Passwordless Authentication and Passwordless Security
It’s no secret — passwords can be a real headache, both for the people who use them and the people who manage them. Over time, we’ve created hundreds of passwords, it’s easy to lose track of them and they’re easily compromised. Fortunately, passwordless authentication is becoming a feasible reality for many businesses. Duo can help you get there.
What is Passwordless Authentication?
Passwordless authentication is the term used to describe a group of identity verification methods that don’t rely on passwords. Biometrics, security keys, and specialized mobile applications are all considered “passwordless” or “modern” authentication methods.
Passwordless provides secure access for every enterprise use case (hybrid, cloud, on-premises and legacy apps). Duo is innovating toward a true passwordless future that balances usability with stronger authentication. Passwordless gives users a frictionless login experience, while reducing administrative burden and overall security risks for the enterprise.
How Passwordless Works
Passwordless authentication ideally involves less user interaction during the login process than traditional forms of authentication. It uses public key cryptography, which authenticates the user with a pair of cryptographic keys — a private key that’s a secret, and a public key that isn’t — and it comes with a lexicon of new (or relatively new) acronyms and standards like FIDO2 standard (FIDO stands for Fast IDentity Online and FIDO2 is just an umbrella term for the combination of WebAuthn and Client to Authenticator Protocol [CTAP]).
Implementing passwordless is no small task, especially when you’re dealing with large user populations, a substantial number of apps, hybrid infrastructures and complex login flows. Achieving a completely passwordless environment is a journey that involves a phased approach as technology continues to evolve and user adoption increases. Although complete elimination of passwords is still far off, reducing reliance on them is already feasible by implementing multi-factor authentication (MFA), establishing trust in devices, leveraging single sign-on (SSO) and implementing adaptive access policies.
Why Passwordless Matters
Passwordless authentication isn’t just a nice-to-have — it can actually improve an organization’s security posture and reduce costs associated with password management. Passwords create higher friction for users, slow down business productivity, and are inherently a weak form of user authentication.
Costly and Burdensome to Manage
20-50% of all IT help desk tickets each year are for password resets (Security Boulevard)
Each year, U.S.-based enterprises allocate over $1 million to password-related support costs (Forrester)
Poor User Experiences
The average enterprise uses 1,400 different cloud services (SkyHigh Networks)
The average business user must log in with as many as 190 passwords (Security Magazine)
Easily Compromised
Passwords that are easily detectable or reused often are vulnerable to phishing attacks. Over 80% of hacking breaches involve brute force or the use of lost or stolen credentials. (Verizon DBIR)
Why Implement Passwordless?
Passwordless authentication provides a single, strong assurance of users' identities to achieve user trust. For enterprises, this means:
Better User Experience
A reduction in user frustration and an increase in user productivity.
Reduced IT Time and Costs
A reduction of the administrative burden of password-related help desk tickets and password resets.
Stronger Security Posture
The elimination of threats and vulnerabilities related to passwords (phishing, stolen or weak passwords, password reuse, brute-force attacks, etc.).
Is Passwordless A Good Choice For Me?
If your business has a goal of reducing the security risk associated with passwords, the answer is almost certainly “yes.” Identity is becoming the new perimeter, and to secure it, companies must put access controls around both users and their devices — also known as the “workforce.”
To address this, many organizations are adopting a zero-trust security approach, under which trust is verified at each access attempt. The best security should be invisible and have minimal impact on the productivity of users.
With security education and multi-factor authentication (MFA), breaches due to stolen passwords can be prevented 99.9% of the time.
- 2020 Verizon Data Breach Investigations Report (DBIR)
Passwordless authentication is a key part of verifying user trust, in a more user-friendly, simplified and secure way. However, there are a few factors that will determine the level of effort involved in implementing passwordless. If you have a complex hybrid environment, it’s going to be more difficult to transition to passwordless.
We recommend having a few technical experts assigned specifically to your passwordless project, so that you can address any issues as they arise. When done correctly, however, a passwordless approach significantly minimizes the likelihood of a breach due to stolen credentials.
