What Are the Different Types of Passwordless Login?

Passwords don’t cut it anymore. About 80% of hacking-related breaches can be traced down to weak passwords, according to a 2019 data breach report. Experts tell users to change their passwords often.

But memorizing different passwords for different accounts is a challenging feat. This password problem will be around for a while. Cybersecurity experts are looking at passwordless login to address the issue. Read more to learn the different types of passwordless login and their applications.

Passwordless Authentication: Defined

Passwordless authentication came in the late ’60s. It turned out more popular in the 1980s with one-time passwords, which came from a time-based one-time password (TOTP) computer algorithm that uses time as an input. This authentication method replaced the methods based on what the user knows.

Passwordless authentication combines factors based on what the user has and is. An example is using a smartphone app (user has) to generate an encrypted key or employing a fingerprint (user is) biometric authentication.

Experts categorize passwordless authentication based on these methods: fully or not fully passwordless. Fully passwordless (first-tier authentication) include hardware security tokens, biometrics, and certificate-based authentication. These first-tier methods show a higher security level than the second-tier (or not-fully passwordless) authentication methods.

Second-tier methods consist of one-time passwords (OTPs), email magic links, and authenticator applications.

6 Types of Passwordless Login

1. Authenticator apps

Authenticator apps work well as backup security because users employ them whenever they forget their passwords. It uses two-factor login codes through text messages. But for these apps to work, users must ensure that the time setting is the same for mobile devices and computers. Otherwise, the code may come in late, and the user may be unable to use the code within the duration (e.g., five seconds).

2. Biometric authentication

Biometric authentication consists of fingerprint, voice print, retinal scan, and facial recognition. Of the four authentication methods, fingerprints are more prevalent. It confirms the user’s identity through the friction ridges of their fingers.

The voice print analyzes the user’s voice for its acoustic patterns. A retinal scan works by scanning the user’s eyes, particularly their retina. Authentication by facial recognition involves the analysis of the user’s facial features.

A significant drawback is when someone steals or ‘spoofs‘ the device with the biometric data. Think of it this way: If someone steals or compromises a password, the user can merely revise it. But he cannot do the same thing to a compromised fingerprint or iris.

3. Email magic links

Email magic links are second-tier passwordless logins. With passwords, users would have to input their username and password. But with an email magic link, users only need to enter their email addresses. Users will click the magic link they receive and then log in.

Magic links boast of smoother user experience and authentication. Because it doesn’t require entering any passwords, users can expect zero password breaches. Email magic links work best when users don’t need to authenticate often. Also, magic links complement well with other passwordless logins like device authentication.

4. Certificate-based authentication

Certificate-based authentication (CBA) leverages cryptography to provide users with a digital certificate. Systems use this certificate to identify the user. Experts combine this method with other authentication methods.

CBA reinforces password-based authentication through its high security. However, it’s less affordable than other authentication methods. Its costs include one-time purchase and renewal.

5. Hardware security tokens

Hardware security tokens are popular passwordless logins. These tokens consist of small hardware devices like key fobs, smartcards, or USB keys. People are also more familiar with car remotes, which are hardware security tokens.

Users receive encrypted keys through a hardware security token. This key serves as the password for the authentication. But tokens are prone to be lost or broken. They involve high IT management costs and can be difficult to distribute to remote team members.

6. One-time password

One-time passwords or OTPs are generated either through smartphone apps or websites. It provides users with a string of numeric or alphanumeric characters, which are only used once (per login). A significant drawback is that OTPs can be delayed. Depending on the email settings, OTPs might not appear in the user’s inbox. Instead, in the spam folder.

Addressing Cybersecurity Problems With Passwordless Login

A growing number of cyberattacks reveal many weak points in today’s business systems. It’s no longer enough to depend on IT teams or employees to do the heavy lifting. When it comes to cybersecurity, technology holds a key. It may take the form of encrypted keys and codes or a retinal scan. But not choosing which passwordless solutions to use will involve higher costs and long-term impacts as cyber attackers ramp up their attacks in several industries.