The Elimination of Cybersecurity's Status Quo – Passwords

According to a report by the World Economic Forum, in the year 2020, cybercrime cost the world economy a staggering $2.9million every minute. According to another report, every single day, enterprises lose about 5 million records containing sensitive data due to vulnerability in their system or a human factor failure. 

A cybersecurity attack could have serious short-term or long-term damages for both users and businesses alike. For users, a cybersecurity attack could lead to data and identity theft, while for businesses, it could imply serious financial and legal implications and, in a worst-case scenario, a malicious attack could even sabotage your business and its operations to an extent that it may never be able to recover from.

Cybersecurity’s Worst Nightmare

Passwords launched in 1961 and ever since then have been a staple in enterprise and customer authentication. However, despite being a ubiquitous form of authentication, passwords have always been a sore topic in cybersecurity. After over 60 years, weak or stolen passwords have proven to be the leading cause of security risks and data breaches, which have only increased as more employees have transitioned to working from home. 

The problem with passwords isn’t hard to explain. There is a limit to how many complex passwords users can try to remember without forgetting or developing bad password hygiene: users taking security risks in order to reduce the inconvenience that plagues passwords. With the number of online accounts a user has to remember increasing in recent years, this problem is bound to get worse.

Due to the fact that passwords are so much of a headache, people result to using simple, similar, or the same passwords for different accounts, writing them down post-it notes, or storing them on insecure computer files. The habit of creating bad passwords is so common the most popular passwords can be hacked and intercepted within seconds. 

Password-Based MFA

Authentication technology has come a long way from what you know (passwords or shared secrets) to other forms of authentication: who you are (fingerprint, face, and iris scanning) and what you possess (key cards or access tokens/badges). Password-Based Multi-factor Authentication (MFA) simply makes use of newer improvements to authentication in combination with traditional means like passwords. 

MFA gained mass adoption as more and more manufacturers equipped their mobile devices with secure and reliable biometric technology like face, iris, and fingerprint scanning. Password-Based MFA, by combining different forms of authentication, is far more secure than traditional password authentication, it also provides users and enterprises with an easier-to-use and seamless experience.

True Passwordless Authentication 

Although password-based MFA is the default for many users and enterprises when it comes to solving password problems, it still includes passwords as an option for multi-factor layering rather than completely getting rid of the problem. Password-based MFA technology may come with the promise of better security, however, it doesn't quite deliver like true passwordless technology, which has the added advantage of completely removing passwords.

By completely eliminating passwords, not only does passwordless authentication vastly improve ease of use, seamlessness, and security, it also eliminates the habits that lead to users developing bad password hygiene: creating and remembering various complex passwords for different online accounts. It doesn’t hide passwords behind another more secure authentication means, therefore there’s no vulnerable password database for hackers to attempt to steal for.

Rather than being stored in a centralized location, private keys are generated from and stored on users’ devices guaranteeing maximum security. Passwordless technology grants users the privilege of having a completely passwordless identity that works with a public-private key share; a private key that may be the user’s trusted device, and a public key stored on a server for validation.

Instead of passwords, passwordless authentication systems verify users’ identities with two main factors: A possession factor (something you have) and an inherent factor, (something you are). Different passwordless authentication technology may take different approaches in verifying users, however, they all have one thing in common: they don't store users’ data within a system, this is what makes passwordless technology inherently more secure than traditional and password-based security technology. 

A Future of Better Security

More than ever, it is becoming clearer that passwords are more of a burden than they are a security tool. Due to bad password hygiene, data breaches are bound to happen when employees create and manage numerous, complex passwords. Every day, as new threats, challenges, and vulnerabilities emerge, the need for security technology to adapt to the ever-changing cybersecurity landscape becomes more evident. 

Not only does passwordless authentication eliminate a hacker’s favorite target, but it also makes the otherwise strenuous process that is authentication far more secure, seamless and convenient. It provides more privacy to consumers and eliminates dependence on a centralized credential store, making it harder for hackers to breach, all while ensuring ease of use isn’t compromised. 

The elimination of passwords in place of passwordless authentication is not only crucial in the elimination of the majority of data breaches but one which is inevitable, mainly because passwords have become one of the main sources of frustration for IT teams who have been trying to get rid of them over the past few years. According to a LastPass report, 92% of IT professionals believe Passwordless technology is the future of their enterprises’ security.

And as a number of big tech companies join the FIDO Alliance: an open industry association that aims to reduce the industry’s reliance on passwords, it is getting more clear than ever that passwords aren’t here to stay. The cybersecurity industry has been just too reliant on a technology that is outdated and insecure in practice.