Inicio de sesión sin contraseña

Passwords have been the root cause of all major security and privacy breaches. But this is about to change once passwordless logins are implemented on a worldwide scale. Recently, the World Wide Web Consortium (W3C) and the FIDO Alliance announced a new authentication standard – Web Authentication (WebAuthn) specification – for the web and other platforms.

The World Wide Web Consortium (W3C) is an international community that operates under a code of ethics and the professional conduct to develop open standards and also to ensure the long-term growth of the Web. The FIDO Alliance is also an open industry association made of tech giants with a mission of developing authentication standards to help reduce the world’s over-reliance on passwords.

¿Qué son los inicios de sesión sin contraseña?

As the name suggests, it’s a way of login into your accounts without using passwords. This method uses the Web Authentication (WebAuthn) specification which is part of the FIDO2 specification. That’s, FIDO2 specifications use the W3C’s Web Authentication specification (WebAuthn) and FIDO’s corresponding Client-to-Authenticator Protocol (CTAP) to authenticate users to online services via commonly used devices easily. WebAuthn gets rid of passwords and instead it employs the use of one-time auth tokens each time you log in.

Instead of passwords, two major forms of authentication are used; biometrics – such as fingerprints and facial recognition – and also hardware security tokens such as USB keys.

¿Cómo funciona el inicio de sesión sin contraseña?

In a nutshell, passwordless logins work by having a trusted authenticator, i.e., your fingerprint sensor or hardware token. When you log into sites or apps that support passwordless logins, you will be asked to prove your identity. For instance, the browser or the app will require the trusted authenticator to prove who you are – you will then be required to scan your fingerprint or your face or insert your hardware token. After you have scanned your fingerprint or provided the token, you have proven your identity.

Unlike passwords which require you to be online for authentication, your fingerprint stays on your device, and this minimizes phishing risks. 

Ventajas del inicio de sesión sin contraseña,

According to the FIDO alliance, passwordless logins are the ultimate solution that averts password phishing, theft and even replay attacks. Also entering passwords is a time-consuming endeavor that also drains resources. Here are some WebAuthn benefits according to FIDO;

• Security: FIDO2 cryptographic login credentials are unique across every website, biometrics or other secrets like passwords never leave the user’s device and are never stored on a server. This security model eliminates the risks of phishing, all forms of password theft and replay attacks.
• Privacy: Because FIDO cryptographic keys are unique for each internet site, they cannot be used to track users across sites.

• Convenience: Users log in with simple methods such as fingerprint readers, cameras, FIDO security keys, or their personal mobile device.

• Scalability: websites can enable FIDO2 via simple API call across all of supported browsers and platforms on billions of devices consumers use every day.

¿Dónde se puede iniciar sesión sin contraseña?

Puedes utilizar este tipo de inicio de sesión en cualquier plataforma compatible. Actualmente, es compatible con Windows 10, dispositivos Android con Android 7 o superior, Mozilla Firefox, Google Chrome, Apple Safari y Microsoft Edge. Además, muchas aplicaciones, especialmente bancarias, emplean este tipo de inicio de sesión. Por ejemplo, PayPal te permite iniciar sesión a través de la aplicación utilizando tu huella dactilar.

Use a VPN if there’s no passwordless login – IPBurger VPN

IPBurger VPN uses the unbreakable AES 256 bit standard to encrypt your internet traffic. This secures your passwords and other login information as they traverse the internet to their destination. This encryption ensures prying eyes such as cybercriminals have no access to your data. And if they intercept it, they won’t be able to decrypt it since they won’t have the key.