The demand for seamless and secure authentication experiences is growing. With the rise of contactless payments and remote working, our lives are becoming more digital. Thanks to the likes of Face ID and Touch ID, users are increasingly at ease with passwordless solutions, but these popular solutions aren’t perfect. 

Almost all of today's authentication solutions have exploitable gaps – whether in terms of UX, security or privacy. In this blog, we'll not only answer some of your top authentication questions, but we'll explore how Keyless closes these gaps with biometrics.

1. Why are traditional passwords facing obsolescence? 

passwords weaken your organization's security posture

. When individuals reuse or share passwords, users face elevated risks of identity fraud, data leaks and phishing attacks. Given that over 80% of data breaches are due to poor password security, the security flaws of passwords are clear. For users, having to create complex passwords for each account is bad for UX. And for firms, loss of revenue as a result of identity fraud or non-compliance fines makes passwords a costly expense. 

Many organizations are turning to band-aid solutions like password managers and other password-based multi-factor authentication solutions (MFAs) in a bid to strengthen compliance and security. However, password managers can create greater security risks in the event of an account takeover, and legacy MFAs are burdened by poor UX, forcing users to complete multiple challenges in order to authenticate and access their accounts. How do we resolve those issues? The answer lies in moving towards new modalities that are more intuitive, such as biometrics. 

3. Why has it been difficult to make authentication intuitive and secure at the same time? 

The ideal authentication solution should combine great UX with robust security and privacy. In reality, most authentication vendors fail to do this, often sacrificing one feature over the other in a bid to meet market demands. 

Making authentication intuitive and secure at the same time has been difficult, as the traditional way to increase security is to increase authentication challenges and make password requirements more complex  – resulting in increased friction which impacts churn and . 

For example, an MFA solution that combines passwords with one-time codes may offer stronger security, but the user experience can be clunky and result in churn and increased costs. On the other hand, less friction can sometimes create security and privacy gaps – but new authentication modalities, such as biometrics, are changing this. 

4. What does the future of passwordless authentication with biometrics look like? 

Smart devices have popularized biometrics in recent yers – they are intuitive, eliminate the need for remembering passwords and PINs, and are integrated with many popular apps that people use every day.

It’s clear biometrics are the future – however popular solutions such as Apple’s Face ID and Google Touch are not by any means perfect. In fact, these solutions leave much to be desired from an interoperability and security perspective due to the underlying technology they use to secure authentication data like biometrics and PINs. 

The underlying technology powering solutions like FaceID is 

. Local authentication  became the industry standard for biometric authentication because it secures sensitive data within hardware, or "locally" on a device (as opposed to in on-premise or cloud data storage centers) – making it difficult for biometrics to be compromised by opportunistic hackers.

Locking biometrics to a hardware device however, such as a smartphone or token, creates limitations in regards to account recovery, consistency between different device models, and security gaps with device-sharing. When it comes to authenticating customers, businesses that rely on these solutions have little control over the user journey and security features they offer. 

5. How can biometric data be securely stored and protected without using local authentication technology?

Keyless is the first in the world to apply privacy-preserving technology to biometric authentication

 to make it impossible to steal, hack or leak biometric data – while still processing authentication requests online.

 and distributed cloud architecture, Keyless echoes the principles on which decentralized technology operates, keeping biometric data permanently out of reach of bad actors, solution providers and clients simultaneously – exceeding the requirements laid out under GDPR. 

To accelerate the adoption of biometrics, the focus for innovation will fall into these three areas: 

5 Essential Questions on Authentication and Biometrics

A conversation with Gal Steinberg, VP of Products at Keyless 

Advancements in biometrics are enabling us to transform how we authenticate people and verify their identities, enabling us to authenticate the actual person, instead of the device or the password they use to login. 

To help unpack what this can mean for you, our VP of Products Gal Steinberg, shares his perspective on how biometrics are helping to drive a new era in online security and identity management.

It wasn’t so long ago that biometric solutions were seen as a contentious issue due to fears of surveillance or lack of privacy – but customer demands for frictionless online experiences have been rising steadily over the last decade. We're seeing more users every day demanding smoother online experiences and faster access to online accounts and platforms. 

