Passwords are 60, time for them to go

Issue 3 2021 Access Control & Identity Management, Information Security

It has been 60 years since passwords were first used at MIT and if the number of breaches in the news are anything to go by, we are no more adept at managing our passwords than we were in 1961. But while passwords are being phased out, IT leaders can fortunately rely on authentication technology that will protect their valuable data without destroying the user experience.


Gerhard Oosthuizen.

As more companies have adopted cloud computing and more recently, remote working, the need to protect data has become significantly more important. For companies transacting online, the need to protect their customers is higher still. However, setting up security roadblocks that slow down the user experience will cause irritation and potentially lose valuable customers.

“Protecting users while keeping fraudsters out has become one of the most critical duties for today’s CIO. Finding the right balance between great user experience and strong authentication in a low-friction environment has become the holy grail in security circles,” says Gerhard Oosthuizen, chief technology officer at Entersekt.

Passwords just don’t cut it

According to Verizon’s annual security report, compromised credentials are still the most often used asset (80%) when it comes to data breaches. Despite the glaring evidence of just how at risk we are, most people resist making use of password managers and according to Oosthuizen, still have terrible password habits.

“We all now have hundreds of accounts that require passwords. The chances are we each have around four or five that we simply recycle. One which we only use for our bank account, one or two that we use for our various social media accounts and one which we use for everything else.

Our ‘recover password’ information is also easily cracked, so that is of little use - especially if we answer honestly. A simple search will give you a person’s mother’s maiden name, the name of their first pet and let’s be honest, the majority of us will answer pizza if asked for our favourite food. Passwords are passé,” Oosthuizen states.

When the weaknesses of password-based authentication started to become known, many organisations introduced two-factor authentication. One popular implementation that is still common today is SMS one-time PIN or password (OTP) technology. While it does add an extra layer of protection, Oosthuizen points out that this often comes with a big dose of user friction and it’s by no means foolproof.

“Today the biggest challenge with OTPs is that the technology does not really protect against modern attacks. Criminals have found many workarounds such as SIM-swap and man-in-the-middle attacks.”

Stronger security, better experiences

More robust technologies like mobile push authentication have now replaced SMS OTPs as the industry standard in authentication. Unlike SMS OTPs, authentication messages delivered via push messaging technology are truly out of band. “This means that you don’t rely on the same channel to deliver authentication requests and responses that was used to initiate the original, potentially fraudulent, transaction,” Oosthuizen explains.

In addition to the stronger security provided by technologies like push-based authentication, they also offer a far greater user experience. The user receives the full request on their trusted mobile app and can approve it from there. They no longer have to wait for an OTP to arrive and copy it or remember it and then enter it, frequently having to switch between apps to do so. It’s all about leveraging the user’s device to create a strong device identity and making authentication experiences as seamless as possible. And today you can use the biometric sensor on a device to completely eradicate the use of passwords, while increasing security.

“We use the end-user’s digital device to help authenticate them. Our certificate-based device ID technology ensures that only your own trusted device can be used and if you combine that with biometrics, it prevents you from having to enter a password or an OTP. This enables a truly passwordless experience, Oosthuizen explains. “So the passwordless future has arrived. That should make all those CIOs smile.”




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Phishing attacks through SVG image files
Kaspersky News & Events Information Security
Kaspersky has detected a new trend: attackers are distributing phishing emails to individual and corporate users with attachments in SVG (Scalable Vector Graphics) files, a format commonly used for storing images.

Read more...
The future of security: intelligent automation
Access Control & Identity Management AI & Data Analytics IoT & Automation
As the security landscape evolves, businesses are no longer looking for stand-alone solutions, they want connected, intelligent systems that automate, streamline, and protect.

Read more...
Smart automation is changing security
SA Technologies IntelliGuard Access Control & Identity Management
Security has come a long way from manual check-ins, logbooks, and standalone surveillance cameras. With the rise of intelligent automation, security is now faster, smarter, and more connected than ever.

Read more...
The future of security in South Africa
ATG Digital Access Control & Identity Management
Security technology is evolving rapidly, but is local innovation keeping pace? Some global players recognise the potential of South African products for international markets, but can our manufacturers and service providers thrive without external support?

Read more...
Integration enhances estate access control
Access Control & Identity Management
With one-third of residential burglaries starting at the front door, the continued seamless integration of Glovent’s estate management platform with Impro access control software is welcome news for estates.

Read more...
T&A in South Africa’s retail sector
ERS Biometrics Access Control & Identity Management
Using existing systems, ERSBio provides a practical and more cost-effective way for businesses to manage operations, reduce payroll mistakes, and enhance overall efficiency through innovative T&A processes.

Read more...
Navigating the complexities of privileged access management
Editor's Choice Access Control & Identity Management
Privileged Access Management and Identity Access Management are critical pillars of modern cybersecurity, designed to secure access to sensitive resources, enforce principles like least privilege, and implement just-in-time access controls.

Read more...
The impact of GenAI on cybersecurity
Sophos News & Events Information Security
Sophos survey finds that 89% of IT leaders worry GenAI flaws could negatively impact their organisation’s cybersecurity strategies, with 87% of respondents stating they were concerned about a resulting lack of cybersecurity accountability.

Read more...
Efficient, future-proof estate security and management
Technews Publishing ElementC Solutions Duxbury Networking Fang Fences & Guards Secutel Technologies OneSpace Technologies DeepAlert SMART Security Solutions Editor's Choice Information Security Security Services & Risk Management Residential Estate (Industry) AI & Data Analytics IoT & Automation
In February this year, SMART Security Solutions travelled to Cape Town to experience the unbelievable experience of a city where potholes are fixed, and traffic lights work; and to host the Cape Town SMART Estate Security Conference 2025.

Read more...
Paxton opens second experience centre
Paxton News & Events Access Control & Identity Management
Security technology manufacturer, Paxton, has opened a new experience centre in Cape Town on 12 February in partnership with its exclusive distributors, Reditron and Regal Security.

Read more...