In today's interconnected world, where information is constantly being transmitted over networks, the 

research conducted by Cofense Intelligence

, man-in-the-middle (MITM) attacks increased by 35% between Q1 2022 and Q1 2023.

In this blog post, we’ll explain how modern authentication solutions can help safeguard your workforce and organization from these threats by reducing the likelihood, impact, and scale of an attack. 

 that occurs when a malicious actor intercepts or alters the communication between two parties who believe they are communicating directly. In this type of attack, the attacker can eavesdrop on conversations, steal sensitive information, or inject malware into the communication stream without the knowledge of either party.

One of the most common methods of MITM attacks is known as “

”. Using this method, hackers will deploy tools to inspect packets of data with the aim of intercepting unencrypted information, such as plaintext passwords, from the victim. A skilled hacker can not only intercept communication by exploiting vulnerabilities in the network, they can also then launch further attacks on any device connected to that network.

, the European Union Agency for Cybersecurity, a MITM attack usually involves 

. The first is intercepting raw data by gaining access to the network. The second step is circumventing any encryption and authentication protocols that the target device/victim has in place. 

 that attackers can use to intercept, monitor and manipulate communication between two parties. Understanding the different types of MITM attacks is crucial for organizations to implement effective security measures to safeguard against these types of cyber attacks.

In this type of attack, the attacker impersonates a trusted IP address to gain access to the network and intercept messages. IP spoofing is typically used to launch DDoS attacks on servers. One of the biggest examples of spoofing occurred in 2017 when 

a 2.5 (network) terabyte per second DDoS attack.

This form of attack is achieved through a method known as 

– With this method, the attacker manipulates the DNS (Domain Name System) server to redirect the target's traffic to a fake website in order to steal sensitive information from the unsuspecting victim.

The attacker intercepts and decrypts SSL (Secure Sockets Layer) traffic to steal sensitive information.

The attacker uses a Wifi sniffer to eavesdrop on wireless traffic and steal sensitive information.

The attacker steals session IDs to hijack the user's session and gain access to the target's account. This type of attack is particularly insidious as the attacker can stay logged in until the session is timed out.

To protect against man-in-the-Middle (MITM) attacks, organizations should follow these security measures.

Implement network segmentation to divide your organization's network into separate segments. This helps isolate critical systems and sensitive data, making it more challenging for attackers to move laterally within the network and conduct MitM attacks.

Deploy strong firewall and intrusion detection systems

Utilize robust firewall solutions and intrusion detection systems (IDS) or intrusion prevention systems (IPS) to monitor network traffic for signs of malicious activity, including potential MitM attacks. These systems can help identify and block suspicious network traffic patterns.

Implement certificate authority (CA) infrastructure

Establish an internal Certificate Authority infrastructure to issue and manage SSL/TLS certificates for your organization's websites, services, and internal communication. This helps ensure the integrity of your certificates and reduces the risk of attackers issuing fraudulent certificates.

Conduct regular vulnerability assessments and penetration testing

Regularly assess your organization's infrastructure for vulnerabilities and perform penetration testing to identify potential entry points for MITM attacks. This proactive approach allows you to address security weaknesses before they can be exploited.

If your organization provides Wi-Fi access to employees or guests, use secure Wi-Fi protocols such as WPA2 or WPA3. Additionally, consider implementing enterprise-grade Wi-Fi solutions that offer features like client isolation and certificate-based authentication to minimize the risk of MitM attacks on wireless networks.

Develop and enforce strict security policies for employees, including guidelines for using secure communication protocols, recognizing and reporting suspicious activities, and adhering to password best practices. Regularly train employees on security awareness and educate them about the risks of MITM attacks.

Implement advanced authentication mechanisms like 

Consider implementing multi-factor authentication (MFA) or biometric authentication for accessing sensitive systems and data. This adds an extra layer of protection, making it more difficult for attackers to impersonate legitimate users.

Encrypt sensitive data at rest and in transit. Use strong encryption algorithms to protect data when stored in databases, on servers, or during transmission. Encryption helps ensure that even if intercepted, the data remains unreadable to unauthorized individuals.

