Why Passwords May Soon Be a Thing of the Past

Is it really fair to ask users to come up with a strong, unique password for each account? Most users would say no. The average user has nearly 200 passwords — an overwhelming number that encourages risky practices. Many users write down their passwords, store them in spreadsheets, and reuse them across multiple accounts.

Unfortunately, eliminating the password has proven difficult. Most organizations still use passwords as part of their cybersecurity practices, sometimes adding multifactor authentication (MFA) to bolster security. MFA requires users to provide two or more verification factors in order to log in, such as a password and a one-time PIN. However, MFA does not address the challenges of managing multiple unique passwords.

Passwordless authentication may offer a better approach. It leverages the same principles as MFA using digital certificates. Public and private encryption keys are generated for each user account, with the private key stored on the user’s local device and tied to an authentication factor. To access the account, the user unlocks the private key by entering a PIN, using facial recognition or some other method. Authentication then proceeds automatically.

Benefits of passwordless authentication include:

• Significantly stronger security

• Faster, easier authentication

• Fewer password reset requests

• Enhanced user experience

• Reduced risk of account takeover attacks

Passwords are not likely to go away soon, and NetAscendant is not making a recommendation for change at this point. With this said, passwordless authentication is on the horizon. Several large enterprises have already made the switch to passwordless, and many others are in the process of doing so. When your organization decides to make the change, know that it is all in the name of lower costs, improved productivity, better security and fewer headaches for you.