Passwordless authentication has been a trending topic in the cybersecurity community for a long time now, and it’s showing no signs of slowing down. Honestly? We get it. Passwordless authentication is a super interesting concept and incredibly effective at limiting or – in some cases – removing the problems we see when using passwords for authentication. In fact, passwordless authentication is getting so popular that we’re starting to see governments hop aboard the bandwagon too; however, governments are more focused on phishing resistant authentication above all else. With that being said, which methods of passwordless authentication are phishing resistant? Let’s find out.
Before we can properly understand which forms of passwordless authentication are phishing resistant, let’s first clarify what being phishing resistant really means. A phishing resistant credential refers to a secure key that is, as the name implies, unable to be phished. This resilience stems from its brilliant design, which enables authentication without the need to share the private key!
With a phishing resistant MFA system, there is no risk of being duped, tricked, bamboozled or hornswoggled into surrendering your key. Given that phishing attacks are among the most well-known types of cyber threats, the ability to employ an authentication method immune to them represents a significant advantage in the realm of cybersecurity.
Now, having established what constitutes a phishing resistant credential, it’s time to look at which – if any – passwordless authentication methods meet the criteria. There are three primary forms of passwordless authentication: smartcards, FIDO2, and phone authentication. Which of these methods are phishing resistant? Let’s take a look!
Yes, smartcard authentication is considered phishing resistant! Smartcard authentication is classified as phishing resistant due to its design, which ensures strong and secure authentication linked to the user’s device that is used for the authentication process. Consequently, it is virtually impossible for users to accidentally disclose their login credentials with this method. Big ups to smartcards!
If your organization has adopted FIDO2 keys for passwordless authentication, you can sleep easy knowing that you’re using a phishing resistant credential. That’s right: FIDO2 is phishing resistant! FIDO2 keys are recognized as phishing resistant due to their robust and secure authentication that’s closely integrated with the user’s device (similar to smartcard authentication).
So, what sets FIDO2 apart from smartcard authentication? Essentially, FIDO2 is a more recent technological development than smartcard authentication and operates with a simpler infrastructure, streamlining the authentication process that smartcards use. For more, check out this blog on the difference between FIDO2 and smartcard authentication or check out the video below.
So, if both smartcard and FIDO2 authentication are phishing resistant, that must mean that phone authentication is too, right? Wrong. Phone authentication is NOT phishing resistant. Imagine for a moment that you’re sitting at your desk trying to log in, and you keep receiving those pesky push notifications saying things like, “Are you trying to log in?” After a few push notifications, you get a call from someone purporting to be your IT department telling you that there’s some sort of error in the system that makes the notifications be sent constantly, and you should just click “Yes” to solve the issue and log in. Trusting the caller, you abide. I hate to break it to you, but you just got phished. That example is, unfortunately, an everyday experience for many organizations, and why phone authentication is not safe to use – especially when compared to smartcard and FIDO2 authentication.
If you’re still hesitant about transitioning your organization to a passwordless system, allow us to provide some reassurance. The idea of completely eliminating passwords, a system around for decades, can absolutely be challenging to fully grasp – believe me, we understand that. That being said, it’s important to recognize the significant cybersecurity risks associated with passwords. For instance, in 2021, hackers exposed over 6 BILLION credentials online, and stolen credentials were the cause of **more than 60% of data breaches. And that’s just in 2021.
In today’s digital landscape, traditional passwords have become outdated. Adopting passwordless authentication offers your organization a safer and simpler way to authenticate. Additionally, third party products like EZCMS, the best CMS for FIDO2 and Entra, make the ordering, shipping, implementation and onboarding processes of going passwordless exponentially easier! To see how EZCMS can help your organization go passwordless painlessly, schedule a FREE consultation with one of our ex-Microsoft PKI experts today!
