Is passwordless authentication safe?
Hi, everyone.
Leo Notenboom here for Askleo.com.
Ask Leo is brought to you in large part by the support of its patrons.
Askleo.com/patron has more information
about how you can help and get access to Patreon exclusive content.
So recently Microsoft announced
the ability to remove your password from your Microsoft account.
The account would have no password at all.
Passwordless authentication would be used instead.
What does that even mean?
How can that even work?
And yet,
as it turns out, there are scenarios, and some reasoning
behind this option, that allow it to be safer than some of the alternatives.
Let's examine just exactly what passwordless authentication means.
One of the best ways to think about
passwordless authentication is to think of it as
two factor authentication without the first factor.
So, for example, a normal login is a username and a password.
That's your first factor.
And for many sites, it's your only factor.
You only need to know your password and your user ID, and you're able to log in.
Two factor authentication adds an additional requirement to that.
That additional requirement can be typing in a code off of an Authenticator device.
It can be responding to an SMS message.
It could be interacting with an app on your phone.
It could be getting an email message
and gathering a code or clicking on a link that was provided in that link.
So now we have two factors.
The first factor, the password that you still need to know,
and then the second factor, this alternate authentication mechanism.
What happens if we take away the first factor?
Well, what we're left with is single factor authentication.
Just using a different factor.
It's
almost the same
security wise
as single factor authentication using a password.
There are differences. Don't get me wrong,
but it's actually not as crazy as you might think.
Let's have a quick look and I'll show you how this works.
I have an account on Medium.com. Medium.com
is a writing and reading site.
They've got lots of articles and lots
of good information, a lot of Internet writers right out there.
So to sign in,
you have an option of signing in with all of these third party sign in providers,
which in general, I don't recommend and I don't use myself.
So you have this option to sign in with email.
When you do that, I enter my email address here,
I hit continue.
And now it says, Click the link we sent to your email address to sign in.
That's it.
That's your second factor.
In a two factor authentication.
They sent an email to an associated email account.
Your ability to get that link, to click
on that link, is then what authorizes you to log in.
It confirms that you are who you say you are.
You are the owner of that email address,
and therefore you should be allowed into the site.
There's no password.
Medium doesn't have a password associated with my account
that actually has some really interesting, interesting,
ramifications.
There's no password stored,
which means there's no password to steal.
There's no password for Medium to have to keep track of.
There's no password for them to be able to have to let you change or reset
or send a reminder or any of those kinds of things.
They don't have to track that at all.
It's much, much simpler for them.
And from our perspective,
from my perspective, as a user, it's not that inconvenient.
If there's ever a data breach at Medium,
there's no password to be stolen.
Whoever gets the data
won't have any more login information than they had when they started.
There's nothing to be stolen.
Even better.
A keylogger on my machine.
If I had one again, I'm not logging in with a password.
There's nothing I Typed.
There's nothing to log.
There's nothing to compromise
since I'm not using passwords, there's no password reuse.
If I'm using the same password on multiple
sites, a breach somewhere else could potentially have compromised my Medium dot
com account if Medium was using passwords, but they're not.
Phishing attempts that try to trick you into typing your password.
They're not going to work because there's no password to type in.
You get the idea. There's a whole lot of things going on with passwords
that simply go away when you stop using passwords.
Now, I've got to say,
passwordless authentication is not perfect.
It does rely on that. Something else.
That's something else you have access to.
If, for example,
I lose access to the email account associated with my medium account,
I can't log in to my medium account
if I lose my second factor, whatever that second factor is, be it
an email account, an SMS number, a Google Authenticator app.
Any of those kinds of things then?
Yeah, that actually could cause some real problems
in passwordless authentication scenarios.
They're the same problems we would encounter if we'd lost our password,
but in this case, we've lost our second factor,
which is now our only factor for logging into these passwordless sites.
Good, I like it.
I do use it.
There is one other thing that
doesn't impact most people, but it does impact me.
My emails path is,
I'll just say, nonstandard.
For example, when you send an email to me, it actually goes through multiple
different steps before it arrives in my inbox.
In other words, there's time involved.
It can be five minutes or ten minutes before I actually get the message.
If I'm trying to log into a site like Medium, I kind of like to log in
now. I kind of wish Medium had the option
to have a password so that I could log in right now, but they don't.
So whenever I log into medium,
I know that I'm going to enter my email address, hit send me that link,
and wait
a couple of minutes later that email shows up.
I click on the link and I'm in.
But there's that delay. Email was never, ever designed to be immediate.
The fact that it is most of the time these
days turns out to be pretty convenient for these kinds of scenarios.
But for those of us that have delays
for other reasons, it can be a little bit of an inconvenience.
And I have to say
two factor, true two factor authentication remains the gold standard.
It really is more secure than any approach to single factor
authentication, be it passworded or passwordless.
Having both a password and something else
is the best way to secure your account
and remains what I suggest you use whenever possible.
I hope that helps you understand a little
bit about what passwordless login is all about.
For updates for related links for comments and more, visit
askleo.com/137786
I'm Leo Notenboom, this is askleo.com.