Strongholds must be built around each individual’s identity, but what’s the best way to do this in an era of hyper-connectivity? Biometric solutions are our best answer.

The ways in which employees access corporate systems have changed dramatically. The shift to remote working, alongside the sheer volume of devices being used to access private networks, must be the wake-up call to reevaluate and modernize security strategies.

The security perimeter has shifted from the office to user end-points, and now finally to the end-user itself and their identity. The question being asked is not whether or not identity is the new perimeter, it’s how can it best be protected?

How can companies ensure that on-premise and cloud services are safe, while employees and third parties are suddenly requesting access to private systems from all over the world?

The answer to securing the new perimeter lies in rethinking how we authenticate and validate identities in the era of digitization.

identities are too commonly guarded with weak credentials like email addresses and passwords. 

These methods are inherently insecure, leaving companies and their users susceptible to privacy and security threats.

Not only are login credentials at extremely high risk of being compromised in breaches, (Computer Weekly reports that there are over 

15 billion credentials for sale on the dark web

), users also still disregard password best practices, insisting on sharing passwords, PINs, and other login data, despite the known risks.

In an increasingly connected world, weak credentials expose organizations and individuals to large-scale threats. 

To make matters more complicated, criminals are exponentially adept at using compromised email addresses and passwords to breach end-points and networks.

Since one set of compromised credentials can enable a bad actor to breach an 

 network, it’s imperative that we rethink authentication and identity management.

Identity is the new cybersecurity frontier — but who can companies trust?

The answer is no one. By implementing a 

 approach to authentication and identity management, companies can ensure that only the right users have access to the right systems, at the right time.

Zero-trust models differ from traditional security models in that they assume that nobody can be trusted (whether they’ve previously gained access to a network or not). This means users will need to continuously authenticate to prove their identity.

Read our blog on zero-trust security to gain a deeper understanding of zero-trust security models…

The Keyless solution: Passwordless Biometrics

 to provide seamless and secure passwordless solutions for the workforce and consumers.

Our solutions are uniquely designed to ensure that biometric data is never at risk of being compromised, lost, or stolen, empowering our clients to harness the security and convenience of biometric authentication. To offer strong-authentication, Keyless verifies that each authentication request is launched from a user’s trusted device, offering another layer of security that is minimally disruptive yet reliable.

With built-in multi-factor authentication, our passwordless, biometric solutions offer unmatched security, privacy, and usability.

Our solutions enable companies to properly secure identities, end-points and networks, from anywhere in the world, without compromising on user-experience, or productivity.

In an increasingly digital world where cyberattacks are the number one threat against organizations, it’s critical that companies leverage biometrics to enhance security and transform their authentication and identity management experiences.

By leveraging a zero-trust approach, companies can dramatically reduce the chance of a threat actor breaching private systems. But to ensure strong security without jeopardizing convenience, companies must move away from traditional authentication methods which are cumbersome and unreliable.

Biometric solutions are key to securing identities in the remote era

Biometric authentication and identity management solutions solve some of the key remote security challenges.

Biometrics allow for fast, easy, and secure remote login experiences that are minimally disruptive to workflow. The seamlessness of biometrics can empower companies to strengthen security by enabling them to implement tighter access controls.

As well as enhancing authentication flows for employees, customers, and partners, 

multiple inherence-factor challenges to users.

By combining physical and behavioral biometrics, companies can deliver a sophisticated authentication solution that is resilient to spoofing threats and account takeovers — making it extremely difficult for hackers to assume the identity of an employee or user.

Behavioral biometrics differ from physical biometrics (facial, iris and, fingerprint scans), as they are invisible to the human eye and dependent on the individual’s unique interactions with their digital devices.

The combination of both behavioral with physical biometrics poses a challenge for cybercriminals — who usually rely on leveraging stolen and leaked passwords.

However, since a user’s biometrics are irreplaceable, it’s imperative that companies handling biometric data ensure that it’s never at risk. If vendors fail to do this, a user’s identity could be permanently compromised.

Last year, BioStar 2, a web-based security platform that is used by thousands of companies, suffered a breach in which 28 million records were compromised. The company’s databases were allegedly unprotected, making it easy for biometric information to be stolen.

The Guardian reported that the type of data exposed in the BioStar 2 breach was, 

“fingerprint data, facial recognition data, face photos of users, unencrypted usernames and passwords, logs of facility access, security levels and clearance, and the personal details of staff”

How then, can companies leverage the benefits of biometric authentication without jeopardizing user privacy and security?