If there was any uncertainty around user attitudes towards biometrics, technologies like Apple's FaceID have proven without a doubt that consumers prefer biometric authentication experiences – with 42% of users already adopting device-based biometrics.

But are biometric authentication solutions secure?

It depends on the underlying technology. With the sheer volume of leaked data available online, biometrics are undoubtedly more secure than a username and password – however since your unique attributes cannot be replaced if compromised, biometrics can wreak more havoc than passwords if not handled properly

When a biometric data breach does happen, your sensitive data becomes irretrievable. And while the likes of Touch and Face ID deliver a good login experience, in their attempt to protect private biometric data, there are a number of security and interoperability drawbacks to these solutions. 

The number one being, to protect customer privacy, biometrics are often stored on the device instead of online where they are more susceptible to security and privacy threats.  "

Instead of authenticating the actual human being, you're authenticating the device

On every new device a user must enrol for biometrics again, which means businesses actually have low assurance that a user is who they claim to be – as unauthorised users with stolen credentials can register for biometric authentication on their own devices without anyone being able to tell the difference between the two sets of biometrics; on the other hand, not all devices have biometric capabilities, meaning some users don't have the option to use them at all.  

This is why we set out to develop a next-generation biometric solution that uniquely addresses the challenges that come with authenticating users with their biometric

Keyless leverages privacy-preserving cryptography to protect biometric data from privacy and security threats, while also enabling businesses to verify the identity of the user they're authenticating.  

Balancing biometrics with compliance concerns

We've noticed a trend where highly regulated industries are apprehensive or even slow to adopt biometric solutions due to perceived privacy and security risks around biometric data", 

According to Gal, many businesses want to implement biometrics but think they can’t because of compliance and security risks. "

We want to raise awareness about how privacy-preserving technologies can help businesses adopt biometrics while exceeding their compliance obligations under regulations like GDPR and PSD2-SCA. This means our customers can focus on delivering value through biometrics – not scrambling to stay on top of compliance."

Many financial institutions rushed to implement multi-factor authentication (MFA) solutions to meet PSD33-SCA compliance deadlines. However, the rush has proven to be detrimental to some businesses – with the financial services sector being targeted with an influx in advanced social engineering attacks and account takeover fraud despite having an MFA solution in place.  

There are so many ways to do passwordless, but only a subset of solutions are effective,

Many MFA solutions fail to mitigate account takeover fraud and account sharing effectively, so I’d recommend taking the time to understand your pain points and study the landscape to find the right passwordless solution for your needs

Humanizing authentication is a challenge, and we recognize that public confidence in biometrics will take time to mature.

As confidence grows in the potential of biometrics to fight fraud and identity theft, I believe we’ll see it being embraced beyond the consumer space, into markets like the fintech and crypto industries.

Humanizing authentication in the real world 

Some industries, like education, are already experimenting with biometrics to help increase identity assurance in increasingly hybrid environments.

For example, Keyless is being used to help prevent students from cheating in exams. During the first wave of the pandemic, when higher education  moved online, many students had to take classes and exams virtually. 

Universities struggled to ensure students weren't cheating, having noticed some had shared usernames and passwords during the exam period. 

A university came to us after realizing some of its students were enrolling their friends to take their exams,” 

 “It needed a more advanced solution that wasn’t tied to students’ devices to prevent cheating – and so they turned to looking for a biometric solution that could enable this

In financial services, it’s not uncommon for users to endure frustrating authentication processes when accessing critical services and information. The same goes during customer onboarding while service agents are performing their Know-Your-Customer due diligence. But Keyless is helping deliver a more passive, friction-free alternative.

Next-generation biometrics can help businesses transform how their workforce and customers interact with services and devices,

In financial services, where significant fraud and ATO attacks are common, Keyless is helping remove passwords without compromising security while enhancing the user experience

Emerging biometric solutions can allow financial institutions to identify every customer and employee during authentication  – instead of the device. 

Many organizations we work with typically start by trialing biometrics as a proof of concept, trialing new solutions with a subset of users, before rolling the solution out further within their business.

