Fast Identity Online defines passwordless sign in with a registered authenticator so a shared reusable password is not required.
The standard family lets a person prove possession of an authenticator the service already enrolled, instead of typing a secret that can be reused elsewhere.
How it works
An authenticator may be a security key or a built in capability of a phone or computer that the person unlocks locally.
The service stores a public credential for that authenticator, and a later sign in checks possession without sending a reusable password to the site.
This reduces phishing that tricks someone into typing a password into the wrong page, because the authenticator is bound to the real site.
Organizations still need a recovery path for a lost authenticator and a choice about which assurance level a given action deserves.
Concrete examples
- A staff member signs in to payroll with a registered key and never types the payroll password into a mail link.
- A bank offers an authenticator for transfers above a threshold and keeps a simpler method for low risk balance checks.
- A lost security key is revoked, and a previously registered spare lets the person back in without a support agent resetting a shared password.
Protective measures
- Enroll authenticators for accounts that can move money or change sensitive data, and test the recovery path.
- Revoke a lost authenticator immediately, and require more than a mailed link to register a replacement.
- Prefer authentication bound to the real site over a one time code that a person might read aloud to a caller.
- Explain to staff what the authenticator is for, and do not ask them to approve a prompt they were not expecting.