In the words of security and compliance manager, Neville Armstrong, “

In a digital world, security has to be built into the infrastructure, business applications and solutions from the moment that they are conceived, not just considered post-development.”

When it comes to securing biometric data, t

here are five key rules that must be met to ensure a user’s identity is not as risk of being compromised

Keyless™ authentication can help deliver secure and seamless digital experiences for your end-users and for your increasingly remote workforce.

 to learn more about our biometric authentication and identity management solutions.

Alternatively, you can email us directly at 

Identity is the new perimeter — but how can companies properly protect it?

Passwords are a burden on businesses and consumers. They’re expensive, insecure and difficult to manage — they must be eliminated.

hacking and phishing threats rose by over 600%

. With threats caused by compromised and weak credentials still rising by the day, one thing is clear: 

passwords are no longer able to fulfil the simple role they were designed for.

1. Stolen passwords are a top attack vendor

Stolen and weak passwords are one of top tools that criminals use when attempting to breach corporate networks. According to Verizon, stolen credentials and phishing attacks were the top cyberattack vendors last year, with at least 

eight in ten hacking incidents being tied back to compromised credentials.

2. Complex password policies are disregarded

 employees often disregard password policies altogether,

 with password sharing and reuse rampant in organizations. Unsprisingly, password sharing makes malicious actors coming across a set of company credentials extremely likely, giving them the power they need to launch large-scale attacks.

Organizations spend millions every year in a futile attempt to bolster the password. According to the World Economic Forum, a company with just 15,000 employees will spend 

for password resets alone, or a shocking $346 per employee.

Verizon Data Breach Investigation Report 2020

stolen credentials and phishing attacks are still one of the top methods used by hackers

Yet according to a study by LastPass, only 

57% percent of companies have implemented some form of multi-factor authentication.

Why are companies resisting strong authentication?

Multi-factor authentication solutions are not as widely adopted as they should be because legacy market solutions are 

too cumbersome on users and/or too expensive to deploy at scale.

 Making things even more complicated is the fact that there’s also major security red flags with some legacy multi-factor authentication solutions.

 (passwords, PINs, secret answers), which are easily compromised, with 

 like (smartcards, hardware tokens or one-time codes sent via text to the user’s device).

While some MFA methods are indeed secure, others like those that rely on SMS-tokens, are not. For example, The Telegraph reports that over a five year period, 

 lost over £9 billion in sim swapping attacks.

human error and diligence play a major role in the effectiveness of legacy multi-factor authentication solutions

. However, how diligent can a business expect its employees and users to be when attacks are becoming ever more sophisticated, and employees are under unprecedented amounts of pressure?

A simple, secure and passwordless alternative.

Keyless provides a simple, secure and interoperable authentication solution that allows organizations to solve the trade-offs between security, privacy and convenience.

Seamless user-experience combined with powerful security

At Keyless we combine seamless authentication with unparalleled security by providing a frictionless, passwordless solution for the workforce that is multi-factor by design.

 to authenticate users, Keyless leverages 

advanced biometrics to authenticate a user in mere milliseconds — 

 the user has to do is look into the camera of their trusted device.

during the authentication experience, but also 

eliminates threats caused by poor password management and human error.

Our solution is not dependent on third-party vendors, which means it can be rolled out regardless of what platform and operating systems are being used, or what device a user owns.

By leveraging the user’s device as a built-in second factor, Keyless provides seamless multi-factor authentication without the user needing to remember 

Keyless is the only biometric, passwordless solution that combines the security of distributed systems with privacy-enhancing technology to store and process authentication data.

Keyless builds upon novel cryptographic techniques that allow our network to compare encrypted biometric templates — without decrypting them — in a matter of milliseconds. Because templates are never decrypted, they can be safely stored in the cloud where no personal information about the user can be extracted.

Storing encrypted, biometric data on our distributed network ensures that sensitive information is never stored on a user’s device, where there is risk of it being linked to a user’s identity if the device is lost or stolen.

Universal solutions for a global workforce

Our biometric multi-factor authentication solutions can be quickly integrated and deployed to a globally distributed workforce to enhance security and privacy — no matter what devices or operating systems employees use on their personal devices.

To ensure seamless and fast deployment, Keyless is designed to integrate seamlessly with existing identity management systems like ForgeRock, Okta and Ping Identity.

