Passwordless authentication

(Pixiv with Bitwarden) Passwordless authentication is an authentication method in which a user can log in to a computer system without entering (and having to remember) a password or any other knowledge-based secret. In most common implementations, users are asked to enter their public identifier (username, phone number, email address, etc.) and then complete the authentication process by providing a secure proof of identity through a registered device or token. Passwordless authentication methods typically rely on public-key cryptography infrastructure, where the public key is provided during registration to the authenticating service (remote server, application, or website). In contrast, the private key is kept on a user’s device (PC, smartphone or an external security token) and can be accessed only by providing a biometric signature or another authentication factor which is not knowledge-based. These factors classically fall into two categories: * Ownership factors (“Something the user has”) such as a cellular phone, OTP token, smart card, or a hardware token. * Inherence factors (“Something the user is”) like fingerprints, retinal scans, face or voice recognition and other biometric identifiers.…

(Pixiv with Bitwarden) Passwordless authentication is an authentication method in which a user can log in to a computer system without entering (and having to remember) a password or any other knowledge-based secret. In most common implementations, users are asked to enter their public identifier (username, phone number, email address, etc.) and then complete the authentication process by providing a secure proof of identity through a registered device or token. Passwordless authentication methods typically rely on public-key cryptography infrastructure, where the public key is provided during registration to the authenticating service (remote server, application, or website). In contrast, the private key is kept on a user’s device (PC, smartphone or an external security token) and can be accessed only by providing a biometric signature or another authentication factor which is not knowledge-based. These factors classically fall into two categories: Ownership factors (“Something the user has”) such as a cellular phone, OTP token, smart card, or a hardware token. Inherence factors (“Something the user is”) like fingerprints, retinal scans, face or voice recognition and other biometric identifiers. Some designs might also accept a combination of other factors such as geo-location, network address, behavioral patterns, and gestures, as long as no memorized passwords are involved. Passwordless authentication is sometimes confused with multi-factor authentication (MFA), since both use a wide variety of authentication factors. Still, while MFA is often used as an added layer of security on top of password-based authentication, passwordless authentication does not require a memorized secret. Usually, it uses just one highly secure factor to authenticate identity (i.e., an external security token), making it faster and simpler for users. When both approaches are employed, “Passwordless MFA” is the term used. The authentication flow is passwordless and uses multiple factors, providing the highest security level when implemented correctly.

Mechanism

A user must first register with a system before their identity can be verified. A passwordless registration flow may include the following steps: Registration request: When a user attempts to register with a website, the server sends a registration request to the user's device. Authentication factor selection: When the user's device receives the registration request, it sets up a method for authenticating the user. For example, the device may use biometrics like a fingerprint scanner or facial recognition for user identification. Key generation: The user's device generates a public/private key pair and sends the public key to the server for future verification. Once they have registered, a user can log in to the system via the following process: Authentication challenge: The server sends an authentication challenge to the user's device when the user attempts to log into the site. User authentication: The user proves their identity to their device using the biometric scanner, unlocking their private key. Challenge response: The user's device digitally signs a response to the authentication challenge with the user's private key. Response validation: The server uses the user's public key to verify the digital signature and provides access to the user's account.

Text derived from https://en.wikipedia.org/w/index.php?oldid=1316451337 under CC BY-SA 4.0; modifications have been made.