#web authentication

Daon’s IdentityX is the core component in a best-of-breed Multi Factor Authentication solution, ensuring strong and secure user authentication.

今年三月四號 W3C 正式將 WebAuthn 列入正式標準中，WebAuthn 是 FIDO2 標準中構成核心的一部份，以 Web-based API 的方式讓網站可以將他們的登入頁加入瀏覽器及平台所支援的 FIDO 驗證。一般我們所使用的密碼登入機制屬於單一認證，一旦被盜取密碼便很容易被控制帳號存取權，然而根據 2017 年的統計，只有28%的使用者使用二階段認證（包括簡訊認證、Google Auth...等等）。

Without knowing customers, it is impossible for a business to offer services. To gather information businesses are using several methods including registration forms, social login, email registration etc. But the problem with these authentication methods is that users have to hand over their Personally Identifiable Information (PII). Sharing PII to any business is not so comfortable for many users. They don’t like to hand over their personal information to anyone.

This mindset encourages IT researchers to come up with solutions that can eliminate the need of providing private information. Anonymous login and Line by line controls are some of the ways that help businesses to gather customers data without annoying them.

Anonymous login: It is a process of authentication where users can access a website without an encounter with the login process. They simply don’t need to provide their PII.

Line by line control: It is a great authentication approach. In this method, users can allow or disallow permission to share their information (nothing or all) with a website.

Both the methods give more control to users regardless of what type of data they are sharing. At present scenario, users are conflicted- at one time they demand personalize experience and on the same time they are concerned about the data they are sharing.

Are the methods good for marketers to gain customers insights?

When a user login to a website using these methods, it gets a unique identifier about the user. Business doesn’t get any PII but they can start to build a profile by examining what are the content users are liking and what are their preferences.

The methods also work great across several devices and mobile apps. Both the process make it easy for users to access the internet services and other applications and improve their experience.

Better experience leads to build a level of trust among users for the business. Marketers can use this opportunity in asking personal questions in order to boost experience and services.

If your answer is yes, you are wrong my friend. Gone are those days when passwords used to be enough to keep you secure and safe from hackers. Passwords are no more safe. They can be judged or hacked by data thieves easily. No matter how big the organization is, hackers can hack users’ credentials. Hewlett Packard, Weebly, Yahoo, Oracle Micros, Myspace etc. are some big names who are the victims of data breach. So, what are you doing to improve security? How careful you are when it comes to secure computer systems of your business?

There is a technology named two-factor authentication(2FA) that helps you in the situation. Let’s take a closer look to it and explore it more.

What is 2FA?

What if I say, you need to put your thumb impression to unlock your home’s main door even after you have keys? Your keys may be stolen by thieves but still they will not be capable of getting inside of your home. Because for that, they need your thumb impression which is not possible to steal. Two-factor authentication works on the same concept. In this, users need to verify themselves after providing a right pair of username and password. That means, there are two separate checkpoints where users need to proof themselves. Generally, banking sector, financial companies, etc. uses this way of authentication to keep their users data secure. The data is highly confidential.

What are the methods used in 2FA?

OTP verification

This is the most common method used for 2FA. In this, a unique code or one-time password is sent on either mobile phone or email id. Users need to enter that code to complete the authentication process.

Biometric authentication

Do you remember what you did to unlock your home’s main door? You put your thumb impression. This is an example of biometric login. The 2FA with biometrics is considered as one of the best pair for authentication. After entering credentials users need to verify themselves by providing their thumb impression, retinal scanning, voice match etc.

Authentication to a website is always a headache for web users. Users are facing many difficulties while authenticating themselves to a website. Every website has a different way of authentication. Some offer traditional registration forms, some offers social login and lots of other methods. From time to time IT researchers have come up with new and unique ideas of web-authentication. In this article, I am going to explain what are the changes that occurred in the field of web-authentication and what are the changes that are going to take place in future.

Once upon a time there was a long and boring registration form:

Do you remember the form above? Yes, if we go few years back, if we wanted to access any website then we had to encounter long and boring registration form. We had no option but to fill the form. This cost us our time. Apart from time, the form frustrated and degraded our efficiency. But in present time, there are many methods that have replaced old traditional method. But still, there are lots of websites that offer an option of web authentication via new methods or traditional form. It totally depends on a user which one to choose.

What do we have?

Thanks to IT researchers for saving us from a long form. It was really a headache. Now, we have lots of option to authenticate ourselves to a website. Will discuss some of them one by one:

Social login:

How many social media accounts do you have? One, two or more? I know we all have accounts on many social media networks. Social login is a method that makes us login to a website using one of our social media accounts.

The above form indicates that we can login to a website using Facebook, Twitter or Google+. Unlike traditional forms, now we don’t need to fill forms and waste our time. Just with one click of the mouse, we can login to a website.

Single Sign-On:

Today, businesses normally have more than one website. No matter how easy the social login method is but authentication to multiple websites is not easy. Here single sign-on or SSO solution helps us to authenticate websites of the same business by authenticating only to any of the websites. I am not saying that SSO is an alternative of social login. Both are different methods. Social login is best for a single resource but for multiple resources businesses single sign-on is a better option.

What is the future?

Well, the approaches mentioned above are quite easy and quick but still researchers are always trying to find something new and great. They are looking for passwordless login where a user can login to resources without a need of passwords. Biometric login is one such approach. The concept is already exists but researchers want to take it to new heights.

Biometric authentication:

Web authentication systems have evolved over the past ten years to counter a growing variety of threats. This post will present a fictional arms race between a web application developer and an attacker, showing how different threats can be countered with the latest security technologies.