Passwordless: More Mirage Than Reality

The concept of “passwordless” authentication has been gaining
significant industry and media attention. And for a good reason.
Our digital lives are demanding an ever-increasing number of online
accounts and services, with security best practices dictating that
each requires a strong, unique password in order to ensure data
stays safe. Who wouldn’t want an easier way?

That’s the premise behind one-time passwords (OTP), biometrics,
pin codes, and other authentication methods presented as
passwordless security. Rather than remembering cumbersome
passwords, users can authenticate themselves using something they
own, know, or are. Some examples include a smartphone, OTP,
hardware token, or biometric marker like a fingerprint. While this
sounds appealing on the surface, the problem is that, when you dig
deeper, these passwordless solutions are still reliant on
passwords.

This happens in two primary ways:

Passwordless Solutions Rely on Passwords as a
Fallback

If you have an Apple device, chances are you’ve encountered an
issue with Touch ID at some point. There are numerous reasons why
Touch ID authentication might fail—debris on the button, users’
finger positioning, or issues with system configuration, to name
just a few. When these and other issues crop up, what are you
prompted to do? Enter your password.

This means that, even if you have Touch ID enabled for every
possible app and service, the security of these accounts is really
only as good as your password. Hackers can ignore the Touch ID and
go directly to a password attack.

Given the rampant problem of password reuse^[1], there’s a good chance
that the credentials many people use for their Apple devices have
already been exposed. And if a password has been exposed, rest
assured that it’s available for all hackers to obtain via the Dark
Web.

Of course, this is not a challenge unique to Apple. As these
emerging authentication solutions are relatively new, a fallback
means of authentication will be required for the foreseeable
future. And when you consider that this secondary form of log-in is
generally a password, the promise of passwordless remains
elusive.

Credentials are Used to Authenticate the System on the
Backend

The second factor contributing to the passwordless mirage is
that credentials are still typically required to authenticate the
system at some point in the security chain.

For example, perhaps you gain access to your office via a
hardware token that defaults to your unique access code if/when the
token is damaged, or you simply forget it. But what about the IT
admin who logs into the system to analyze the data? If they are
using a password without a complementing solution to ensure the
integrity of their credentials^[2], then the system’s
security is still reliant upon password security.

Why Passwords Will Not Disappear Anytime
Soon

The two examples outlined above underscore that the passwordless
concept is largely smoke and mirrors—at least at this stage of the
game. These emerging invisible security strategies have some
additional authentication concerns that will require passwords to
remain part of authentication security for the foreseeable.

In contrast, passwords still have a lot of appeal to
organizations. They are the most affordable and scalable
authentication option, which makes them difficult to replace. There
are no compatibility issues with passwords which work across all
devices, versions, and operating systems.

This is not the case with many of the emerging passwordless
solutions, which will require organizations to allocate more budget
if they want to increase compatibility. Another benefit of relying
on a password is that it’s either correct or not. In contrast, some
of the passwordless options rely on probabilistic decision-making,
where there is a built-in margin of error.

The Role of Varied and Multiple Layers of
Authentication

According to^[3]
Eric Haller, Experian’s EVP and General Manager of Identity, Fraud,
and DataLabs, “Consumers want to be recognized digitally without
extra steps to identify themselves…they are open to more practical
solutions in today’s digital era.” The willingness may be there on
consumers’ part, but the truth is that no single, effective
solution for secure authentication exists. These invisible security
strategies have their place, but only as part of a broader
cybersecurity approach in which multiple layers of authentication
are deployed. This brings us back to passwords.

Securing the Password Layer

As mentioned above, it’s incredibly common for people to create
simple, easy-to-remember passwords that they then reuse across
multiple accounts and services. Ninety-one percent of respondents
in one survey acknowledge that this introduces numerous security
concerns, yet 59% admit to doing it anyway. It’s unrealistic to
expect human behavior to change, particularly in the post-pandemic
world where we have more digital interactions in our personal and
professional lives than ever before. So, what can organizations do
to ensure password security?

Importance of Screening for Compromised
Credentials

With data breaches occurring in real-time, the only approach is
to screen passwords against a live database of compromised
credentials at every login. Whether passwords are used as the
primary means of authentication or as a backup for when an
invisible security strategy fails, it’s critical that companies are
continuously monitoring for the use of exposed credentials.
Enzoic’s^[4]
dynamic compromised credential screening solution allows
organizations to automate this process, freeing resources to focus
on other areas of cybersecurity while ensuring protection at the
password layer.

Don’t Believe the Passwordless Hype

For now, the promise of a passwordless world remains a mirage.
While our reliance may wane, the complete elimination of passwords
seems unlikely. Therefore, with passwords part of our lives for the
foreseeable future, it’s critical that organizations protect the
password layer.