Keyless is seeing groundbreaking examples of biometrics in the consumer space. “

We’re confident that the consumer biometrics market – particularly in banking and payments – will see huge growth in the next five years as awareness continues to expand and more frictionless use-cases emerge in our day-to-day lives

A new era of authentication and identity management 

So, where are biometrics headed over the next decade? According to Gal, they’re expected to be increasingly used within the financial services, banking and fintech sectors as a layered security approach to help protect against rising cases of account takeover fraud and social engineering schemes. 

Secondly, next-generation biometrics will play a crucial role in modern personal identity management. 

I see personal identity management becoming a big part of our lives,” says Gal. “This means everyone gets their own digital identity that only the individual can control. And you can share bits of it to, say, your university, employer, or hospital for them to personally identify and authenticate your unique biometric features.

Simple, secure, private biometric authentication

These are just two examples of where biometrics may be headed. Right now, Keyless are pioneering the next generation of biometrics powered by privacy-first technology.

If you want to learn more about biometric authentication and how Keyless can help you enhance your security and compliance posture, while providing excellent user experiences  please visit our  website. keyless.io/go 

Humanizing Authentication with Biometrics 

Awards season is upon us, and at CogX last month, Keyless took home its first for the year 

Last month we attended the CogX 2022 awards in London – and to our delight we left with the award for 

 and Privacy! It’s always humbling for our team whenever we receive awards like these. 

Although Keyless is new, our technology is the result of almost a decade of research into mobile biometrics and privacy-preserving cryptography, as well as months of testing and development. For those that weren’t aware, we’re the first in the world to build a privacy-preserving solution that enables businesses to securely adopt biometric solutions without any risk to biometric data.

Powerful, Seamless and Private Authentication

With its privacy-first passwordless technology, Keyless is helping companies to improve customer journeys while strengthening compliance and reducing the overall impact of fraudulent account takeovers and identity theft.

Since we launched in 2020, we’ve continued to receive awards and nominations for our unique use of technology. While we’re very humbled by the awards, we’re also proud to share them with the world. 

Below is a list of awards and nominations we’ve received so far 

Keyless Wins Best Innovation in Data Protection Award at CogX London 2022

Just in case you weren’t able to make it, we’ve wrapped up the most important lessons from our latest webinar with Auth0! 

’s Head of Partner Enablement, Tobias to discuss how organisations

can build for the future of identity, and leverage new regulations to make strong authentication their competitive advantage.

Here are the most valuable points from our key takeaways: 

Identity assurance and user friction – finding the right balance

One of the key things we discussed during yesterday’s webinar was how you can find a competitive balance between strong security and frictionless user experiences. 

Tobias rightly pointed out that businesses that integrate overly complex login solutions tend to drive customers away from their platforms and services, and this can quickly result in lost revenue, as well as a profound decrease in overall customer satisfaction. 

In contrast, businesses that offer intuitive solutions – like passwordless social login – are reporting up to a 50% increase in online conversions. 

Yet despite the clear business case for implementing a passwordless solution into your digital applications and platforms, many of you may still be hesitant to part with traditional multi-factor authentication methods due to perceived security and privacy risks, and an increasingly unforgiving regulatory environment.  

So many of you may be grappling with the age-old dilemma: should you prioritise strengthening security and privacy, or reducing friction and increasing revenue? 

As Tobias and Fabian pointed out, Keyless and Auth0 are helping to solve this long-standing trade-off – making it possible to provide frictionless digital experiences while meeting strict compliance requirements.

Face ID and other local biometric authentication solutions leave much to be desired

Keyless stands out from other popular biometric authentication solutions (most notably FaceID) because our technology does not rely on the devices current features and capabilities.

Instead, we’ve developed our own secure biometric software that can be used on any device – and as a testament to our technology, we're one of 

the only authentication vendors in the world

 – the highest level of international certification in biometric authentication and security.

Our certified software can be used on any modern device with a front-facing camera – whether that be a tablet, laptop or mobile – or an Apple, Samsung, Google, Windows or Huawei. This, along with our advanced encryption technology, is one of the key reasons why Keyless is attracting partners like Auth0.

The ability to use Keyless across different devices and brands, Fabian explained, also means your end-users only need to register for biometric login once. Once they’ve registered, those same biometrics are recognised across all of their trusted devices. This enables users to self-manage device revocation and account recovery – dramatically reducing the burden on your support teams. 