The Life and Death of Passwords
Learn from security experts how information security evolved toward passwords, how we can achieve security resilience without passwords, and what we foresee for the future of passwordless security.
The Solution: A Journey to Passwordless
With strong MFA, SSO, adaptive access policies and device trust capabilities, you can lay the foundation for a passwordless experience today. We recommend taking a phased approach to securing access for the workforce, with each step taking you closer to a fully passwordless future:
.png)
1. Identify use cases and enable strong authentication.
Start your passwordless journey by reducing your reliance on passwords. Pursue passwordless for only a few use cases at a time, and lower the risk of credential theft with strong authentication.
CORRESPONDING DUO PRODUCTS:
Duo MFA
MFA protects users’ credentials with a strong security layer that thwarts account takeover. Once MFA is enabled for all applications, you can require fewer password resets, getting you one step closer to a passwordless experience.
Duo MFA is available in all Duo editions.
.png)
2. Streamline authentication workflows.
For Cloud apps, use single sign-on (SSO) for SAML-based applications. For on-premise services, integrate application workflows using access and authentication proxies.
CORRESPONDING DUO PRODUCTS:
SSO and Duo Central
Leveraging federated logins protected with MFA is a great next step toward passwordless. Integrate Duo with an existing single-sign-on (SSO) platform, or implement its alternative SSO options for SAML based applications.
Duo SSO and Duo Central are available in all Duo editions.
.png)
3. Increase trust in authentication.
Apply adaptive access policies based on the context of the user, device, location, behavior, and more, to ensure authentications can be trusted.
CORRESPONDING DUO PRODUCTS:
Access Policies and Device Trust
Detect anomalous user behavior and spot risky devices with policies that provide contextual signals around each access attempt. This visibility helps you verify that users are who they say they are, and that they’re using healthy devices to access your data.
Access Policies and Device Trust are available in Duo’s Access and Beyond editions.
.png)
4. Provide a passwordless experience.
Enable users to log in using a single biometric authenticator (or security key) to access applications at the point of federation.
CORRESPONDING DUO PRODUCTS:
WebAuthn MFA and Agnostic Integrations
Duo supports password-free open standards, such as WebAuthn, as MFA methods for SAML applications. This functionality lets organizations establish a passwordless login workflow for cloud apps, without ripping and replacing existing infrastructures.
WebAuthn and Agnostic Integrations are available in all Duo editions.
Optimize your passwordless toolset
The final step in the journey is integrating the technology and moving towards continuous improvement. True passwordless will eliminate reliance on passwords for any login workflow, either behind the scenes or throughout your users’ experiences.
A fully passwordless product
While federation provides a starting point, enterprise companies are filled with complex use cases, including OS login and protecting legacy applications.
There is work to be done to provide passwordless homogeneously throughout an environment and organizations will move iteratively towards a true passwordless future, tackling one use case at a time.
This is the challenge in the market today that passwordless-pioneering technology platform providers need to solve. Duo is working on support for a comprehensive ecosystem that enables passwordless across every enterprise use case.
Passwordless Authentication from Duo
Passwordless Resources
Learn more about what Duo is doing to pave the way for a passwordless future by working to make passwordless technology and standards open, accessible and easy for the broader community.
Related Topics
More About MFA
Duo’s MFA is the foundation for any passwordless security strategy. MFA minimizes the risk that compromised credentials of any kind can be used to access your applications.
More About Single Sign-On
Duo’s Single Sign-On lets you streamline access to any and every application, reducing the number of passwords users need to manage.
More About Authentication Methods
Duo gives you granular control of the authentication methods available to your users. Allow the ones that meet your security needs and block the ones that don’t, based on who’s accessing which application, and how.
Passwordless: The Future of Authentication
A world without passwords is closer than you think. In this guide, we'll explore the considerations associated with a shift to passwordless, dig deeper into what is achievable today, and plot a five-step phased approach to your organization can follow to lay the foundation for a passwordless future.