Deploy security information and event management (SIEM) solutions to monitor network traffic and log events. Analyzing network traffic patterns can help identify anomalies and potential MitM attacks in real-time, enabling a swift response.

Conduct regular security awareness training

Educate employees about MITM attacks, their consequences, and how to detect and report suspicious activities. Provide ongoing security awareness training to reinforce best practices and keep employees informed about emerging threats.

Keyless provides a credential-free multi-factor authentication solution that can help reduce the impact of MITM attacks by limiting the amount of sensitive data that can be stolen during an attack. With Keyless, users are authenticated using advanced, privacy-preserving facial recognition (inherence) and device verification (possession) – eliminating the need for passwords and single-use credentials like OTPs.

This essentially makes it impossible for hackers to steal sensitive login credentials that would otherwise allow them to gain access to employee accounts and company systems. 

Furthermore, Keyless can integrate with remote working apps such as VPNs to help protect remote employees accessing company email or data from unsecured networks. Lastly, Keyless can enable organizations to authenticate users more often without hurting productivity, helping to enforce zero-trust security environments that stop attackers from moving laterally through a network. 

By implementing Keyless, alongside other critical security measures, you can significantly enhance your defenses against MITM attacks and protect sensitive information from interception and manipulation.

Safeguarding your organization from man-in-the-middle (MITM) attacks

Biometric authentication has become increasingly ubiquitous across various industries and applications, providing a secure and efficient means of online identity verification. Among the biometric modalities, facial recognition technology has gained considerable attention in recent years due to its unique advantages. 

Compared to other biometric authentication modalities, facial recognition solutions can accurately verify an individual's identity while improving the authentication experience overall from a user-experience perspective. 

, the global facial recognition market was valued at $3 billion in 2019 and is expected to reach a value of $13 billion by 2028. In this article, we will explore the reasons behind the success of facial recognition technology compared to other biometric authentication modalities. 

Biometric authentication is a highly secure and reliable method of authentication based on unique biological characteristics such as fingerprints, facial features, and voice patterns. But, while biometric authentication is more secure and reliable than traditional password-based methods, it is not foolproof. That is why it's essential to choose biometric authentication systems that have been extensively tested and verified.

Why is facial recognition superior to other biometric modalities?

Facial recognition technology is more reliable and secure than other biometric authentication methods. A 

 showed that facial recognition technology is less intrusive and can accurately identify a person's identity with a high degree of accuracy, making it a popular choice for security and authentication purposes.

Other biometric authentication methods, such as fingerprint and voice recognition, encounter limitations. Fingerprint recognition is a commonly used method, but it can be bypassed by hackers with an 

. In contrast, voice recognition can be easily fooled by AI-generated voices, as demonstrated by a 

 who broke into a bank account using an AI-generated tool.

Facial recognition presents several advantages over other biometric modalities:

Liveness detection and anti-spoofing systems

Facial recognition technology has advanced to include liveness detection and anti-spoofing systems. Liveness detection systems can determine whether the face presented to the camera is real and not simply a photograph or video. Meanwhile, anti-spoofing systems can identify signs of tampering or manipulation in the image, such as masking or overlaying.

Facial recognition is viewed as a more reliable form of biometric authentication as it does not rely on physical contact with the device like fingerprint recognition. Often, fingerprint recognition fails to work when fingers are wet, dirty, or injured, making it unreliable in certain situations. However, facial recognition tends to work in nearly all situations.

Facial recognition technology is typically considered a more secure and reliable biometric authentication method than other biometric modalities, such as fingerprint and especially voice recognition. Voice recognition, in particular, has recently been under scrutiny due to the increasing sophistication of voice cloning tools which enable scammers to readily 

. In contrast, advanced facial recognition technology requires a live sample of an individual's facial image to be captured. As such, this is usually with the knowledge and consent of the user, which can help build trust and demonstrate a commitment to privacy and security.

