Passwordless, unphishable web browsers

SMART Access & Identity 2024 Access Control & Identity Management, Information Security

South Africans have become used to excellent in-app security when it comes to banking and other online transactions. Looking ahead, passkey technology will mean we could soon enjoy the same unphishable, biometric-based solution in the browser; boosting consumer confidence and helping foster digital adoption.

“As banking apps have become more secure, fraudsters have naturally looked to exploit the weakest link, which, at the moment, is a combination of the browser and users being overly trusting. The usual username and password for browser login can easily be phished, and fast-talking social engineering can even dupe unsuspecting users into sharing OTPs with fraudsters. Fortunately, passkey technology is proving to be an easily deployed way to bring unphishable biometric-based security to browsers as well,” shares Arno van der Merwe, Product Manager: Browser Experience at Entersekt.


Arno van der Merwe.

Passkeys are digital credentials tied to a user account and a website or app. They rely on biometrics such as fingerprints (TouchID), facial recognition (FaceID), or sometimes a PIN (Windows Hello) to authenticate a user. This removes the need for complex, and often easily forgotten passwords. In addition, because they are stored locally on a device and not on a server; even if a website or app is breached, they remain out of the hackers’ reach.

Passkeys can also be used and synced between devices, allowing users to keep them when they upgrade phones or computers and removing the need to remember different passwords for different websites or apps.

“South Africans are conditioned to see the mobile application as being secure. Our phones are tied to us as a unique identifier, while browsers could be launched from any computer anywhere in the world and lack that strong authentication identifier. While apps on mobile phones are by no means invincible, it is much harder to take over someone’s account by taking over an app, than it is to go into the front door on the browser where they do not need much identification,” Van der Merwe explains.

US leading the way, but SA is set to follow

Fido authentication, or passkey authentication, is a fairly new authentication method, but it has enjoyed strong adoption, especially in the US over the past few years.

“Passkeys have gained a lot of traction over the last few years, especially since Google, Apple, and Microsoft have all announced support for the technology. The US has been particularly keen to adopt passkey authentication, probably because US consumers are less fond of apps than many customers in Europe and even South Africa. We already have multiple US credit unions making use of passkey technology and, with around 80% of operating systems able to support the technology, this is likely to quickly grow over the next year or two,” Van der Merwe says.

However, Van der Merwe says that there is a strong use case for passkeys in South Africa, especially when it comes to creating a seamless authentication experience across all digital channels.

“It will be really easy for local banks to implement passkeys since we offer it as a SaaS model and, because many users are already using biometric authentication on their devices, there will not have to be too much user education. What is more, the payments industry is very

keen to embrace this method, and the EMVCo 3DS 3.2.1 spec has had changes specifically tailored to allow passkey authentication as part of 3D Secure Payments,” he says.

Van der Merwe says local banks are especially keen on the technology because it has relatively low friction compared to out-of-band solutions, but still provides strong cryptographic proof of user presence and consent. Passkeys are also unphishable and do not pose the same complexity as sending an SMS OTP to an out-of-band device.

“This is collectively putting in place everything we need from a technical and regulatory standpoint to start using passkeys as the primary authentication mechanism, even in e-commerce transactions, as we move into 2024,” he predicts.

For more information, visit entersekt.com




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Smart surveillance and cyber resilience
Axis Communications SA Surveillance Information Security Government and Parastatal (Industry) Facilities & Building Management
South Africa’s critical infrastructure sector has to step up its game regarding cybersecurity and the evolving risk landscape. The sector has become a prime target for cybercriminals on top of physical threat actors, and the consequences of an incident can be far-reaching.

Read more...
Unlock data insights and integration
Gallagher Access Control & Identity Management Products & Solutions
Gallagher Security announced the release of its security site management software, Command Centre v9.20, which enables integration with Microsoft Entra ID, a cloud-based identity and access management system that provides seamless synchronisation of cardholders across systems.

Read more...
Gallagher Security opens Cape Town office
Gallagher News & Events Access Control & Identity Management
Acknowledging a significant period of growth for the company in South Africa, opening a second office will enable Gallagher to increase its presence across the region with staff based in Johannesburg and Cape Town.

Read more...
Autonomous healing systems are the future
Infrastructure Information Security AI & Data Analytics
Autonomous healing software, an emerging technology, is gaining traction for its potential to transform how organisations manage software maintenance, security, and system performance.

Read more...
Securing access against unwanted visitors
Intelliguard Access Control & Identity Management Residential Estate (Industry) Products & Solutions
In today's residential estates and complexes, one of the biggest concerns is preventing unauthorised access, while ensuring a smooth and convenient experience for residents and approved visitors.

Read more...
Smart access for a safer community
neaMetrics Suprema Access Control & Identity Management Residential Estate (Industry) Products & Solutions
Suprema's BioEntry W3 integrates AI-powered facial authentication into a sleek design that prioritises security, privacy and user experience, and even allows users to store their facial templates on their mobiles instead of external devices.

Read more...
Effortless and secure visitor management
Secutel Technologies Access Control & Identity Management Residential Estate (Industry)
Secutel Ventures has introduced SecuVisit, an access control solution designed to simplify visitor management while enhancing security. With two innovative components onboard, SecuVisit ensures seamless visitor check-ins anytime, anywhere.

Read more...
Glovent’s SOS Suite triple protects estate residents
News & Events Access Control & Identity Management Residential Estate (Industry)
One hundred and fifty-three years since the world’s first panic button was introduced in New York City, Glovent offers estate residents three different ways of summoning emergency assistance at the touch of a button.

Read more...
Security professionals gather at Integrate 360
Gallagher Access Control & Identity Management News & Events
Gallagher Security’s Integrate 360 brought together some of the best minds in security, innovation, and technology for two days full of insights, demonstrations, and future-focused discussions.

Read more...
Suprema showcases enterprise security at Integrate 360
Suprema News & Events Access Control & Identity Management
Since 2006, neaMetrics, Suprema’s distributor in Africa, has worked closely with Gallagher, building a robust partnership resulting in seamless integration between Suprema’s advanced biometric readers and Gallagher’s security management platform.

Read more...