It also makes it impractical for end-users to allow friends and family to access their accounts using FaceID or equivalent on their own devices (aka credential sharing) – as trying to login with a different set of biometrics on another device will result in the user being locked out. 

It’s possible to verify identity at every touch point 

What really sets our technology apart is that we can verify an end user’s identity at every touchpoint – all without compromising on privacy, security and the user having to repeat extra identity verification steps across new devices – a clear win-win. 

Again, Keyless can do this because we do not rely on the device's in-built technology. 

You can adopt passwordless biometric authentication without breaching GDPR

Thanks to breakthroughs in privacy-enhancing technologies, it's possible for us to provide secure biometric authentication without you needing to worry about your end-user data being stolen, leaked or otherwise compromised. 

As Fabian explained during the webinar, Keyless uses a patented combination of technologies to ensure encrypted biometric data can never be used to reconstruct a user’s original biometrics – and that no one ever has a complete encrypted template. 

For more info on our breakthrough technology, check out our 

There’s still time to make passwordless your competitive advantage

During the webinar, Tobias shared interesting data comparing end-user attitudes towards different types of strong authentication solutions compared with what applications currently offer.

The biggest takeaway from this is that frictionless strong authentication solutions are not yet a commodity and that you can turn strong customer authentication requirements into your competitive advantage by adopting solutions that balance strong security, privacy and user experience – as Keyless does!

Auth0 and Keyless can support you on your identity journey

 The last, and potentially most important, takeaway from yesterday's webinar was that your identity and authentication partners are there to serve you. Auth0, or whichever vendor you use to manage identities, can help guide you while you navigate staying compliant and competitive in an evolving identity landscape.

Similarly, Keyless is here to help support you when it comes to authentication and knowing which authentication solution is best for supporting you and your unique business case. 

Ready to start your passwordless journey? Get started today.

Whether you’re looking to enhance security for your customers, employees or business partners – Keyless is here to help. Our FIDO2-certified, biometric software solutions can help modernise the way you manage identities across all touch points – while ensuring unparalleled privacy for all your end-users. 

check out Keyless on the Auth0 Marketplace

 to learn more about how we can support you in your passwordless journey.

Key Takeaways from Unlocking a Frictionless Futures Webinar with Auth0

Ever since “cloud computing” hit the headlines (

), people have been predicting the end of on-premise solutions. After all, why do we need on-premises when we can achieve things like greater cost efficiencies, flexibility and better uptime SLAs in the cloud?

The fact of the matter is - while conceptually, the cloud beats on-premise hands down - reality continues to play out differently. Particularly for enterprise organizations who have complex infrastructures, legacy technologies and thousands of users - staff, business partners and customers - accessing systems. Add to that, for some highly regulated industries (think financial services for example) where regulation is so strict, it makes moving to the cloud a difficult sell.

So, let’s start unpacking some of those aspects which slow down, or currently prevent organizations from moving to the cloud:

It’s safe to say that this is the biggest barrier for organizations. Cloud computing utilizes multiple data centres, with some of those data centres hosted countries who hold different views on topics such as data privacy. And from a compliance point of view, some regulators absolutely won’t let data out of the country or region the business operates in, in order to preserve that data privacy.

Additionally, from a security point of view, cloud computing providers may not have the high enough levels of security built into their architecture that some organization types need, and if customer data (for example) is centrally stored in the cloud, that risk is then too high for them.

No business starts out with plans for how they want to look and work in 10 or 20 years time. Organizations grow, for the most part, organically. Departments grow, business units are created, acquisitions are made, and people naturally end up working in silos, which means processes, technologies and data end up in silos too. Users accessing the company’s technology also increase and vary - from access management rights for staff through to business partners and customers.

Migrating to the cloud can add dependencies to existing infrastructures which not only increases administration, but it can have very harmful effects such as customer data being stored across multiple instances, which could cause disruption to the customer experience, not to mention the inefficiency and insecurity of such an approach opening the business to unacceptable risk.

When it comes to cloud computing, there are multiple choices and working out which one is the best fit, that will bring value, be secure and improve operations and user experience (think of how many times or places your employees or customers are being asked to login or authenticate) and the road to cloud adoption gets complicated, fast.