Since Keyless Solutions are device-agnostic and designed to integrate with existing systems, companies can save on costly and unnecessary overhauls to their current security infrastructure — meaning they can offer 

strong authentication quickly, at an affordable cost.

Our privacy-enhancing biometric authentication solutions for the workforce have the power to transform the authentication experience for the better, whether online or in the real world.

— including 99.9% of all hacking and phishing attacks — they can also 

enhance how employees and users interact with digital services.

 Thanks to the seamlessness and security of biometrics, businesses can start to close the gap between security, privacy and usability, thus making the internet, and by extension the world, a far safer place.

Want to learn more about our workforce authentication solutions? View our one-pager!

Why you must go passwordless

And how zero-trust biometric solutions can help you transition to a more secure digital workplace

We’re rapidly approaching a future fueled by digital technology — one where users and employees frequently access private systems outside the security perimeters of a workplace.

Traditional security systems, which are flawed, to begin with, fail to offer adequate protection from cyber threats outside of the security perimeters of a workplace.

To properly secure remote working environments, organizations must start thinking about implementing radically different security models.

Traditional security models refer mainly to perimeter network firewalls.

Firewalls were designed to protect corporate systems from malicious attacks by erecting security defenses that ward off threats from 

Security experts often refer to this as the 

 approach. The idea is based on the assumption that anyone outside the “moat” (firewall), cannot be trusted; and that anyone in the “castle” (the network) can be.

The issue with this approach is that it assumes anyone within the network can be trusted. This is problematic for two reasons:

Remote-work security is traditionally tackled with VPNs

, but with the rising adoption of smart technology comes the proliferation of security backdoors — greatly increasing the likelihood of a hacker successfully breaching a corporate network via poorly protected remote devices.

If a hacker compromises one smart-device within a home network, then the potential to launch further attacks on other devices (used to access company systems) greatly increases. In theory, hackers could potentially hijack a user’s device, steal their login credentials, and use them to bypass a VPN.

Hackers only need to find the weakest entry point to a network in order to infiltrate it.

Once a hacker has gained access to a network, they’re then free to move laterally within the network until reaching a target — usually a highly sensitive database that contains the private data of users, employees or clients.

According to IBM, the average breach went 

 (just under six months), giving malicious parties plenty of time to steal such data.

What is zero-trust security, and what are the benefits?

Zero-trust  systems take a radically different approach to network security. Instead of trusting those who have already authenticated and accessed a network, these models assume that no one can be trusted — regularly requiring users to reauthenticate as they move through the network. Therefore anyone attempting to access systems must be regularly authenticated no matter where, when or how they access systems.

How do zero-trust solutions protect against insider threats?

Insider threats and cybersecurity incidents doubled between 2018 and 2019 — meaning it’s absolutely true that not everyone who has permissions to a network can be trusted.

Since zero-trust models assume that no one is trusted, they protect organizations from such threats. Insider organized threats can otherwise have large-scale financial and reputational consequences for organizations.

What is zero-trust authentication and identity

Zero-trust authentication and identity solutions combine the principles of zero-trust security, with the principles of strong authentication. Strong authentication – sometimes referred to as MFA or SCA – can greatly improve security by presenting users with at least two 

For example, an MFA solution may require a user to enter their login credentials, followed by a one-time password sent to the user’s registered phone number.

Traditional MFA solutions create a range of user-experience problems when combined with the idea of zero-trust security:

 having to authenticate at every level of access can be disruptive when the authentication experience is cumbersome.

Plus, legacy MFA solutions are not immune to threats — since 2015, 

customers in the UK lost £9.1 million due to SIM swapping attacks

. (SIM swapping is where a bad actor is able to bypass 2FA by having the ‘one-time code’ sent to the victim’s phone number, diverted to a new SIM).

Read more about security issues with 2FA solutions like YubiKey 

The Keyless solution: Zero-Knowledge Biometrics

At Keyless, we combine multi-modal biometrics with privacy-enhancing secure multiparty computation to provide a passwordless, secure and privacy-first way to authenticate users that is minimally disruptive to the user experience.

Our privacy-enhancing biometric authentication solutions offer multi-factor (MFA) security by design:

Once a user is registered, all they need to do to access their accounts is look into the camera of their device.

