“There is no doubt that over time, people are going to rely less and less on passwords… they just don’t meet the challenge for anything you really want to secure,” said Bill Gates.
That was 17 years ago. Although passwords have lost some of their charms, they have so far survived many attempts to kill them for good.
The perception of high cost and tricky implementations has stalled some smaller businesses from ditching passwords. But alternatives to passwords are affordable, easy to implement, and safer, showing industry insights gathered by Extra Crunchy. The move to zero trust systems is acting as a catalyst.
First, a primer. Zero trust focuses on who you are, not where you are. Zero trust models require companies to never trust any attempt to access their network and verify every single time — even from logins from inside the network. Passwordless tech is a vital part of zero trust models.
There are several alternatives for passwords, including:
- Biometric authentication: widely used as fingerprint readers in smartphones and physical verification points at buildings;
- Social media authentication: where you use your Google or Facebook IDs to authenticate you with a third-party service;
- Multi-factor authentication: where more layers of authentication are added using devices or services, such as token authentication using a trusted device;
- Grid authentication cards: which provide access while using a combination PIN;
- Push notifications: which are usually sent to the user’s smartphones or encrypted devices;
- Digital certificates: cryptographic files stored locally on the machine or device.
Wolt, a Finnish food-delivery site, is just one example of going passwordless. “The user registers by entering their email address or a phone number. Log in to the app takes place by clicking the temporary link in the user’s inbox. The app on the user’s mobile phone places an authentication cookie, which enables the user to continue from that device without having to go through any further authentication,” said Erka Koivunen, CISO at F-Secure.
In this case, the service provider is in complete control of the authentication, allowing it to set expiration time, revoke service and detect fraud. The service provider does not need to count on the user’s commitment to keeping their passwords.
Passwordless tech is not inherently costly but may take some adjustment, explained Ryan Weeks, CISO at managed service provider Datto.
“It is not necessarily costly in terms of monetary investment because there are a lot of easily accessible open-source alternatives for multi-factor authentication that don’t require any sort of investment,” said Weeks. But some companies believe passwordless tech may cause friction to their employees’ productivity.
Koivunen also dismissed that zero trust models are unaffordable for startups. “Zero trust recognizes the futility of forcing users to authenticate themselves by presenting something they should keep a secret. Instead, it prefers to establish the user’s identity using some context-aware method,” he said.
Zero trust goes further than authenticating users; it also includes the device and the user. “From a zero-trust perspective, there is an idea that there is a continuous authentication or revalidation of trust occurring. Therefore, passwordless in a zero-trust model is potentially easier for the user and more secure as the combination of the ‘something you have’ and ‘something you are’ factors are more difficult to attack,” said Datto’s Weeks.