Passwordless, unphishable web browsers

SMART Access & Identity 2024 Access Control & Identity Management, Information Security

South Africans have become used to excellent in-app security when it comes to banking and other online transactions. Looking ahead, passkey technology will mean we could soon enjoy the same unphishable, biometric-based solution in the browser; boosting consumer confidence and helping foster digital adoption.

“As banking apps have become more secure, fraudsters have naturally looked to exploit the weakest link, which, at the moment, is a combination of the browser and users being overly trusting. The usual username and password for browser login can easily be phished, and fast-talking social engineering can even dupe unsuspecting users into sharing OTPs with fraudsters. Fortunately, passkey technology is proving to be an easily deployed way to bring unphishable biometric-based security to browsers as well,” shares Arno van der Merwe, Product Manager: Browser Experience at Entersekt.

Arno van der Merwe.

Passkeys are digital credentials tied to a user account and a website or app. They rely on biometrics such as fingerprints (TouchID), facial recognition (FaceID), or sometimes a PIN (Windows Hello) to authenticate a user. This removes the need for complex, and often easily forgotten passwords. In addition, because they are stored locally on a device and not on a server; even if a website or app is breached, they remain out of the hackers’ reach.

Passkeys can also be used and synced between devices, allowing users to keep them when they upgrade phones or computers and removing the need to remember different passwords for different websites or apps.

“South Africans are conditioned to see the mobile application as being secure. Our phones are tied to us as a unique identifier, while browsers could be launched from any computer anywhere in the world and lack that strong authentication identifier. While apps on mobile phones are by no means invincible, it is much harder to take over someone’s account by taking over an app, than it is to go into the front door on the browser where they do not need much identification,” Van der Merwe explains.

US leading the way, but SA is set to follow

Fido authentication, or passkey authentication, is a fairly new authentication method, but it has enjoyed strong adoption, especially in the US over the past few years.

“Passkeys have gained a lot of traction over the last few years, especially since Google, Apple, and Microsoft have all announced support for the technology. The US has been particularly keen to adopt passkey authentication, probably because US consumers are less fond of apps than many customers in Europe and even South Africa. We already have multiple US credit unions making use of passkey technology and, with around 80% of operating systems able to support the technology, this is likely to quickly grow over the next year or two,” Van der Merwe says.

However, Van der Merwe says that there is a strong use case for passkeys in South Africa, especially when it comes to creating a seamless authentication experience across all digital channels.

“It will be really easy for local banks to implement passkeys since we offer it as a SaaS model and, because many users are already using biometric authentication on their devices, there will not have to be too much user education. What is more, the payments industry is very

keen to embrace this method, and the EMVCo 3DS 3.2.1 spec has had changes specifically tailored to allow passkey authentication as part of 3D Secure Payments,” he says.

Van der Merwe says local banks are especially keen on the technology because it has relatively low friction compared to out-of-band solutions, but still provides strong cryptographic proof of user presence and consent. Passkeys are also unphishable and do not pose the same complexity as sending an SMS OTP to an out-of-band device.

“This is collectively putting in place everything we need from a technical and regulatory standpoint to start using passkeys as the primary authentication mechanism, even in e-commerce transactions, as we move into 2024,” he predicts.

For more information, visit

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Data security and privacy in global mobility
Security Services & Risk Management Information Security
Data security and privacy in today’s interconnected world is of paramount importance. In the realm of global mobility, where individuals and organisations traverse borders for various reasons, safeguarding sensitive information becomes an even more critical imperative.

Sophos celebrates partners and cybersecurity innovation at annual conference
News & Events Information Security
[Sponsored] Sun City hosted Sophos' annual partner event this year, which took place from 12 to 14 March. Sophos’ South African cybersecurity distributors and resellers gathered for an engaging two-day conference.

The CIPC hack has potentially serious consequences
Editor's Choice Information Security
A cyber breach at the South African Companies and Intellectual Property Commission (CIPC) has put millions of companies at risk. The organisation holds a vast database of registration details, including sensitive data like ID numbers, addresses, and contact information.

AI augmentation in security software and the resistance to IT
Security Services & Risk Management Information Security
The integration of AI technology into security software has been met with resistance. In this, the first in a series of two articles, Paul Meyer explores the challenges and obstacles that must be overcome to empower AI-enabled, human-centric decision-making.

Milestone Systems joins CVE programme
Milestone Systems News & Events Information Security
Milestone Systems has partnered with the Common Vulnerability and Exposures (CVE) Programme as a CVE Numbering Authority (CNA), to assist the programme to find, describe, and catalogue known cybersecurity issues.

Defending against SIM swap fraud
Access Control & Identity Management
Mobile networks must not be complacent about SIM swap fraud, and they need to prioritise the protection of customers, according to Gur Geva, Founder and CEO of iiDENTIFii.

Access Selection Guide 2024
Access Control & Identity Management
The Access Selection Guide 2024 includes a range of devices geared specifically for the access control and identity management market.

Biometrics Selection Guide 2024
Access Control & Identity Management
The Biometrics Selection Guide 2024 incorporates a number of hardware and software biometric identification systems aimed at the access and identity management market of today.

Smart intercoms for Sky House Projects
Nology Access Control & Identity Management Residential Estate (Industry)
DNAKE’s easy and smart intercom solution has everything in place for modern residential buildings. Hence, the developer selected DNAKE video intercoms to round out upmarket apartment complexes, supported by the mobile app.

Authentic identity
HID Global Access Control & Identity Management
As the world has become global and digital, traditional means for confirming authentic identity, and understanding what is real and what is fake have become impractical.