无密码登录

Passwords have been the root cause of all major security and privacy breaches. But this is about to change once passwordless logins are implemented on a worldwide scale. Recently, the World Wide Web Consortium (W3C) and the FIDO Alliance announced a new authentication standard – Web Authentication (WebAuthn) specification – for the web and other platforms.

The World Wide Web Consortium (W3C) is an international community that operates under a code of ethics and the professional conduct to develop open standards and also to ensure the long-term growth of the Web. The FIDO Alliance is also an open industry association made of tech giants with a mission of developing authentication standards to help reduce the world’s over-reliance on passwords.

什么是无密码登录？

As the name suggests, it’s a way of login into your accounts without using passwords. This method uses the Web Authentication (WebAuthn) specification which is part of the FIDO2 specification. That’s, FIDO2 specifications use the W3C’s Web Authentication specification (WebAuthn) and FIDO’s corresponding Client-to-Authenticator Protocol (CTAP) to authenticate users to online services via commonly used devices easily. WebAuthn gets rid of passwords and instead it employs the use of one-time auth tokens each time you log in.

Instead of passwords, two major forms of authentication are used; biometrics – such as fingerprints and facial recognition – and also hardware security tokens such as USB keys.

无密码登录如何操作？

In a nutshell, passwordless logins work by having a trusted authenticator, i.e., your fingerprint sensor or hardware token. When you log into sites or apps that support passwordless logins, you will be asked to prove your identity. For instance, the browser or the app will require the trusted authenticator to prove who you are – you will then be required to scan your fingerprint or your face or insert your hardware token. After you have scanned your fingerprint or provided the token, you have proven your identity.

Unlike passwords which require you to be online for authentication, your fingerprint stays on your device, and this minimizes phishing risks. 

无密码登录的好处

According to the FIDO alliance, passwordless logins are the ultimate solution that averts password phishing, theft and even replay attacks. Also entering passwords is a time-consuming endeavor that also drains resources. Here are some WebAuthn benefits according to FIDO;

• Security: FIDO2 cryptographic login credentials are unique across every website, biometrics or other secrets like passwords never leave the user’s device and are never stored on a server. This security model eliminates the risks of phishing, all forms of password theft and replay attacks.
• Privacy: Because FIDO cryptographic keys are unique for each internet site, they cannot be used to track users across sites.

• Convenience: Users log in with simple methods such as fingerprint readers, cameras, FIDO security keys, or their personal mobile device.

• Scalability: websites can enable FIDO2 via simple API call across all of supported browsers and platforms on billions of devices consumers use every day.

在哪里可以使用无密码登录？

您可以在任何支持的平台上使用这种登录方式。目前，Windows 10、运行 Android 7 或更高版本的 Android 设备、Mozilla Firefox、Google Chrome、Apple Safari 和 Microsoft Edge 都支持这种登录方式。此外，许多应用程序（尤其是银行应用程序）都采用了这种登录方式。例如，PayPal 可以让您使用指纹通过应用程序登录。

Use a VPN if there’s no passwordless login – IPBurger VPN

IPBurger VPN uses the unbreakable AES 256 bit standard to encrypt your internet traffic. This secures your passwords and other login information as they traverse the internet to their destination. This encryption ensures prying eyes such as cybercriminals have no access to your data. And if they intercept it, they won’t be able to decrypt it since they won’t have the key.