Unless you have a photographic memory, this will probably sound very familiar. Imagine this: you’re away from your desk and need to access one of your apps on your phone. You try to log in and get the dreaded message: ‘The username and password you entered do not match those on file’. This marks the start of the time-consuming process of requesting a password reset, including coming up with a new password that doesn’t match any you’ve used in the past. Despite the frustration, passwords have been the cornerstones of our online data security for decades. In today’s digital landscape, however, we need more than just passwords.

Here are a few key reasons why:

Vulnerability to cyber attacks

• Passwords are often targeted by phishing attacks, brute-force cracking attempts and credential stuffing.
• Stolen passwords are often sold on the dark web, thereby putting sensitive information at risk.

Human limitations

• People find it difficult to remember complex passwords, which leads to weak or reused credentials.
  • With the advancement of artificial intelligence, hackers are able to crack passwords more quickly and bypass traditional security measures.
• Common passwords such as 123456 or ‘password’ remain widespread despite awareness campaigns.
  • Password managers, whilst useful, are not foolproof and can be compromised.

User frustration

• Password resets account for a significant proportion of IT support requests, causing frustration for users and incurring costs for businesses.

Data protection incidents

• In 2023 alone, billions of credentials were leaked worldwide due to weak or reused passwords, making it a record year for data breaches.
  • Companies spend millions every year on password-related issues, including password resets, support and security measures. According to IBM, the average total cost of a data breach is $4.88 million.
• Reports show that in more than 65 per cent of hacker attacks, login credentials are compromised.

Password-free authentication

Passwordless authentication can be used to verify a user’s identity without relying on traditional passwords. Instead, it uses other forms of verification, such as:

• Hardware tokens: security token or smartphone.
• Biometric data: fingerprints, facial recognition or retinal scans.
• Special links: links shared with the user that automatically log them in.
• A combination of all forms of verification.

Passwordless authentication methods generally rely on a public-key cryptographic infrastructure, where a key pair is generated. The security of public-key cryptography depends on the private key being kept secret, whilst the public key can be freely distributed without compromising security. The public key is therefore provided during registration with the service performing the authentication (a remote server, application or website), whilst the private key is stored on the user’s device (security token, smartphone) and, ideally, can only be accessed by entering an additional factor of authentication (PIN, biometric data).

How does passwordless authentication mitigate common cyber security threats?

The main problem associated with password reuse is credential stuffing, which means that a password obtained during a data breach on one website is reused to attempt to gain access to accounts on other websites. Users typically reuse passwords across multiple websites, so a single data breach can put all their accounts at risk. Passwordless authentication does not use passwords, so users are not required to enter their login details.

Phishing is a form of social engineering and a scam in which attackers trick people into revealing sensitive information. In the use case we examined, this sensitive information would be an authentication factor, such as a password, a hardware token or a login link. As one might expect, in a passwordless workflow, there is no password, and users are also rather reluctant to share their security keys or biometric data.

A brute-force attack is like a digital battering ram – attackers attempt to gain access to an account or system by trying every possible password combination until they find the correct one. This is a trial-and-error method that relies more on sheer computing power than on any sophisticated tricks. In a password-less environment, such attacks are virtually ineffective, as public-key cryptography is much harder to crack than a password; the computational effort required for a brute-force attack to succeed makes it much more difficult. Furthermore, the use of more than one authentication factor – such as a biometric scanner or a security key – makes it virtually impossible to carry out such attacks.

In summary, many of the attacks that occur in password-based environments can be minimised or even eliminated altogether by using a passwordless authentication workflow.

Why is it worth switching from a password-based system to a passwordless one?

There are several reasons for switching to passwordless authentication. Indeed, some large companies, such as Mastercard, have already announced their intention to switch to a passwordless model and use biometric data instead. When organisations begin to assess whether they should make the switch, the key benefits can be categorised as follows:

Enhanced security

• Password-less methods (biometrics, password keys or hardware tokens) eliminate vulnerabilities such as phishing and brute-force attacks.
• Relying on more secure systems, such as public-key cryptography, which is virtually impossible to crack.
• Authentication is carried out using an individual’s unique physical or behavioural characteristics – such as their fingerprint, face or voice – rather than passwords. In other words, the person’s inherent characteristics, rather than a memorised password, serve as the key to access.

A better user experience

• Users no longer need to remember multiple passwords, or to reset or change their passwords.
• Authentication becomes faster and more user-friendly, which increases satisfaction and reduces churn.
• Surveys show that users prefer passwordless options, such as biometric or device-based authentication, for reasons of convenience and security.
• Users are more likely to trust a system that ensures the security of their data without relying on them to create secure passwords.

Industry acceptance

• Regulatory bodies, such as NIS2, emphasise stricter security measures and often recommend alternatives to passwords.

Why is it worth taking a multi-layered approach to security?

The challenges of identity management and access control cannot be addressed by a single approach or a single solution. Instead, a multi-layered approach is essential, which is often achieved through the combined use of tools and solutions. In the case of passwordless authentication, this can be further enhanced through the use of multi-factor authentication (MFA) and single sign-on (SSO). Let us explain these concepts before going into more detail about the reasons behind them.

What is MFA?

MFA is a security system that requires more than one authentication method to verify a user’s identity. Rather than relying solely on a password, MFA uses a combination of two or more of the following factors:

• Possession factors (“Something the user possesses”), such as a security token, a mobile phone or a smart card.
• Knowledge factors (‘Something the user knows’), such as a password or PIN code.
• Authentication factors (“Something the user has”), such as fingerprints, retinal scans, facial or voice recognition, and other biometric identifiers.

What is SSO?

SSO is a user authentication process that allows you to access multiple applications or services using a single login credential. Instead of logging in to each service individually, SSO provides a unified login experience. It simplifies access, as once authenticated, the user can access all related services without having to re-enter their credentials.

Security authentication: password-less + MFA + SSO

By eliminating traditional passwords, it strengthens protection against security breaches whilst simplifying the login process. The integration of MFA adds an extra layer of security, ensuring that only authorised users are granted access. Meanwhile, SSO enhances the user experience by providing easier access to multiple applications with a single login. Together, these technologies offer a robust and user-friendly solution for the modern security environment.