User experience is critical for biometric authentication, especially as its use is becoming more mainstream. According to a 

, 2.6 billion consumers will use biometrics for authentication by 2023, highlighting the growth of this technology.

The process of facial recognition is intuitive, requiring little conscious effort from the user. Users present their faces to the device's camera, automatically recognizing and authenticating them. This technology saves time and effort by avoiding entering complex passwords or PINs.

Facial recognition technology boasts a low error rate even when users wear glasses or hats, according to a 

National Institute of Standards and Technology (NIST) study

 that revealed the best face identification algorithm has an error rate of 0.08%. The same research also disclosed that some facial recognition algorithms perform 20 times better when the subject is wearing a mask, proving the adaptability and versatility of this technology.

Why you should implement facial recognition

Facial recognition technology offers numerous benefits for biometric authentication, including improved reliability and security with liveness detection and anti-spoofing systems. Solutions like FaceID enhance the user experience and provide simplicity while privacy-preserving biometric authentication can be achieved with solutions like 

Looking to the future, we expect continued growth in biometric authentication methods, and facial recognition technology will likely become even more integrated into daily life and business operations. Ongoing innovation and development must prioritize reliability, security, and privacy to ensure that the technology remains trustworthy.

Explore passwordless solutions like Keyless today and unlock a new level of security and convenience for your customers. To learn more about our solution and how it can benefit your organization, visit 

Why facial recognition is the biometric authentication method of choice

We're proud to announce Keyless has taken home three separate awards in the 

We’re thrilled to be recognized in the 2023 Infosec Global Awards – winning one award is a huge achievement; winning three is a testament to our technology and the dedication and talent within our team. We hope these awards highlight the potential for emerging biometric solutions in helping to improve security, fight fraud and protect privacy,” 

said Andrea Carmignani, Co-Founder and CEO at Keyless. 

The Global InfoSec Awards honor global innovators in the cybersecurity industry who have a unique and compelling value proposition. The judges included CISSP, FMDHS, CEH, and certified security professionals, who voted based on their independent review of all nominees.

 world-first biometric authentication solutions

 that leverage privacy-enhancing cryptography to provide a secure, convenient, and privacy-focused way for users to authenticate their identity online. 

These winners are the most innovative, forward-thinking and proactive cyber security companies and service providers on the planet who are working to bring tomorrow’s cybersecurity solutions to market, today,

 said Gary S. Miliefsky, Publisher of Cyber Defense Magazine.

The complete list of this year's winners can be found here: 

Keyless Stands Out in 2023 Global Infosec Awards

In our digitalized world, virtually every business that matters has an online presence. And yet, while businesses and technology have evolved significantly since the early days of the internet, the use of passwords has unfortunately remained an ever-present feature. 

The task of remembering multiple passwords for different accounts and recovering them can be daunting – yet despite passwords being a 

The good news is that there is a solution to the password problem, and that is: 

. By eliminating the need for credential-based authentication methods such as OTPs and passwords, organizations can fundamentally transform the user experience, making it more convenient, secure, and user-friendly. 

In this article, we’ll explore how adopting a passwordless strategy can help accelerate innovation and improve brand experience, benefiting users and organizations alike. 

What are the benefits of embracing passwordless login?

Implementing a passwordless solution can be a key differentiator in how users perceive your business. In the new digital norm, fast and simple access to online services and applications is critical to business success, client retention, and productivity. 

Passwordless solutions have many benefits, including enhanced security (by reducing the risk of attacks caused by compromised credentials and personal data) and eliminating the need for users to remember and manage multiple login credentials.

One of the most popular forms of passwordless authentication is 

, which uses unique physical characteristics, such as fingerprints or facial features, to verify a user's identity. According to a 

, over half of the users surveyed who use biometric authentication methods prefer them over any other method.

Biometric authentication offers several advantages over other forms of authentication, including increased security and convenience. Biometric data is also unique to each individual and cannot be easily replicated or stolen.

How does a passwordless strategy transform the user experience?

