January 6, 2016 By Larry Loeb 2 min read

The war on password use has been waging on for some time now. Passwords are a relic of the days when computers were stand-alone boxes and hardly ever networked; the damage of a bad login was limited to one account at one location. But a networked computer can do far more damage.

FIDO Takes a Stab

The FIDO Alliance was one of the first organizations to experiment with a viable password alternative. According to the group, the goal is “to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to securely authenticate users of online services.”

Those are lofty aspirations, to be sure. The group first concentrated on specs and standards for hardware such as dongles and fingerprint readers embedded in devices. But the effort has never really gained traction in the authentication field and has so far come up short of developing widely adopted solutions.

Google Tests a Password Variant

Google has begun a test of another authentication system that uses a common hardware device: your smartphone. An individual who was granted early access to the technology recently posted the details on Reddit.

It seems simple enough: To sign on, an email address is entered and the phone number associated with that address receives a notification. One of the three numbers present in the notification is pressed, depending on the instructions from Google. Once this challenge is completed, login proceeds. The mobile device must have a secured lock screen so only the owner can access it.

This approach gets around the rigidity of biometrics. Fingerprints never change; once they are used as a key, invariance is a big problem. If stolen somehow, they can be used by a bad actor who knows that the print will always be valid.

This new method is different than the two-factor authorization Google uses in its Authenticator app. It’s easier to use because no additional typing by the user is needed. That could lead to greater adoption since ease of use is always a bonus when trying to get users to accept new practices.

Yahoo Did It First

The Yahoo Account Key was introduced by Yahoo in 2015 as part of its Mail redesign. It’s basically a push notification sent to a smartphone that allows account login. It links your Yahoo account to a mobile device, likely a smartphone.

It works this way: When logging in to Yahoo Mail on the Web, the email address is entered, then the password field selected. Yahoo recognizes that the feature is enabled and sends a push notification to the phone. Approval or denial of the login can then be performed from the phone.

While Yahoo said at the time of introduction it would implement this approach to its other services, that has yet to happen. But now that Google has jumped on board, Yahoo may seek to catch up.

The Smartphone Is the New Dongle

The latter two approaches use the smartphone as the hardware key to the account. To gain access, one must have an active mobile device on hand.

The true question here is how many users will adopt this approach. If the old, cumbersome method of passwords can be supplanted by these new ways, companies that adopt them will be in a better position to deliver services with less bother to users. If cybercriminals or even petty thieves catch up to this technology, however, it could have dire consequences.

More from Identity & Access

Access control is going mobile — Is this the way forward?

2 min read - Last year, the highest volume of cyberattacks (30%) started in the same way: a cyber criminal using valid credentials to gain access. Even more concerning, the X-Force Threat Intelligence Index 2024 found that this method of attack increased by 71% from 2022. Researchers also discovered a 266% increase in infostealers to obtain credentials to use in an attack. Family members of privileged users are also sometimes victims.“These shifts suggest that threat actors have revalued credentials as a reliable and preferred…

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

Obtaining security clearance: Hurdles and requirements

3 min read - As security moves closer to the top of the operational priority list for private and public organizations, needing to obtain a security clearance for jobs is more commonplace. Security clearance is a prerequisite for a wide range of roles, especially those related to national security and defense.Obtaining that clearance, however, is far from simple. The process often involves scrutinizing one’s background, financial history and even personal character. Let’s briefly explore some of the hurdles, expectations and requirements of obtaining a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today