Passwordless Authentication Methods for SaaS Web Applications

The Pros and Cons of Passwordless Authentication

Wouldn’t it be great to eliminate reliance on passwords completely and deliver a better user experience, benefiting both the business and users? Some companies are already using passwordless authentication systems, which have replaced traditional user passwords or other knowledge-based secrets with more secure authentication factors. Typically, these are magic links, fingerprints, PINs, or secret tokens that users receive via email or SMS messages.

In general, from the user’s point of view, passwordless authentication systems are more practical because the authentication mechanism has shifted from what the user knows, a password, to what the user has—access to a device or an SMS or email client. Because using this type of authentication doesn’t require multifactor authentication, this sounds too good to be true. This is still single-factor authentication unless a service adds an additional layer of security on top. However, there is also a downside to this approach: the security of the system depends completely on two other systems that the user cannot control—the system’s delivery mechanism and the way the user accesses his or her inbox. Figure 1 shows the relative limitations and merits of different types of authentication systems.

Image source: Microsoft authentication methods

Should your SaaS Web application or product go passwordless? Well, it depends—really on your current system’s level of security. If your current system is more secure than going passwordless would be, it would probably be better to skip making this change for now. However, if your product’s security is far from the greatest and you’re already having some issues, passwordless authentication could be the right choice.

Benefits of Going Passwordless

Although going passwordless would not be suitable for every type of business organization—especially not for those in fintech or banking—many businesses are successfully going passwordless for a variety of reasons, because it provides numerous benefits, as follows:

• Going passwordless improves the user experience. Eliminating password and secrets fatigue and providing unified access to all applications and services lets people access SaaS applications more quickly and effortlessly rather than spending hours each year recovering or resetting forgotten user names and passwords.
• Passwordless authentication strengthens security. Companies can provide more secure authentication methods such as possession factor or inherent factor and thereby eliminate risky password-management techniques and reduce credential theft and impersonation.
• Switching to a passwordless approach simplifies IT operations. By eliminating the need to issue, secure, rotate, reset, and manage passwords, companies can concentrate on solving other persistent security issues. How much would your company benefit if your Support team received no more “I forgot my password” or “How can I reset my password?” tickets?
• The adoption of passwordless authentication is on the rise. In 2020, Microsoft alone saw more than 150 million people signing in to its services using passwordless methods each month, as Figure 2 shows. This trend is not going to slow down because of COVID-19 and the resulting dramatic adaptations of services’ going online. As Microsoft CEO Satya Nadella has put it, “We’ve seen two years’ worth of digital transformation in two months.”

Image source: Microsoft Stories Asia

How to Apply Passwordless Authentication to Your Product

To implement passwordless authentication for regular Web applications, you must do two things. First, you need to capture the user identifier in your application—for example, the user’s email address or phone number. Second, you must invoke the passwordless / start endpoint to initiate the passwordless workflow. In this way, the user gets a one-time-use code or magic link or receives an SMS message.

To understand this better, let’s look at an example: the passwordless workflow of Notion’s Web application, which, from the user’s perspective, uses magic links. This workflow uses logic that is similar to the way password-reset functionality works. Here are the steps that the user must take to log in:

1. The user types his email address into the Notion app, then clicks the Continue with email button.
2. If the service recognizes the email address, it sends an email message to the user with a magic-link URL that generates a one-time password.
3. The user opens the email client, clicks the link, initiating a new user session, and redirects to the application.

Given what we know, are magic links safe? Certain things make this authentication method even more secure in comparison to a typical password login. Only the person who receives the email messages that the system sends to the email address can access the magic link. The magic link that the user receives can be used only once and expires after one hour. Other SaaS products provide examples of similar workflows and logic.

Conclusion

The simple idea of eliminating our reliance on centrally managed passwords offers multiple benefits. However, there is no single passwordless solution that would fit most businesses. Nevertheless, we know that the adoption of passwordless methods is on the rise because of the range of business benefits it offers, including an enhanced user experience, fewer data breaches, lower support and development costs, and overall better product security.