This simple, user-friendly solution can be implemented at multiple access points, 

ensuring that only the right users have the right access at the right time

To protect end-users and organizations against fraudulent takeovers, Keyless leverages advanced liveness detection and anti-spoofing techniques, in addition to the built-in multi-factor security. This allows Keyless to ensure that the user is in fact, real.

Simple, secure, and above all, private authentication

Or in other words that’s nothing to remember, nothing to type, nothing to lose, nothing to forget, nothing to phish and nothing to copy and paste.

Keyless never stores sensitive information on a user’s device or on centralized servers. Instead, encrypted shares of data are stored on the Keyless Network, a distributed cloud network.

This is possible thanks to our patent-pending technology zero-knowledge biometric (ZKB™) authentication — enabled by the unique combination of state-of-the-art biometrics with 

This breakthrough technology allows Keyless to authenticate users, without needing or being able to access the raw contents of someone’s sensitive information. In other words, we don’t trust anyone, not even ourselves.

Alternatively, you can email us directly at

Why legacy security models don’t work

Attacks and account take-overs like last week’s Twitter hack are completely avoidable. To reduce the impact of a security breach, companies must implement strong authentication at every access point – or risk their sensitive systems, data and reputation. 

The hackers responsible for Twitter's widely reported 2020 hack, where customers were scammed into sending bitcoin to celebrities –  were able to breach the social media giant's backend systems simply by stealing credentials from within its private employee Slack channel. Once inside Twitter’s systems, the attackers were then free to take over at least 

103 accounts and download the personal data of at least 8 accounts

In light of this unprecedented attack, we have to ask ourselves some serious questions — what were login credentials doing on the public Slack channel in the first place? Why were they posted there publicly for ease of access? How did the hackers get access to Twitter’s slack? Were those credentials phished out of an employee in an advanced social engineering attack?

If there’s one thing that’s certain, it’s that passwords are inherently insecure, and failing us. Despite the known security risks, even the world’s biggest companies still struggle with enforcing proper password hygiene.

Why then, are companies like Twitter still using passwords as a means of accessing their backend systems, when alternative solutions that enhance security and privacy are on the market?

To stop these disastrous hacks and breaches from reoccurring, companies must stop using passwords to authenticate employees and start embracing new solutions as a weapon to fight back and end avoidable security threats. 

Biometric multi-factor authentication would have stopped the Twitter attack. Here's How. 

1. Without passwords, there is nothing to steal, lose or remember.

Biometric multi-factor authentication can help secure corporate systems by removing human error from the equation altogether. Unlike passwords, biometrics can’t be easily stolen, faked, or phished. Biometrics also can’t be shared between multiple users, written down and published online, or forgotten.

If Twitter (and Slack) were using biometric multi-factor authentication, the entire attack could have been foiled — saving Twitter and Slack their respective reputations, and Twitter’s users hundreds of thousands of dollars.

2. Biometric MFA can stop bad actors from moving through a network

Biometric multi-factor authentication solutions allow for seamless and secure authentication that is minimally disruptive to workflow and the user-experience. This means biometric MFA can be used to set stringent access controls for users, ensuring that only the right people have access to the right systems at the right time.

In last week’s attack, once the hacker gained access to Twitter’s systems via the compromised credentials found on the company’s Slack channel, they were then free to move through the network until they found a way to hack the accounts of prolific users.

The hacker’s ability to move through the network indicates that Twitter wasn’t using MFA to secure employee access at multiple entry points to its corporate systems.

Access controls ensure that lower-level employees aren’t able to move through a network, meaning that if a single set of login credentials are compromised, a hacker can’t then use them to freely move within a network until they find sensitive and private data.

Having biometric MFA checks at each access point in Twitter’s system would have prevented the attacker from moving laterally through Twitter’s network, which would have stopped them from breaching multiple systems.

3. Biometric multi-factor authentication provides greater security than two-factor authentication

Why didn’t Twitter’s two-factor authentication stop the attack?

The short answer is obvious: Twitter’s 2FA solution still relies on passwords — which are inherently insecure.

Twitter uses 2FA solutions that combine 

 (sent to either the user’s phone via SMS or push or the user’ email address — which only the user should have access to) to authenticate its users.

The problem with 2FA solutions that partly depend on passwords is that one half of the entire solution is unreliable. 

If a password is compromised or shared willingly between people (as was the case with credentials being pinned in Twitter’s Slack), all a bad-actor then needs to do is compromise the user’s device or email accounts to bypass 2FA. Unfortunately, this is 

 done if the user’s passwords for these accounts have also been compromised.