And for those organizations who have to still use on-premise solutions, they will automatically have the requirement for a hybrid approach, which is a challenge for some cloud providers as they can’t offer the same level of data storage, protection and SLAs on-premise that they do in the cloud.

So how can organizations who need to maintain on-premise solutions, but also want to have the option of utilizing the benefits of a cloud solution (at some point), move forward?

Here at Keyless, we’re aware that some of our customers have been experiencing the pains we’ve just been speaking about. And while we can’t solve the entire on-premise-cloud conundrum, we are pleased to say we’re doing our part when it comes to how you can manage digital identity and authentication for your users, business partners and customers: with Keyless On-Premise. It will work just like our existing solutions do - just like an on-premise service. We feel this is an important step, especially for our customers in those highly regulated industries, who can’t quickly or easily move to the cloud. We can offer our customers the ability to quickly adopt and deploy cutting edge technology - without the need to complete a multi-year digital transformation project first. 

If you would like to find out more, please 

Why is On-Premise still here?

There’s been a lot of buzz in the identity and access management market in recent years as new kid on the block – Passwordless Authentication – has been gaining popularity, if not full-scale adoption. 

According to Gartner, by 2025, more than half of the workforce and more than 20% of customer authentication transactions will be entirely passwordless – up from under 10% today. So whether they are ready to or not, organizations must start considering passwordless authentication as a serious option for their login and authentication flows, regardless of use case.

But... passwordless just tells you what the authentication method is not. So, what is passwordless?

This blog will give a brief overview on what passwordless is and what organizations can look out for when considering passwordless authentication solutions. First of all, passwordless authentication methods are available in a few wrappers:

For example, a user could be asked to authenticate as part of a multi-factor process, where they are asked to enter a pattern (something they know) and then enter a one-time pin, delivered most often through their phone (something they have). And even if a password is baked into the first step, the addition of a passwordless second authenticator greatly increases security. That said, while security is increased, it is still compromised by the fact that a password is involved.

Furthermore, there is still the matter of user experience (UX), even if the security box is checked. Multiple authentication methods, across different devices, is hardly the frictionless UX organizations hope to offer their customers.

Biometric authentication is also a great passwordless option, and adoption of this is on the rise. This is in part, thanks to Face ID and Touch, who embed biometric authentication into their devices. Additionally, some biometric authentication solutions also lean on devices, by storing biometric data on the device. While this is certainly a great way to get user buy-in, it still presents organizations with some challenges, most notably, in a couple of areas:

However, passwordless biometric authentication is already moving beyond on-device and it’s challenges. Keyless is a next-gen biometric authentication solution that does not rely on a particular device and eliminates the need to process and store biometric data. This enables passwordless authentication for users in a way that exceeds GDPR and is PSD2 ready. With device-agnostic software, organizations have the ability to provide a consistent and intuitive user experience, that is user friendly, private and secure. It works either as a single factor authenticator or as part of a multi-factor authentication experience, integrating with an existing identity provider (IDP).

Now that we’ve looked at the passwordless authentication methods, what do organizations need to consider for use in their organization, whether for employees or their customers? Here are a few suggestions:

the first vendor in the world to have certification for both FIDO2 and FIDO biometrics

 - which means that our passwordless biometric authentication is approved for both employee and customer use cases. Additionally, if you want to read more from Gartner on this subject, we can also recommend Gartner’s paper, Take 3 Steps to Passwordless (in which we’re also cited).

 Finally, if you’d like to learn more, you can visit our 

schedule a quick call with a Keyless expert. 

So, you want to go passwordless?

Introducing the New Webcam Authentication for Windows

When it comes to multi-factor authentication (MFA), it’s now standard practice to enable it through the use of a “companion device” – most of the time, this is your mobile. But if you think about it, what’s the user experience really like?

How many times have you sat down at your desk, ready to start the day, you open your laptop and your login for accessing the company systems kicks in. To authenticate you, a notification is sent to your mobile-only you’ve left your mobile in another room. You get up from your desk, go get your phone and when you get back, the authentication window has timed out and you need to start again. And this is without other hassles, such as a lost or broken mobile.

