Passwordless Logins

Passwords have been the root cause of all major security and privacy breaches. But this is about to change once passwordless logins are implemented on a worldwide scale. Recently, the World Wide Web Consortium (W3C) and the FIDO Alliance announced a new authentication standard – Web Authentication (WebAuthn) specification – for the web and other platforms.

The World Wide Web Consortium (W3C) is an international community that operates under a code of ethics and the professional conduct to develop open standards and also to ensure the long-term growth of the Web. The FIDO Alliance is also an open industry association made of tech giants with a mission of developing authentication standards to help reduce the world’s over-reliance on passwords.

What are passwordless logins?

As the name suggests, it’s a way of login into your accounts without using passwords. This method uses the Web Authentication (WebAuthn) specification which is part of the FIDO2 specification. That’s, FIDO2 specifications use the W3C’s Web Authentication specification (WebAuthn) and FIDO’s corresponding Client-to-Authenticator Protocol (CTAP) to authenticate users to online services via commonly used devices easily. WebAuthn gets rid of passwords and instead it employs the use of one-time auth tokens each time you log in.

Instead of passwords, two major forms of authentication are used; biometrics – such as fingerprints and facial recognition – and also hardware security tokens such as USB keys.

How do passwordless logins work?

In a nutshell, passwordless logins work by having a trusted authenticator, i.e., your fingerprint sensor or hardware token. When you log into sites or apps that support passwordless logins, you will be asked to prove your identity. For instance, the browser or the app will require the trusted authenticator to prove who you are – you will then be required to scan your fingerprint or your face or insert your hardware token. After you have scanned your fingerprint or provided the token, you have proven your identity.

Unlike passwords which require you to be online for authentication, your fingerprint stays on your device, and this minimizes phishing risks. 

Benefits of passwordless logins,

According to the FIDO alliance, passwordless logins are the ultimate solution that averts password phishing, theft and even replay attacks. Also entering passwords is a time-consuming endeavor that also drains resources. Here are some WebAuthn benefits according to FIDO;

• Security: FIDO2 cryptographic login credentials are unique across every website, biometrics or other secrets like passwords never leave the user’s device and are never stored on a server. This security model eliminates the risks of phishing, all forms of password theft and replay attacks.
• Privacy: Because FIDO cryptographic keys are unique for each internet site, they cannot be used to track users across sites.

• Convenience: Users log in with simple methods such as fingerprint readers, cameras, FIDO security keys, or their personal mobile device.

• Scalability: websites can enable FIDO2 via simple API call across all of supported browsers and platforms on billions of devices consumers use every day.

Where can you use passwordless logins?

You can use this type of login on any supported platform. Currently, it’s supported in Windows 10, Android devices running on Android 7 or higher, Mozilla Firefox, Google Chrome, Apple Safari, and Microsoft Edge. Also, many Apps especially banking apps employ this type of logins. For instance, PayPal lets you log in via the app using your fingerprint.

Use a VPN if there’s no passwordless login – IPBurger VPN

IPBurger VPN uses the unbreakable AES 256 bit standard to encrypt your internet traffic. This secures your passwords and other login information as they traverse the internet to their destination. This encryption ensures prying eyes such as cybercriminals have no access to your data. And if they intercept it, they won’t be able to decrypt it since they won’t have the key.