How Passwordless Authentication Works

As society moves steadily to become fully digital, human dependence on digital systems to work, study, shop, and socialize will increase. Securing access to these systems is vital to protect the user's identities and data. Digital authentication systems play an integral role in securing IT systems in today's information age.

The ability to identify yourself among billions of connected people is critical to gain access to various public and private online services. The ongoing spread of COVID19 disease has forced most global organizations to adopt the work-from-home model. This resulted in shifting a massive number of employees to work remotely. Accessing restricted resources online from home requires using robust authentication systems to verify the user's identity, and this is what digital authentication systems do.

Authentication is a method to verify someone is who or she is pretended to be. Authentication technology provides a mechanism for access control systems to validate users by comparing user credentials (for example, username and password) with a list of authorized users stored in their database.

Passwordless authentication is a method that does not utilize passwords or anything secret that need to be remembered to authenticate users. For instance, instead of using passwords, a user can be verified based on the "possession factor". Any object used to verify its holder's identity, such as a hardware token, one-time password, or a registered mobile device (smartphone or an IoT device). It can also be accomplished through biometric factors, which depend on the human biological characteristic to verify a user. Examples of biometric factors include fingerprint, facial and voice recognition, retinas and irises recognition.

The future is for a Passwordless scheme. According to Gartner, by 2022, 60 percent of large global enterprises and 90 percent of mid-size enterprises will implement passwordless methods in more than 50 percent of use cases.

This article will list its benefits and the prominent cyberattacks that can be prevented by utilizing it.

Passwordless authentication benefits

1. Improve security: According to the Verizon Data Breach Investigation Report (DBIR), 81% of hacking-related data breaches are caused by compromised, weak, and sometimes stolen passwords. Traditional passwords are the most significant attack vector utilized by cybercriminals to infiltrate IT systems. The nature of conventional passwords makes them easy to reuse and share with others, so they are very susceptible to cyberattacks.

2. Enable convenience: By utilizing Passwordless, a user does not need to remember passwords which streamlines the authentication mechanism. On the other hand, most current IT systems require a complex and lengthy password to authenticate users. Such passwords are difficult to remember, and most novice users write them on paper or store them in a text file, making them vulnerable to theft.

3. Reduce IT support expenses: Maintaining traditional passwords requires continual work from IT staff to keep the system running. For instance, non-tech-savvy users commonly lose or forget their passwords and request a new one. Reducing the number of support tickets and avoiding wasting user's time while waiting for their new passwords are significant benefits from adopting the passwordless authentication scheme.

What prevalent cyberattacks can be mitigated by using it?

Password spraying Password spraying is a kind of a password attack technique where attackers try to access many accounts (e.g., using account username) by using common ones. Nordpass has a list of the top 200 most common passwords used during 2020. The attack is used against single sign-on (SSO) applications (e.g., cloud apps) and email accounts.

Credentials stuffing Credentials stuffing is a cyberattack where attackers use a specific service's stolen credentials (e.g., Facebook) and use them to access another unrelated service (e.g., Gmail). This attack is possible because many users utilize the same passwords to access more than one account. The stolen credentials used during this attack are commonly obtained from previous data breaches and darknet marketplaces (e.g., TOR darknet) that promote trending freshly stolen credentials. Some successful credential stuffing attacks are HSBC bank and Spotify.

Spear Phishing Spear phishing is a kind of phishing that uses a customized attack against target entities. Attackers collect information about their target before creating a personalized campaign. For example, adversaries utilize open-source intelligence (e.g., social media profiles, public records, commercial databases, newspapers, journals) to search about their target. Then customize an email message -based on the collected info- that looks appears to originate from a legitimate entity, and finally try to convince them to reveal sensitive information such as login credentials.

Brute Force Attack In brute force attack, adversaries try to guess a victim account password using all possible letters, numbers, and symbols combination to form the correct password. Such an attack is time-consuming, and modern authentication systems can stop it easily. However, many legacy systems are still vulnerable to it.

Summary

Legacy password-only authentication systems become obsolete. Most data breaches could be stopped by utilizing passwordless authentication. Using passwordless will not only improve security, but it will also result in a better user experience and save IT support expenses.