Tired of remembering a few words you created six months ago with at least 8 characters, one capital letter, one number and a special symbol? The move to passwordless authentication is getting closer.
Nobody is pleased at the prospect of clearing their cookies to fix an IT problem. That’s because it means losing automatic sign-in to every website and app on the internet — and who can remember all those different passwords?
They are all different, right?
On World Password Day, 5 May, security experts and technology companies took the opportunity to brief the industry on the initiatives they are undertaking to build a future that keeps us safe without passwords. It can’t come soon enough.
The problem with passwords
According to SpyCloud’s 2022 Annual Identity Exposure Report, reused passwords have been a main avenue for cyberattacks over the past few years. The report also notes a 64% password reuse rate over the past year among users with more than one password.
But how do you remember all those passwords? A 2021 NordPass study shows that the most popular password that year was “123456”, and the fifth most popular was the word “password”.
Clearly something has been broken in the world of passwords for a long time. And while multi-factor authentication provides an extra layer of security for organisations, it also reduces productivity by forcing employees to interrupt their work to enter a code or provide a fingerprint. The more inconvenient security measures are, the more likely users are to look for ways around them — for example, by reusing passwords.
Moving towards dropping passwords
“Eliminating passwords altogether once sounded like a bold idea,” says Greg Stucklin, vice president and general manager for North America at WSO2, a company that builds, among other things, an identity server. “That’s no longer the case, especially considering Verizon’s 2021 Data Breach Investigations Report, which found that compromised credentials such as usernames and passwords account for more than 84% of all data breaches.”
Stucklin says there are simpler and more effective ways to authenticate users, including alternative sign-in options such as the Fast ID Online 2.0 (FIDO2) standard, biometrics, security keys and plug-in authenticators.
Mark Ruchie, chief information security officer at Entrust, a digital security and data protection company, says mobile push tokens, certificate-based credentials and various forms of biometrics can provide a smoother employee experience and a stronger security infrastructure with a smaller attack surface for a wide range of threats.
“As cyberattacks become more sophisticated and new technical talent becomes scarcer, businesses realise that passwords are a headache not only for IT departments but for employees too. They are the bane of every CISO’s life,” says Ruchie.
Apple, Google and Microsoft expand FIDO support
This week, to mark World Password Day, the three tech giants pledged to expand FIDO support. According to a statement published by the FIDO Alliance, Apple, Google and Microsoft announced they are accelerating the availability of passwordless sign-in. All three already support the Alliance’s standards, but this week’s announcement adds two new capabilities: letting users automatically access their FIDO sign-in credentials, or “passkeys”, across devices without re-enrolling every account; and letting users use FIDO authentication on their mobile device to sign in to an app or website on a nearby device, regardless of the OS platform or browser.
Sampath Srinivas, Google’s product manager for secure authentication, said on Google’s blog that the company will implement passwordless support for FIDO sign-in standards in Android and Chrome.
On Microsoft’s Tech Community site, Alex Simons, corporate vice president of product management in the Identity and Network Access division, wrote that the company is introducing several new capabilities, including passwordless access for Windows 365, Azure Virtual Desktop and virtual desktop infrastructure. According to Simons, these features are currently in preview with Windows 11 Insiders.
Windows Hello for Business Cloud Trust is a new deployment model that can remove the earlier requirements for public key infrastructure and for syncing public keys between Azure Active Directory and on-premises domain controllers. Microsoft Authenticator now supports multiple accounts instead of just one, starting later this month on iOS devices, with Android to follow. In addition, from next month Microsoft will add a Temporary Access Pass to Azure AD: a time-limited passcode that lets organisations set up new Windows devices without using a password.
These advances should be a welcome change for both business and consumer users frustrated by trying to remember multiple passwords.
“On World Password Day, let’s commit to freeing consumers from passwords and instead giving them advanced alternatives that make protecting their data — and yours — easier than ever,” says Stucklin.
Read at the source (in Russian): https://bit.ly/3nktVEo