computer science

Passwordless authentication

Passwordless authentication is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Passwordless authentication rather than just read about it. In short: Passwordless authentication is an authentication method in which a user can log in to a computer system without entering (and having to remember) a password or any other knowledge-based secret. In most common implementations, users are asked to enter their public identifier (username, phone number, email address, etc.) and then complete the authentication process by providing a secure proof of identity through a reg…

Key takeaways

Passwordless authentication belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Passwordless authentication to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Passwordless authentication from memory before moving on to harder problems.

Reference excerpt

Passwordless authentication is an authentication method in which a user can log in to a computer system without entering (and having to remember) a password or any other knowledge-based secret. In most common implementations, users are asked to enter their public identifier (username, phone number, email address, etc.) and then complete the authentication process by providing a secure proof of identity through a registered device or token. Passwordless authentication methods typically rely on public-key cryptography infrastructure, where the public key is provided during registration to the authenticating service (remote server, application, or website). In contrast, the private key is kept on a user’s device (PC, smartphone or an external security token) and can be accessed only by providing a biometric signature or another authentication factor which is not knowledge-based. These factors classically fall into two categories:

Ownership factors (“Something the user has”) such as a cellular phone, OTP token, smart card, or a hardware token. Inherence factors (“Something the user is”) like fingerprints, retinal scans, face or voice recognition and other biometric identifiers. Some designs might also accept a combination of other factors such as geo-location, network address, behavioral patterns, and gestures, as long as no memorized passwords are involved. Passwordless authentication is sometimes confused with multi-factor authentication (MFA), since both use a wide variety of authentication factors. Still, while MFA is often used as an added layer of security on top of password-based authentication, passwordless authentication does not require a memorized secret. Usually, it uses just one highly secure factor to authenticate identity (i.e., an external security token), making it faster and simpler for users. When both approaches are employed, “Passwordless MFA” is the term used. The authentication flow is passwordless and uses multiple factors, providing the highest security level when implemented correctly.

History The notion that passwords should become obsolete has been circling in computer science since at least 2004. Bill Gates, speaking at the 2004 RSA Conference, predicted the demise of passwords, saying "they just don't meet the challenge for anything you really want to secure." Matt Honan, a journalist at Wired, who was the victim of a hacking incident, in 2012 wrote "The age of the password has come to an end." Heather Adkins, manager of Information Security at Google, in 2013 said that "passwords are done at Google." Eric Grosse, VP of security engineering at Google, states that "passwords and simple bearer tokens, such as cookies, are no longer sufficient to keep users safe." Christopher Mims, writing in The Wall Street Journal said the password "is finally dying" and predicted their replacement by device-based authentication, however, purposefully revealing his Twitter password resulted in being forced to change his cellphone number. Avivah Litan of Gartner said in 2014, "Passwords were dead a few years ago. Now they are more than dead." The reasons given often include reference to the usability as well as security problems of passwords. Bonneau et al. systematically compared web passwords to 35 competing authentication schemes regarding their usability, deployability, and security. (The technical report is an extended version of the peer-reviewed paper by the same name.) Their analysis shows that most schemes do better than passwords on security, some schemes do better and some worse regarding usability, while every scheme does worse than passwords on deployability. The authors conclude with the following observation: “Marginal gains are often not sufficient to reach the activation energy necessary to overcome significant transition costs, which may provide the best explanation of why we are likely to live considerably longer before seeing the funeral procession for passwords arrive at the cemetery.” Recent technological advancements (e.g., the proliferation of biometric devices and smartphones) and changing business culture (acceptance of biometrics and decentralized workforce, for example) continuously promote the adoption of passwordless authentication. Leading tech companies (Microsoft, Google) and industry wide initiatives are developing better architectures and practices to bring it to wider use, with many taking a cautious approach, keeping passwords behind the scenes in some use cases. The development of open standards such as FIDO2 and WebAuthn has further generated adoption of passwordless technologies such as Windows Hello. On June 24, 2020, Apple Safari announced that Face ID or Touch ID would be available as a WebAuthn platform authenticator for passwordless login.

Mechanism A user must first register with a system before their identity can be verified. A passwordless registration flow may include the following steps:

Registration request: When a user attempts to register with a website, the server sends a registration request to the user's device. Authentication factor selection: When the user's device receives the registration request, it sets up a method for authenticating the user. For example, the device may use biometrics like a fingerprint scanner or facial recognition for user identification. Key generation: The user's device generates a public/private key pair and sends the public key to the server for future verification. Once they have registered, a user can log in to the system via the following process:

Authentication challenge: The server sends an authentication challenge to the user's device when the user attempts to log into the site. User authentication: The user proves their identity to their device using the biometric scanner, unlocking their private key. Challenge response: The user's device digitally signs a response to the authentication challenge with the user's private key. Response validation: The server uses the user's public key to verify the digital signature and provides access to the user's account.

Benefits and drawbacks Proponents point out several unique benefits over other authentication methods:

… excerpt ends here. Continue reading the full article.

Illustrations

Worked examples

Example 1 — a first encounter with Passwordless authentication

Start with the simplest possible case. Write down what Passwordless authentication claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Passwordless authentication before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Passwordless authentication ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Passwordless authentication

In research: Passwordless authentication appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Passwordless authentication in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Passwordless authentication is common in secondary-school and first-year university syllabi. It links to neighbouring topics Access control, Applications of cryptography, Authentication, so understanding it makes those chapters shorter.
In everyday life: Look for Passwordless authentication outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Ask Teacher Smith questions about this articleOpens your AI tutor with a question about “Passwordless authentication” →

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Passwordless authentication in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Passwordless authentication means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Passwordless authentication out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Passwordless authentication in simple terms?

Why does Passwordless authentication matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Passwordless authentication?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Passwordless authentication.