Passwords can easily be stolen through keyloggers, malware or a vast number of other nefarious tactics employed by hackers. As such, passwords are often viewed as the weakest link in security, with compromised credentials being the most common initial attack vector, representing 

By adopting a passwordless strategy, businesses can enhance their security and offer far more secure authentication methods – such as biometrics – which are much harder for hackers to bypass. Switching to biometrics provides peace of mind for both businesses and their customers, and goes a long way to protecting user accounts from fraud and other cyber threats.

 have shown that over 50% of users prefer to protect their accounts using a method that does not involve passwords. This is no surprise since passwords can be a source of frustration for users. One of the main advantages of using a passwordless solution is that it can reduce login friction, as users aren’t expected to remember difficult passwords. 

With passwords, users often forget their login credentials or use weak passwords that are easily compromised, leading to a frustrating user experience (UX). A poor UX can result in a number of 

 for your business, with instances of abandoned shopping carts and a 

 being the most common outcomes. In addition, a poor UX design is likely to be 

 as your customer and IT support teams gradually become inundated with requests from disgruntled customers/users. 

In a worst-case scenario, a bad UX could result in your business losing customers entirely or hiring many extra team members to manage the ever-growing list of support tickets.

By adopting a passwordless strategy, your business can vastly improve the UX, as customers will be able to log in to their accounts without the need for any complex passwords. As such, a passwordless solution makes the login & overall user experience seamless and more user-friendly. It is 

 that businesses with good UX design are more likely to face reduced operating costs, increased conversions, and perhaps most importantly, have more satisfied customers. 

 shows that 81% of satisfied customers are more likely to do business with your company again if they have a positive experience. Comparatively, as much as 95% of customers are likely to take some form of action (a bad review, discussing the experience with friends and family, etc.) after receiving a negative experience. As a result, it’s imperative that businesses put their customers front and center, and one way of doing this is by implementing a passwordless solution. 

Overall, adopting a passwordless strategy can offer a range of benefits for businesses and their customers. By improving both security and the user experience, businesses can gain a competitive edge in the market while providing their customers with a more secure and seamless experience.

Embrace a passwordless future with Keyless

In a world where cyber threats continue to evolve, it's essential to prioritize security while also delivering a frictionless user experience. Keyless offers a cutting-edge solution that addresses both of these challenges. 

As such, we believe that our industry-leading, biometric-based passwordless authentication solution can help your business embrace a passwordless future. Leveraging facial recognition to authenticate users without requiring passwords, Keyless eliminates the risk of credential theft and phishing attacks while also streamlining the login process for your users. As such, customers of businesses that use Keyless can enjoy a faster, more convenient and more pleasurable user experience than ever before.

Our privacy-enhancing, frictionless authentication technology has been recognized by numerous industry experts and organizations, earning awards such as the Frost & Sullivan 2020 European Technology Innovation Award for Passwordless Authentication.

Don't let passwords hold you back from delivering the best possible user experience. Join the passwordless revolution with Keyless today and unlock a new level of security and convenience for your customers. To learn more about our solution and how it can benefit your organization, visit 

How adopting a passwordless strategy can transform user experience

We're proud to announce Keyless has taken home three gold awards in the 

We’re extremely proud to be recognized by the Cybersecurity Excellence Awards as a gold winner in three categories this year – a huge achievement. These prestigious awards recognize the best in the industry, so it’s a testament to the work of our team and the industry value our solutions are providing,” 

said Andrea Carmignani, co-founder and CEO at Keyless. 

The Cybersecurity Excellence Awards recognizes individuals and companies that demonstrate excellence, innovation, and leadership in information security, based on the strength of their nomination and the popular vote by members of the Information Security community.

The awards were given to Keyless for our 

world-first biometric authentication solutions 

that leverage privacy-enhancing cryptography to provide a secure, convenient, and privacy-focused way for users to authenticate their identity online. 

Keyless is also the first vendor to win gold in the newly created 

 category, attesting to not only its technology but the growing acceptance of biometrics in the wider cybersecurity community. 

