The war on password use has been waging on for some time now. Passwords are a relic of the days when computers were stand-alone boxes and hardly ever networked; the damage of a bad login was limited to one account at one location. But a networked computer can do far more damage.

FIDO Takes a Stab

The FIDO Alliance was one of the first organizations to experiment with a viable password alternative. According to the group, the goal is “to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to securely authenticate users of online services.”

Those are lofty aspirations, to be sure. The group first concentrated on specs and standards for hardware such as dongles and fingerprint readers embedded in devices. But the effort has never really gained traction in the authentication field and has so far come up short of developing widely adopted solutions.

Google Tests a Password Variant

Google has begun a test of another authentication system that uses a common hardware device: your smartphone. An individual who was granted early access to the technology recently posted the details on Reddit.

It seems simple enough: To sign on, an email address is entered and the phone number associated with that address receives a notification. One of the three numbers present in the notification is pressed, depending on the instructions from Google. Once this challenge is completed, login proceeds. The mobile device must have a secured lock screen so only the owner can access it.

This approach gets around the rigidity of biometrics. Fingerprints never change; once they are used as a key, invariance is a big problem. If stolen somehow, they can be used by a bad actor who knows that the print will always be valid.

This new method is different than the two-factor authorization Google uses in its Authenticator app. It’s easier to use because no additional typing by the user is needed. That could lead to greater adoption since ease of use is always a bonus when trying to get users to accept new practices.

Yahoo Did It First

The Yahoo Account Key was introduced by Yahoo in 2015 as part of its Mail redesign. It’s basically a push notification sent to a smartphone that allows account login. It links your Yahoo account to a mobile device, likely a smartphone.

It works this way: When logging in to Yahoo Mail on the Web, the email address is entered, then the password field selected. Yahoo recognizes that the feature is enabled and sends a push notification to the phone. Approval or denial of the login can then be performed from the phone.

While Yahoo said at the time of introduction it would implement this approach to its other services, that has yet to happen. But now that Google has jumped on board, Yahoo may seek to catch up.

The Smartphone Is the New Dongle

The latter two approaches use the smartphone as the hardware key to the account. To gain access, one must have an active mobile device on hand.

The true question here is how many users will adopt this approach. If the old, cumbersome method of passwords can be supplanted by these new ways, companies that adopt them will be in a better position to deliver services with less bother to users. If cybercriminals or even petty thieves catch up to this technology, however, it could have dire consequences.

More from Identity & Access

How to Keep Your Secrets Safe: A Password Primer

There are two kinds of companies in the world: those that have been breached by criminals, and those that have been breached and don't know it yet. Criminals are relentless. Today’s cyberattacks have evolved into high-level espionage perpetrated by robust criminal organizations or nation-states. In the era of software as a service (SaaS), enterprise data is more likely to be stored on the cloud rather than on prem. Using sophisticated cloud scanning software, criminals can breach an enterprise system within…

Making the Leap: The Risks and Benefits of Passwordless Authentication

The password isn't going anywhere. Passwordless authentication is gaining momentum, though. It appears to be winning the battle of how companies are choosing to log in. Like it or not, the security industry must contend with both in the future.  But for some businesses and agencies, going passwordless is the clear strategy. Microsoft, for instance, has recently stopped forcing users to use a password to access their account, which allows access to a wide range of Microsoft business and personal…

Old Habits Die Hard: New Report Finds Businesses Still Introducing Security Risk into Cloud Environments

While cloud computing and its many forms (private, public, hybrid cloud or multi-cloud environments) have become ubiquitous with innovation and growth over the past decade, cybercriminals have closely watched the migration and introduced innovations of their own to exploit the platforms. Most of these exploits are based on poor configurations and human error. New IBM Security X-Force data reveals that many cloud-adopting businesses are falling behind on basic security best practices, introducing more risk to their organizations. Shedding light on…

Why Your Success Depends on Your IAM Capability

It’s truly universal: if you require your workforce, customers, patients, citizens, constituents, students, teachers… anyone, to register before digitally accessing information or buying goods or services, you are enabling that interaction with identity and access management (IAM). Many IAM vendors talk about how IAM solutions can be an enabler for productivity, about the return on investment (ROI) that can be achieved after successfully rolling out an identity strategy. They all talk about reduction in friction, improving users' perception of the…