authentication safe? Is it something we should be working toward?

Is Passwordless Authentication Secure?

When a technology has spent decades as the reigning security solution around the world, that means hackers have spent decades perfecting techniques for compromising it. Passwords are no longer a highly secure means of protecting resources 鈥� and especially not when they stand alone, without the added layer of MFA. In fact, , followed closely by shared credentials and phishing attacks. 

Two main weaknesses of the password are driving the need for a better security solution:

Password theft and hacking techniques are sophisticated and rampant. Hackers have developed ways to compromise just about every type of password, including TOTPs. From running phishing scams to sourcing compute power to mounting brute-force attacks that can guess billions of password combinations per second, hackers have made it near impossible to create a password that someone couldn鈥檛 crack.聽

Users rarely follow password best practices. From writing passwords down to reusing them to using passwords like 鈥減assword123,鈥� users have trouble following password best practices. While most indiscretions are not malicious, they still create targets for compromise.

Most of these malpractices come from the inefficiency of the password as an authentication factor. As businesses move to cloud and SaaS-based models, users have to remember more and more passwords 鈥� an average of over 170. Expecting users to create and remember unique, complex passwords for each resource is unrealistic, and most use fewer than 20 passwords to lock all 170+ resources.聽

As bad password habits become the norm and hackers learn to spot and target vulnerable password-protected accounts, companies have started looking for more secure ways to protect their assets. When implemented correctly, passwordless authentication does just that. So, what鈥檚 taking so long? Why haven鈥檛 we implemented it yet?

What Are the Barriers to Passwordless Adoption?

If passwordless authentication is possible and secure, and the IT community has been predicting it for years, why hasn鈥檛 it become a reality yet? 

Inertia

It鈥檚 difficult to stop decades of worldwide inertia, and the password has enjoyed as it gained global popularity. Now, it鈥檚 become so common that people have come to expect it, and logging into applications without one can be jarring, confusing, and hard to promote buy-in among users and leadership. 

Perceived Security 

Many people鈥檚 first thought about passwordless logins is that it sounds less secure, not more secure than a password-protected account. For busy, business-oriented leadership teams, this could be enough to bar adoption; many businesses aren鈥檛 looking to be at the vanguard of security 鈥� they just want to implement reasonably secure policies, and to the untrained eye, the password accomplishes this. However, passwords are becoming less and less secure, and the norm is moving toward MFA, Zero Trust security, and higher security standards that rely less and less on passwords.聽

Cumbersome Tools

When MFA made its debut, it wasn鈥檛 as sleek as it is today 鈥� the first instances of MFA included factors being sent to pagers, printers, landline phones, and other receivers (). Even today, some MFA methods impose significant demands on the user, like sourcing and typing in a TOTP.

Some TOTP instances can be even more cumbersome: RADIUS, for example, requires users to type in their password, then a comma, then their TOTP. It鈥檚 easy to imagine how a user might lock themselves out after too many failed attempts (or worse, give up and find a workaround or sign into an easier-to-access network).

Further, passwordless solutions have historically worked for some solutions, but not others, making it a less attractive solution than the well-understood and universal password. However, as providers hone their passwordless technology and software vendors come to understand the importance and growing demand for it, more and more solutions are supporting passwordless authentication and, crucially, prioritizing MFA accessibility.

Lack of Buy-In

All of these barriers created a lack of user competency around passwordless MFA and skepticism among leadership, generating low buy-in. However, as tools streamline the user experience and the business world鈥檚 understanding of the precarious security landscape improves, buy-in is growing and more businesses are seriously considering the idea of moving toward passwordless authentication.

What Makes This Time Different?

Although passwords have proliferated longer than many IT experts expected, changing business environments, evolving mindsets, and rapidly developing technology are carving the path toward a passwordless future. The following are some of the changes the modern workplace is experiencing that are spurring faster and wider adoption of passwordless authentication.

Increased Understanding of the Password鈥檚 Weaknesses

The illusion of the password鈥檚 security is fading as catastrophic breaches caused by password compromise continue to make the news and additional studies of user behavior have confirmed suspicions that users don鈥檛 follow best practices 鈥� like the fact that for every account. Businesses are taking note and beginning to look for alternative solutions rather than continue to impress unrealistic expectations that users remember growing numbers of unique, complex passwords. 

Remote and Hybrid Work

Before the coronavirus pandemic forced businesses around the world to go remote, the norm was in-office work. Workspaces were more homogenous, with employees all signing onto their office鈥檚 central network (probably LAN or WAN) from the same location at the same time. While cybersecurity was still a growing threat, it wasn鈥檛 as top-of-mind for executives as it is now, as companies need to secure employees using various methods and devices to access resources from widespread remote locations. 

The Rise of Zero Trust Security and Increased Leadership Buy-In

The shift in leaders鈥� attention toward securing remote work has spurred more interest in tighter security. The business world is seeing a growing adoption of Zero Trust security, including MFA solutions, conditional access, and other security methods more advanced than the password.