“We congratulate Keyless for the recognition as an award winner in 3 separate categories in the 2023 Cybersecurity Excellence Awards," 

said Holger Schulze, CEO at Cybersecurity Insiders. 

"With over 800 entries in more than 300 award categories, the 2023 Cybersecurity Excellence Awards program is highly competitive. All winners reflect the very best in innovation and excellence in defending against today's evolving cybersecurity threats," 

Keyless Cleans Up in 2023 Cybersecurity Excellence Awards

Identity and Access Management (IAM) is an essential part of virtually every organization's security setup. IAM systems help control who has access to an organization's files and systems.

If your organization has a worldwide workforce or manages remote workers, the chances are, you’ll already be using an IAM provider to ensure safe and secure employee access to business-critical services and applications.

Today, most IAM platforms integrate with internal business applications and systems to offer a 

 for employees, helping to reduce password fatigue and improve employee productivity. While IAM platforms can help enable better digital experiences for your employees, authenticating once and gaining access to a wide range of company apps and data can pose significant security risks. 

By integrating solutions like Keyless with your IAM application, you can help keep your company's data safe and secure. Read on to find out more.

The role of IAM is to securely manage who has access to company data, files, apps, and systems. The idea is to block access to specific data and systems based on an employee's role and responsibilities. A proper IAM strategy will ensure that only authorized users gain access to business-critical systems and company data. 

Today the IAM market is dominated by companies such as Microsoft, Okta, IBM, OneLogin, and Ping Identity.

IAM platforms like these typically use magic links (one-time email links used for authentication) to offer a single-sign-on experience for employees. Once authenticated, employees can access multiple linked apps, services, and files until they log out – posing a massive problem if employee credentials are compromised. 

Magic links and OTPs can greatly increase the chances of threat actors gaining access to sensitive company data, especially if a company also uses weak authentication methods for authenticating employees to company email. 

65% spike in total global losses from business email compromise (BEC) fraud in 2022

. BEC is where bad actors aim to compromise an employee's email address to commit fraud and launch further attacks within an organization. 

Public-sector employees are at particular risk, with 

government employees making up more than 50% of all credential-stealing phishing attacks in 2021

To mitigate these risks, Keyless integrates with the world's leading IAM providers to provide a passwordless multi-factor authentication solution that is resilient against emerging fraud, phishing, and spoofing threats.

When employees sign in using Keyless, employees will be prompted from their trusted device to authenticate by looking into their device’s camera – a seamless multi-factor authentication experience that is fool-proof for employees. 

Keyless secures SSO access to IAM applications

 by combining privacy-enhancing facial recognition with background device verification checks to offer MFA with a single look into the camera.

With Keyless, employees can enjoy secure access to the systems and apps they need to complete their jobs. This approach empowers organizations to strengthen their overall network security by ensuring that only authorized users can access company data.

Our world-first technology offers a truly passwordless experience that is resilient against emerging phishing, social engineering, and credential-stuffing attacks, as well as biometric spoofing threats. 

From strengthening security to preventing employee credential sharing and streamlining employee access, our passwordless solutions enable superior authentication experiences, which can help organizations accelerate a zero-trust environment while reducing the attack threat surface.

The benefits of using Keyless to login into your IAM applications 

Keyless can be integrated directly into a workstation via our SDK or installed on an employee's work (or personal) handheld device. Our biometric-based, passwordless MFA solution can dramatically enhance the security of IAM platforms.

Interested in learning more? Experience the simplicity of Keyless authentication today – 

How Keyless helps enhance IAM security

While it is often overlooked in light of other security concerns, account recovery is a considerable labour-intensive task for IT service desks. As the size of a business grows, so too do the challenges posed by account recovery.

In this article, we will discuss the key challenges of account recovery and reveal how companies can improve their account recovery procedures.

As a business, your account recovery processes make a major difference to the user experience of your platforms and apps.

Data shows that the average person has around 

However, forgetting login details are not the only reasons why a customer would need to recover their account. Account recovery may also be required when an account has been locked due to a previous breach. In some cases, accounts can also be locked if a customer changes the device that they log in from. 

