What is Passwordless authentication?
Passwordless authentication is any method of verifying a user without requiring the user to provide a password.
Proving the user’s identity can instead be done using an alternative factor like a proof of possession factor (mobile authenticator apps, hardware token, one-time OTP), biometrics, or—in less than ideal cases—a knowledge factor (PIN, passphrase, etc).
You’re probably already familiar with some forms of passwordless from everyday use like logging into an app using FaceID on iOS, Android fingerprint authentication, and logging into your laptop via Windows Hello.
Passwords are no longer enough
For enterprise IT departments, nothing costs more than password support and maintenance. It’s common practice for IT to lessen password risk by employing stronger password complexity and demanding more frequent password changes. However, these tactics drive up IT help desk costs while leading to poor user experiences related to password reset requirements. Most importantly, this approach isn’t enough for current cybersecurity threats and doesn’t deliver on organisationall information security needs.
Why eliminate passwords?
Multi-factor authentication (MFA)— for instance, a pin and password, or biometrics—has presented a more secure method for organisations. With increasingly complex access environments and more access points than ever before, IT teams have every reason to add multi-factor authentication options such as smart cards, hard and soft tokens, SMS, and more— wherever users connect to resources. By going beyond passwords to add authentication steps, you can make user access to your resources more secure.
However, depending on the implementation, MFA can also lead to increasing complexity regarding the user experience. It’s imperative for IT teams to deliver a seamless user experience while balancing security risk.
Adopting a password-less strategy
Here are the key considerations for implementing password-less authentication into your MFA strategy:
1. Choosing the right technology –
Develop password-replacement offerings with a new set of alternatives that address the shortcomings of passwords while embracing their positive attributes. This early stage is about implementing an alternative and getting users acquainted with it.
2. Understanding how it works –
Get to know how password-less technologies overcome security challenges and reduce the user-visible password-surface area. Adopting these technologies means upgrading experiences related to the life-cycle of a user’s identity—including provisioning of an account, setting up a brand-new device, using the account/ device to access apps and websites, and enacting recovery. It also means deconditioning users from providing a password any time a password prompt shows on their computer.
3. Increasing user adoption –
Simulate a password-less world—that is, enable end-users and IT admins to replicate the approach in a test environment and transition into a password-less world with confidence. This simulation should encourage a cultural shift within the organisation—getting users comfortable with the idea of never typing, changing, or even knowing a password in the future.