And another consideration here - did you know that according to this article in 

: “Employees use an average of 191 passwords to enter 154 times in a given month, racking up an estimated 36 minutes of password data entry during that time, according to a report released today.”

That’s a lot of time lost, entering passwords...

Whatever the situation, we believe security, user experience and productivity don’t need to be compromised.

Windows Webcam Strong Authentication is Here

At Keyless we are continually working to enhance the security of organizations through passwordless, biometric authentication. While we offer it through mobile, as a companion device to laptops, we wanted to give even more flexibility for users authenticating via their organization’s existing identity and access management (IAM) solution.

With Webcam Authentication for Windows, you can enrol for passwordless biometric authentication through the camera on your laptop, or you can simply add your laptop as a trusted device in your authenticator app.

By enabling this feature, organizations can:

Giving you authentication choices 

As of today, joint customers can now take advantage of Keyless’s biometric authentication solutions via IBM Security Verify

Keyless is pleased to announce its integration with IBM Security Verify to help drive the adoption of cutting-edge cloud authentication solutions that can help organizations eliminate avoidable cyber threats.  

IBM Security Verify, IBM’s cloud identity and access management solution, was recently named a leader in risk-based authentication, access management and customer identity and access management by multiple analyst firms. With the integration, Keyless wants to help organizations protect against avoidable threats and poor customer experiences caused by legacy authentication technologies that are still dependent on passwords and one-time codes, such as SMS-2FA.

Keyless, which offers solutions for both workforce and consumer authentication, is currently accelerating its goal to becoming a leading partner for cloud identity and access management providers – having already partnered with the likes of Microsoft, OneLogin, Auth0, ForgeRock, and Oracle earlier this year.

By combining advanced facial recognition and device identification technology, Keyless offers organizations a way to seamlessly authenticate users. Its biometric software is built upon novel privacy-first technology to ensure biometric data is never at risk – meaning organizations can embrace user-friendly biometrics while simultaneously enhancing compliance standards.

Keyless partners with IBM Security Verify to reduce reliance on legacy cybersecurity solutions

Taking Pioneering Biometric Authentication to a New Level

This piece is brought to you by Keyless co-founders: Andrea Carmignani, CEO; Fabian Eberle, COO; and Paolo Gasti, CTO. 

At Keyless, our mission is to provide people and organizations with a passwordless future, where the user is the key. We want to do it in a way that lets people log in to any app or service, from any device, easily and safe in the knowledge that they have the privacy they deserve, and for organizations to maintain security and compliance for their systems and users.

Not only have we achieved that, we continuously work to improve how we do that.

By bringing together over 10 years of research from some of the best minds in cryptography and biometrics, the Keyless team has built and patented pioneering biometric authentication technology that meets the compliance requirements of PSD2, has received FIDO® certifications, and helps online businesses more easily meet the requirements of GDPR. We have a product that we are proud of—that our partners and our customers are proud of.

So today, we are excited to announce that we’re taking Keyless to a new level: Keyless will become part of 

, the leader in Digital Trust & Safety. We’ve made this decision because Sift’s mission closely matches ours—to help everyone trust the internet—and together with Sift, we can deliver on our mission to help everyone achieve a passwordless future.

Digital identity sits at the intersection of user experience, security, and privacy, and as organizations face unprecedented phishing attacks, fraud, and account takeovers, it presents one of the biggest challenges right now—particularly in high-profile, consumer-reliant industries, such as financial services and e-commerce. Therefore, the role of authentication is a critical step in addressing these challenges and preventing fraud. The combination of Sift + Keyless delivers end-to-end growth and protection for all online or digital sites, as current and future customers can leverage passwordless biometric authentication along with Sift’s other Digital Trust & Safety solutions to secure and enhance the customer experience, from account creation to payments to managing disputes.

While this is a big step in our journey as a company, at Keyless our focus and commitment will remain on protecting employee and customer credentials. And with the combination of Sift + Keyless, organizations can take a strong, proactive stance against all fraudulent activity, throughout the customer journey—whether it’s at the point of login, sign up with KYC (Know Your Customer) processes, or in-app authentication.

If you would like to know more about the acquisition, check out the press release. And if you would like to know how Sift+Keyless can help your organization, please 

Blog