In all of the above scenarios, account recovery should be straightforward for a customer to register a new device or reset a compromised password. 

At Keyless, we understand that poor authentication experiences negatively impact user experience. By using a 

passwordless multi-factor authentication solution

 like Keyless, customers can log in to accounts with a single look into the camera, which allows for a better and smoother user experience.

 recommends a technique known as ‘throttling’ - whereby password systems are configured so that there is a progressively increasing time delay between successive login attempts. The idea behind throttling is that it restricts the number of times that an attacker can attempt to enter an account, while also providing multiple opportunities for a legitimate user to remember their password. 

Throttling is generally preferred to a standard account lockout scheme that tends to give a limited number of login attempts before the account is frozen. Once a user's account has been frozen, they are effectively forced to contact the company’s helpdesk.

Additionally, as passwords continue to become more complex, companies are beginning to use additional account recovery methods to help customers access their accounts. For example, many organizations also ask users to set a secure PIN alongside their password. However, unless the PIN is a number or code that the customer uses elsewhere, they’re likely to forget these as (unlike a security question) there is often no context or hint provided. 

Occasionally, companies might provide users with a set of single-use authorization codes that they can enter to recover their accounts. Authorization codes are generally seen as more secure than a PIN, but again, unless the user writes them down or takes a screenshot (which itself is a security risk), they’re unlikely to remember an arbitrary string of numbers and letters with no context. 

Increasingly, companies are also implementing device-bound account recovery methods via one-time passwords (OTPs), or through device-bound biometrics. However, it’s important to note that if the customer has lost their device, they would also be unable to generate their OTP or supply their biometric data to access their account.

As a result, businesses using device-bound methods need to rely on fallback authentication methods to verify customers' identity - often a set of security questions or, at worst, contacting support. 

Calling a helpdesk to carry out a password reset isn’t just frustrating for the customer, but also a costly and time-consuming endeavor for the business as well. 

A study by the Gartner Group found that up to 

 are related to password resets, with each reset typically taking between 2 - 30 minutes to fix. In monetary terms, meanwhile, Forrester Research found that the average cost of resetting a single password is as much as 

When you consider that massive global organizations such as Amazon, Apple, or Meta deal with millions of customers a day, it’s easy to see just how expensive a password reset can become if you don’t have a sufficient account recovery method in place. 

Businesses that wish to protect their users from account takeovers, while also limiting their helpdesk expenditure, should consider using a hybrid account recovery approach that merges passwordless account recovery with a self-service solution. 

Some account recovery methods are an invitation for fraud

Typical account recovery methods, such as sending OTPs via SMS or email, can pose security risks as these can readily be intercepted by malicious actors.

Research has shown that OTP security might fail 

 and that accounts using OTPs are increasingly being targeted by hackers looking to carry out account takeovers via SIM swapping. Even OTPs sent via push notification or via an authenticator app can be intercepted using the latest phishing toolkits and keyloggers. 

Scammers are increasingly aware of the pain points of account recovery and are actively targeting customers by offering 

In addition to offering personalized “support” to customers who have forgotten their passwords, fraudsters are increasingly exploiting outdated account recovery methods to impersonate users and access their accounts. 

For example, scammers have used stolen personal information (often obtained through 

) to impersonate genuine users while initiating account recovery processes.

The rate of data breaches is increasing globally, which has contributed to the rise in identity theft and impersonation. Since 2001, the victim count has increased from 6 victims per hour to 97 - making for a 

Passwords, PINs, and OTPs are all “written” information which opens the door to a number of fraud and security concerns, as outlined previously.

Companies that use Keyless are resilient to credential-based authentication fraud, such as phishing and man-in-the-middle attacks, as there is no written password or code, that can be compromised. With Keyless, businesses and customers alike can benefit from a 

 that enhances security, eliminates overheads, and improves user experience.

Interested in learning more? Contact us today to discover how Keyless can help your business overcome the challenges of account recovery.

