Ditching passwords, rethinking cybersecurity

Andrew Shikiar

OUR current methods of authentication are no longer fit for today’s digital landscape. Take the phishing scams that targeted OCBC bank customers in late 2021 for example. Hackers could bypass the bank’s security protocols and drain over S$13 million from the accounts of unsuspecting victims. 

The debacle threw banks’ cybersecurity into the spotlight and sent shockwaves not only in Singapore but also throughout the region. As a result, people began to question if their financial institutions’ security systems are truly as airtight as they seem. It also caused many to rethink legacy authentication methods like SMS, one-time passwords (OTPs), codes and passwords.

Vulnerabilities of passwords, OTPs and SMS codes 

Experts have long warned about the fallibility of knowledge-based authentication such as passwords, OTPs and SMS codes. For example, former Microsoft chairman Bill Gates predicted the demise of passwords as early as 2004, citing that the method cannot “meet the challenge” of keeping critical information secure.

At the core, knowledge-based credentials such as OTPs are human-readable and can be pried out of consumers’ hands by enterprising hackers. As we have seen with SMS OTPs, attackers can use SIM swapping techniques to get the code sent to their phones instead of the intended recipient. Today’s increasingly saturated digital landscape has also provided a rich environment for criminals to launch their attacks – Southeast Asia alone added 70 million new online shoppers since the pandemic began.

Even good cyber hygiene will not suffice as cyber threats continue to evolve. The average user has almost 200 pairs of usernames and passwords, making it nearly impossible to remember and keep track of them. As a result, 53 per cent tend to reuse the same password for multiple accounts or reuse passwords with minor variations. These poor hygiene habits make them vulnerable to account takeovers, with one leaked password putting all other accounts at risk.

While consumers absolutely need to exercise greater caution online, the ultimate responsibility rests with the online service providers who must ensure their cybersecurity systems are robust and fit to protect their users. Thankfully, there are standards already available to help reduce organisations’ reliance on passwords.

Use possession-based, not knowledge-based, authentication

Instead of relying on knowledge-based “secrets” that can be easily stolen or otherwise hacked, the industry should move towards possession-based authentication techniques that are not susceptible to remote attacks. These techniques leverage devices that consumers literally have at their fingertips throughout the day, such as using their smartphone’s biometrics or by touching a security key. While this only requires a single gesture by the user, behind the scenes an advanced cryptographic authentication dialogue takes place between a “private key” stored securely on the user’s device, and its “public key” counterpart on the service provider’s server. By relying on advanced cryptographic algorithms instead of human recollection, the authentication process becomes far more secure.

Most of us have already used possession-based authentication in our daily lives. For example, using your face or fingerprint to unlock your smartphone and to access apps and websites. If you own a Windows device, you would likely have used your fingerprint or face to log in via Windows Hello. 

More recently, Microsoft, Google, and Apple have announced plans to support a common  passwordless sign-in standard, which would enable consumers to log into their accounts across devices and platforms without requiring passwords. This commitment by the industry’s biggest tech players signalled a massive step towards eliminating the world’s reliance on passwords. 

The passwordless future is already here

The shift away from legacy authentication methods will not be easy. Old habits will need to be unlearned, and new ones formed. Nonetheless, it is clear that our current ways of authentication are outdated, and a significant overhaul is urgently needed.

The passwordless future is closer than ever – possession-based authentication is available in billions of devices and every leading web browser and operating system. Fortunately, most businesses are getting on board. Gartner predicts that 60 per cent of large global enterprises and 90 per cent of midsize firms will implement passwordless methods in the next few years. With the growing threats of cyberattacks across Asia and the world, it is high time to move toward a stronger, more convenient and passwordless reality. 

The writer is executive director of FIDO, an open industry association that seeks to help reduce the world’s over-reliance on passwords