When was the last time you used a biometric authentication such as a fingerprint or facial recognition instead of a password? In my case, it happened today.
With each passing day, we’re using fewer and fewer passwords. Days, where you had to remember a 12-character password with a mix of uppercase and lowercase letters, numbers, and special characters, are slowly fading. Moreover, the caveat when using passwords is that they can be easily hacked–especially weak passwords.
The vulnerability factor
Let’s all agree that it is sometimes cumbersome to set, reset, and remember passwords. So, in turn, we set simple easy-to-remember passwords, use them for multiple accounts, and store them where they’re easily accessible. Such practices leave a loophole for perpetrators to hack into our accounts and systems.
A new AI-driven hacking method can now predict the passwords of the users with more than 90 percent accuracy by tracking what the users type on their keyboards.
In another instance, two Nigerian cybercriminals swindled INR 25 million in India by sending a phishing email. Apparently, they used keylogger software to identify the credentials of the bank staff.
On top of all of this, it’s a hassle to be consistently resetting forgotten passwords and changing the password every 3-6 months (which is the currently prescribed best practice). Hence, in today’s digital world, it has become a necessity to balance security with user-friendly practices.
The new way: Password-less authentication
Password-less authentication methods enhance security, reduce vulnerability, and simplify the user experience. Password-less authentication methods eliminate most of the limitations faced by traditional passwords.
-
Biometric authentication methods such as fingerprint scans and facial recognition offer better security as they use characteristics unique to an individual. This makes them very hard to replicate by hackers.
-
One-time codes are sent via SMS or email, or are generated through authenticator apps. They are sent for a single use and expire shortly after. As one-time codes are unique and expire quickly, it is usually hard for perpetrators to access them. It adds an extra layer of security.
-
Authenticator apps generate one-time codes and tap to login options for accessing online accounts. These apps also work offline, making it an accessible option for areas with limited connectivity. Authenticator apps can also be used as an additional layer of security for multi-factor authentication (MFA).
The password-less future
Here are a few examples of how password-less setups are being deployed:
-
This article by S&P Global Market Intelligence begins with this passage: “Tech industry coalition including Apple Inc., Alphabet Inc. and Microsoft Corp. is working to expand adoption of a secure alternative to the common password.” These efforts are mainly because of security limitations.
ManageEngine’s ADSelfService Plus—an identity security solution with MFA, SSO, and self-service password management capabilities—offers password-less authentication with a maximum of three stages for SSO-based logins to enterprise applications and logins into its Android and iOS mobile application.
The hassle of using passwords is well-known, but thankfully new authentication methods have brought us closer to a password-less future. In the coming years, traditional passwords will be replaced or supplemented by other convenient and secure methods of authentication and we’ll finally bid goodbye to static passwords.