Solving Account Recovery Challenges with Keyless

The average business typically has multiple subscriptions to a vast number of cloud services or online-enabled software such as Microsoft OneDrive, Teams, and the Google Workspace suite. With every site or service requiring unique and often complex login credentials, employees will often reuse passwords to make their login information easier to remember.

, passwords are no longer able to fulfill the simple role they were designed for and have lost both their intuitiveness and effectiveness when it comes to mitigating unauthorized access. Unfortunately, despite a steady increase in 

hacking attacks and data breaches caused by compromised credentials

, passwords are still the most common method of verifying a user’s identity online.

 to both employee and company security. While Single Sign-On (SSO) authentication can somewhat reduce this threat by allowing users login to multiple applications with a single password, there are still security risks. With SSO, it only takes one password to be compromised for a bad actor to access a wide range of internal apps and systems. SSO security can be improved by replacing passwords with Keyless’ passwordless authentication solution.

SSO is a session and user authentication service

 that allows a user to access multiple applications and services using only one singular set of login credentials. 

One of the main benefits for both employees and businesses using SSO is the fact that it allows enterprise users to avoid having to create a unique password for all the applications that they need throughout their working day. As such, this means that businesses using SSO can reduce their security vulnerabilities while also increasing employee productivity and collaboration. 

 between an application (service provider) and an identity provider. This “relationship” between identity and service provider is based on a certificate of authentication that is exchanged between the two parties when the user attempts to log into an application. 

One thing is clear - SSO improves the user experience. But at what cost? Let’s take a look at the security risks associated with an SSO authentication model.

Verizon Business 2022 Data Breach Investigations Report

 showed that hacking was the most common form of data breaches, with a Denial of Service (DoS) attack and the use of stolen credentials both equally responsible for 40% of the hacking actions taken last year. 

An SSO service is a potential golden ticket for cybercriminals because once a hacker has obtained the SSO login credentials, they can automatically get access to any number of applications that are linked to that specific account. Depending on how a user is authenticated (i.e., via OTPs to an email), a hacker could also take full control of an employee's email account and use this to register for even more services.

SSO authentication can also raise issues for businesses that have multiple users on a single device. For example, if the previous user forgets to completely log out of the SSO service before leaving the device, any accounts authenticated to that user will still be accessible on that same device for the next employee. Depending on the intentions of the second employee using the device, they could use their colleague's account to defame others, which could result in the termination of the wrong employee. 

 (such as Apple, Facebook or AWS) for Identity and Access Management (IAM) to verify and authenticate a user. However, should the third-party identity partners service be unavailable for whatever reason, the end user will be unable to access any of their accounts.

In practice, this means that even if the application’s (or service provider’s) service is available, a user will not be able to access their account directly. Instead, the user must wait until the identity provider's services are back online in order to use their account.

Little adherence to the principle of least privilege

The principle of least privilege dictates that a user should only have access to the minimum data, applications, and files needed to do their job. For example, under this principle, if a user wishes to access a file outside of their job range, they will need to request access before they can view or edit the file.

However, SSO systems do not necessarily limit certain users from only accessing content that is relevant to their position. The security concern with this is that you could potentially have senior-level, company-sensitive information being viewed by junior or freelance staff. Depending on what security procedures are in place, a rogue employee could also sabotage company documents if they haven’t been write-protected.

Keyless partners with major identity providers by combining authentication with SSO to provide customers with a best-of-both-worlds passwordless SSO authentication technology, offering greater security for businesses and employees, as well as improved usability for the end user.

Unlike traditional password-based systems that have the potential to be hacked due to compromised details or phishing attacks, with passwordless SSO, there is no password to steal.

As shown in the video above, passwordless SSO allows individuals to use several different services, without the risk to user privacy. Users who wish to log in to a particular service or application only need to tap a notification on their linked device to be authenticated.

Lastly, passwordless SSO also alleviates the workload of IT teams, which are often burdened by password reset requests. According to a study by Gartner, 

40% of an IT team's time is taken up by such tasks

Blog