In fact, in a recent 探花大神 survey of IT professionals, 21% of respondents said their business already had Zero Trust in place, and another 46% said their company planned to adopt it by the end of 2021, if not sooner. The same study showed that 84% of respondents worked at companies that had some level of MFA implemented.

While IT admins may have long been advocates for passwordless authentication, changing workplace trends and rising security concerns have opened the ears of company decision-makers, who are now more willing to slow inertia in favor of more secure solutions. 

Better Tools

Passwordless models have been clunky in the past, whether they were only compatible with a small subset of tools, substantially increased friction in the user experience, or were susceptible to the same hacking techniques that passwords were. Fortunately, technology has been advancing to meet password and security challenges with more streamlined, secure, and user-friendly approaches. 

Push notifications, for example, streamline clunky MFA steps like SMS codes: users can simply tap a button on their phone rather than type out the code sent via text message. Biometrics similarly reduce friction with secure, user-friendly technology. 

One of the key developments in recent years that is streamlining MFA and bringing passwordless authentication within reach is the FIDO Alliance and the principles and protocols they鈥檝e developed in pursuit of a passwordless world.

Passwordless Authentication with FIDO2

FIDO, or Fast Identification Online, is a set of standards for secure passwordless authentication put forth by the FIDO Alliance. FIDO2 is the most current set of standards, which include Web Authentication (WebAuthn) and Client-to-Authenticator Protocol (CTAP). 

WebAuthn

WebAuthn is an API that facilitates secure authenticator-to-website interaction with public key cryptography. This can take place via:

• Security keys as an MFA factor
• Device-generated biometrics as identity verification 

CTAP

is a protocol that facilitates secure communication from client to removable authenticator. 

How FIDO2 Works

FIDO2 (the second and most current iteration of FIDO standards) uses , like a security key or built-in biometric scanner, as an MFA factor. The hardware generates a public/private key pair, registering the public key with the client and storing the private key on the device. Then, every time the user goes to log in, they complete an action on the device (like scanning their fingerprint or pressing a button) to authenticate their identity. 

A FIDO2-supported login can be supplemented with another non-password MFA factor, like a push notification, to facilitate a secure passwordless login.

FIDO2 Benefits

Broad Application

FIDO2鈥檚 ability to facilitate web-based authentication with secure hardware-generated data allows businesses to use passwordless technology on websites. Previously, this technology was only available on mobile device applications (like providing your fingerprint to re-authenticate your identity on a mobile application); now, users can use security keys and biometrics to log into web-based applications.

WebAuthn can also be used in conjunction with single sign-on (SSO), allowing for one secure, FIDO2-based login to grant users access to all of their FIDO2-enabled services. 

Improve Security

Some older security keys plugged into devices and registered as another keyboard so they could auto-input TOTPs. While this bypasses the user鈥檚 step of sourcing and typing in the TOTP, it doesn鈥檛 eliminate the security concerns associated with TOTPs. In this model, spray, brute-force, and phishing attacks still have the potential to compromise resource access. 

In fact, most MFA factors can fall victim to phishing. While they still exponentially improve security, they don鈥檛 eliminate risk in sophisticated attacks. FIDO-enabled security keys cannot be phished; the hacker would essentially have to gain access to the physical device. Even better, biometrics hold up against the hacker gaining access to the device, because they are unique to the user and difficult to replicate.

Reduce Friction

FIDO2 authentication imposes much less friction on the login process than many other MFA factors. It does not, for instance, require the user to receive and type in a TOTP. In addition to improving the user experience, this also improves security.

FIDO2 also enables biometrics to authenticate identity on websites, making authentication one step easier for users by eliminating their need to carry a security device. When paired with another seamless factor like a push notification to the user鈥檚 personal device, this creates a fast, seamless, and highly secure passwordless authentication experience. 

Promote a Passwordless Environment

As in the example above, FIDO2-enabled devices are prime candidates for creating passwordless environments because they鈥檙e secure, easy to use, widely applicable, and cost-effective. They create a secure environment for users to complete a second passwordless MFA factor, like a push notification, helping organizations put passwords aside for easier, more secure authentication methods to all the resources users need to complete their work. 

Streamline Passwordless Authentication with a Unified Platform

Going passwordless requires an ironclad grip on your user base and a sophisticated IAM platform that can support WebAuthn, security keys, push notifications, and other MFA factors to ensure users have options available to them to keep friction low and buy-in high. The 探花大神 Directory Platform is a cloud-based IAM platform that manages access to all the IT resources users need to Make (Remote) Work Happen.

探花大神 can power passwordless authentication from a centralized identity directory by supporting FIDO2 logins to our user portal, offering a push notification app, interfacing with third-party authenticator apps, enabling conditional access policies, and more. Learn more about our MFA offering powering a passwordless future.