Death of the password? New web standard trades passcodes for biometrics

The death of the password could be upon us.

A new security standard recently endorsed by the World Wide Web Consortium has experts excited about the prospect of making logins “unphishable” and ending the vulnerabilities that currently exist because so many users have poor “password hygiene” and reuse the same one across countless websites.

The Web Authentication (WebAuthn) standard developed collaboratively by members of the FIDO Alliance — which includes the likes of Amazon, Facebook, Google, Intel, Lenovo, Microsoft, PayPal, Samsung and Visa — allows web surfers to use biometrics such as fingerprints or facial scans instead of inputting a password. Plugging a compatible USB device into a computer can also be used to bypass password screens on participating websites.

“I don’t think the password will be killed tomorrow, or even within the next three to six months, or even year,” says Joni Brennan, president of the non-profit Digital ID and Authentication Council of Canada.

“But there’s a shift and a journey that needs to happen and to finally move past having so many passwords and ideally not having passwords at some point — this I think is a really key step.”

Mozilla’s Firefox browser has already implemented the technology while Google and Microsoft have also committed to updating their browsers.

Users who adopt the new standard will basically be upgrading to a level of security used for protecting state secrets, says Vancouver native John Bradley, standards architect for the security hardware company Yubico, a board member of the FIDO Alliance.

“Essentially you’re moving people from being able to do remote attacks to phish you to actually having to break into your house and steal your phone … and extract your pin from you at gunpoint. It significantly raises the bar,” says Bradley, who predicts some popular websites may start offering the new type of login within a couple of months.

He says security experts call the login method “unphishable” because there’s no indication yet that hackers could compromise it.

“So people would have to move onto other social-engineering schemes,” he explains.

“But there isn’t something you could tell someone over the phone if (a scammer) called you up… there isn’t anything the user can actually disclose to somebody else (to reveal their login), so it makes it very difficult for the attackers. I’m sure they’ll come up with some other scheme to keep security people in business, but this would cut off what’s becoming a major pain in the neck for people.”

Bradley notes that users who choose to use biometrics as an unlocking mechanism needn’t worry about their fingerprints being handed over to websites they visit. Biometrics are not uploaded during the login process and are not stored on the user’s device.

“All the biometrics are local to the device, so you’re not sending your fingerprint to the website — that would be a bad thing from a privacy perspective,” he says.

Brennan expects some people might be nervous about using their biometrics routinely for logging in online and fear they’ll be misused. She admits it took her a while to warm to Apple’s Touch ID fingerprint technology on its devices.

“Over time I saw there was a convenience there and I was able to learn what was happening,” she says.

“That was a personal decision.”

Just Posted

Red Deer couple win $100,000 in lottery

Couple won their money on June 1 LOTTO MAX with EXTRA draw

‘Walking survey’ of Red Deer’s green carts starts this week

Gold stars or pointers on correct use will be left on inspected carts

Physicians urge Ottawa to pay another $21B over decade for seniors health care

OTTAWA — Physicians are calling on the federal government to shell out… Continue reading

‘I didn’t want to do something frivolous’: Sting’s play to make Toronto debut

TORONTO — Drawing Canadian theatregoers to a politically charged musical about an… Continue reading

Japan, EU sign trade deal to eliminate nearly all tariffs

TOKYO — The European Union and Japan signed a landmark deal on… Continue reading

Updated: SUV smashes through fences and deck in Anders

Driver taken to hospital after SUV veered off 30th Avenue into Anders

Adam Henrique signs $29.1M, 5-year extension with Ducks

ANAHEIM, Calif. — Centre Adam Henrique has signed a $29.1 million, five-year… Continue reading

Fashion firms upend design routine to focus on speed, trends

NEW YORK — Prototypes? Passe. Fashion company Betabrand saw that knitwear was… Continue reading

Trimming and tidying: Perennials need care too

The great attraction in growing perennial flowers is that you never have… Continue reading

Johnny Depp settles lawsuits involving former managers

LOS ANGELES — Johnny Depp has settled lawsuits with his former business… Continue reading

Cubs’ Kyle Schwarber falls to Bryce Harper in Home Run Derby final

WASHINGTON — Nationals Park was eerily quiet late Monday when Kyle Schwarber… Continue reading

Lava crashes through roof of Hawaii tour boat, injuring 23

HONOLULU — An explosion caused by lava oozing into the ocean sent… Continue reading

Banff holds blessing ceremony with Indigenous elders before letting bison roam

BANFF, Alta. — Several Indigenous elders were flown by helicopter into the… Continue reading

Research expedition looks at unseen depths of Labrador Sea ecosystem

ST. JOHN’S, N.L. — Last summer, a team of scientists returned from… Continue reading

Most Read

Five-day delivery plus unlimited digital access for $185 for 260 issues (must live in delivery area to qualify) Unlimited Digital Access 99 cents for the first four weeks and then only $15 per month Five-day delivery plus unlimited digital access for $15 a month