Passwordless Authentication

Passwordless authentication is technically any type of authentication that does not rely on the traditional username/password combo. Fingerprint or Face ID on your smartphone, the RFID badge that opens doors at work – all these count as passwordless methods.

When it comes to network access, passwordless means certificate-based authentication, which means your device gets a digital certificate that is used to verify access to company resources (networks, devices, applications, etc.) While usernames verify people, certificates verify devices, and that makes them much more secure.

The obvious reason is increased security. Certificate-based authentication lets your IT administrators control which devices can access the network by controlling when and how to distribute certificates, which is a huge benefit to security, especially if you incorporate cloud-based application access control.

Surprisingly, though, passwordless authentication is also a much better user experience. Oftentimes increased security means increased annoyance with trying to get any work done, but the beauty of passwordless authentication is that you don’t have to remember a million different, oddly complex passwords for each resource you need – all the authentication is done by the client (your device) and the server, so you just open your laptop or unlock your phone and go.

The truth is users (and we are all users) are terrible about secure password practices. We re-use passwords, we store them in unencrypted files, we never change them unless we’re forced to, we make them easy to guess, and let’s not talk about those phishing e-mails we click on. It’s no wonder that most cyber breaches can be traced back to a compromised credential.

By contrast, digital certificates are issued by a Certificate Authority (a trusted organization that makes sure you are who you say are before issuing the certificate), encrypted using the PKI (public key infrastructure) and really, the only danger is if someone gets physical access to the device which is much more difficult than guessing your clever P@ssw0rd!

MFA, or Multifactor Authentication, is when you combine something you know (your password) with something you have (a face, a fingerprint, a smartphone, etc.) It’s better than passwords alone, but it’s still not better than passwordless.

MFA is much easier to bypass than you would think. A new technique called “MFA Fatigue” is when a hacker spams multifactor requests to a compromised user's phone – if you’re using an app that does push notifications, it only takes one time to accidentally click allow (and let’s be honest, we’ve all clicked “OK” on an error message when we meant to click “Cancel”) and then the hacker is in. Social Engineering can also be a factor – in 2022, Uber was breached when the hacker called an employee and pretended to be from Uber’s IT team and got them to accept the MFA request.

In the same scenario, if someone called you, there’s no information you could give them about the certificate that would matter - they would still need physical access to your device to gain entry onto the network.