Passwordless authentication is a modern way to verify a user’s identity without the user needing to remember a password. Passwords have been proven to be insecure because, as humans we love to reuse passwords, choose easy-to-guess passwords (e.g. password123), and digital platforms don’t do a great job of keeping our passwords safe from theft.
By eliminating the requirement to use a password, passwordless authentication is inherently more secure. And with the proliferation of passwordless authentication factors, organizations are not limited in where, when and how a customer should be prompted to authenticate.
Types of Passwordless Authentication
There are different types of passwordless authentication factors, satisfying at least 2 principles of multi factor-authentication, which are as follows, knowledge based (something only the user knows), possession based (something only the user has), and inherence (something only the user is). At Authsignal, we support the following factors:
SMS One Time Passwords (OTP)
SMS authentication, also known as SMS-based two-factor authentication (2FA) and SMS one-time password (OTP), allows users to verify their identities using a text message-based code.
It is a type of two-factor authentication that frequently acts as a second verifier for users to gain access to a network, system, or application and is a good first step towards improved security.
It should be noted, however, that SMS authentication is widely regarded as a weak form of verification because of a new kind of attack known as Sim Swapping. Authsignal has developed tools to mitigate against this attack through our Sim Swap Shield feature.
Time-Based One Time Passwords (TOTP)/Authentication Apps
Time-based One-Time Passwords, or TOTPs, are a popular type of two-factor authentication (2FA). A standardized technique uses the current time as an input and creates distinct numeric passwords. When utilized as a second factor, time-based passwords offer convenient, improved account security and are accessible offline. The use of TOTP is popularized with Authenticator Apps, like Google Authenticator, Authy, and Microsoft Authenticator.
It is regarded that TOTP should be used over SMS OTP due to the inherent security features it provides and its mitigation over issues like Sim Swapping inherent in SMS.
Email Magic Links
Email magic links is an email that gets sent with a one-time use link, this enables users to verify their identity upon clicking. Although very simple, email magic links only provide an adequate level of assurance due to the fact that not all email accounts can be guaranteed to be secure. Use this as a base level of passwordless authentication, and pair it with another factor to achieve a higher level of security.
WebAuthn/FIDO2
The Webauthn is a specification that allows enabled browsers to accept authenticator types like Biometrics (FaceID, Fingerprint readers) and secure hardware keys (Yubikey) This form of authentication factor is by far the most secure, the easiest and therefore the most frictionless to the end user.
Implementing Passwordless Authentication
At Authsignal, we make it easy to introduce passwordless authentication factors even if you have an existing application leveraging passwords or other sign-in methods like Single Sign On, we believe the best way to do this is to allow users to opt-in and enforce step-up authentication in different parts of your application. By doing this, you are inherently achieving all three principles of multi-factor authentication and moving towards a passwordless future.
Authsignal manages all the authentication factors on your behalf, so you and your engineers don’t have to figure out the complexities of how to build each one to best practice. Not only saving your team’s time, but it ensures that your end users are going to experience the best possible flows to maximize adoption. Our easy-to-use APIs, SDKs and simple-to-use integrations like (Authsignal MFA for Auth0) allow you to drop-in step up challenges anywhere in your customers’ user journey on both web and mobile.
To view the comprehensive documentation, check out our Developer Docs, sign up to Authsignal and start enabling Passwordless Step-up Authentication in your app.
.svg)