One-time codes (the second half of 2FA solutions) sent via text or email have their own security risks; if an email account or phone number has been compromised without the victim’s knowledge, then bypassing the 2FA security becomes easy.

How biometrics would have stopped the Twitter hack

Biometric multi-factor authentication solutions depend on the user proving who they are via their unique biometrics (something that can’t be easily stolen or faked), and via proof that they have their registered device (by only logging into accounts from these devices). With biometric MFA, the reliably strong methods for authenticating users are fundamentally more secure than 2FA solutions that depend on inherently insecure authentication methods.

To prevent hacks for good, biometric MFA must also be privacy-enhancing and universal

While biometrics remove human error from the cybersecurity equation, they aren’t necessarily immune to being hacked — that’s why it’s critical that biometric multi-factor authentication solutions are also 

, we combine multi-modal biometrics with privacy-enhancing technology to provide a passwordless, secure and privacy-enhancing authentication solution. Our multi-factor solution can be implemented at every access point, ensuring that only the right users have the right access at the right time.

By providing a secure, frictionless way to establish access controls at multiple entry-points, Keyless prevents unauthorized movement through a company’s private systems. This protects from threats like the Twitter hack, where an unauthorized user wreaked havoc simply by stumbling upon a set of compromised credentials.

Privacy-enhancing technology allows Keyless to do two things:

1) Ensure biometric data is never exposed.

 to transform biometric data so that it never represents personally identifiable information. This is done via a one-way encryption function. The transformed data is then split into fragments and stored on different servers (nodes) in the Keyless Cloud Network (instead of on the user’s device). This means that even if one (or all) of the nodes are compromised, that a user’s personal information is never at risk of being compromised.

2) Authenticate users without viewing raw biometric data.

— a privacy-enhancing technology — that allows multiple nodes in our network to authenticate users without needing to view the raw components of the data.

To protect end-users and organizations against fraudulent takeovers, Keyless leverages advanced liveness detection and anti-spoofing techniques, in addition to the built-in multi-factor security. This allows Keyless to ensure that only the real user gains access to private accounts.

There’s no excuse to continue using passwords — it’s time to go passwordless

At Keyless, we believe biometrics are the answer for solving the key challenges that have arisen in cybersecurity, which ultimately led to the Twitter hack last week.

Biometric multi-factor authentication allows us to close the gap between security, privacy, and convenience. By leveraging biometric solutions, organizations can offer both a seamless authentication experience and powerful security. Thereby putting a permanent stop to hacks and threats caused by compromised or weak credentials.

If companies want to avoid future large-scale attacks and hacks like last week’s Twitter hack, then they should immediately be looking to ditch passwords for good. It’s time for enterprises and technology companies to embrace passwordless authentication to secure corporate systems, implement access controls, and protect their users.

If they don’t, they’ll leave themselves and their users vulnerable to financial scams, privacy breaches, fraud, and identity theft.

If Twitter did this one simple thing, last week’s attack would never have happened

Passwordless would have stopped the infamous Twitter bitcoin hack

Unexpected events that highlight our vulnerabilities and weaknesses are often the catalysts for large transformation...

The events of 9/11 prompted governments around the world to tighten airport and aircraft security overnight, which had been relatively lax up until that morning. Likewise, the pandemic, and the onslaught of cyber attacks and threats targeting displaced workforces, has likely been the inflection point that pushed the world to embrace new authentication technologies.

When it comes to remote-work security, passwords are doing more harm than good. In the last week alone, remote workers attempting to access San Francisco Airport’s systems remotely had their credentials compromised, after the airports websites were hacked; and the usernames and passwords of half a million Zoom users, who had their accounts hacked last month, went up for sale on the dark web this week.

Earlier in 2020 — pre-pandemic — Marriott Hotels suffered a massive privacy breach, where the records of 5.6 million guests were exposed after just two employees had their passwords compromised.

These examples highlight two things: how vulnerable corporate systems and databases are when they are protected by passwords, and how attractive companies become to criminals when they store user login credentials in their databases.

It’s likely that Coronavirus-related attacks will continue to highlight how weak passwords are, hopefully driving us to adopt smarter authentication technologies that don’t put us at unnecessary risk.

Biometric authentication has never been more secure

Biometrics is one of those technologies, and its  come a long way in the past decade, where its now at the point where it can securely replace passwords. Unlike passwords, a user’s unique biometrics and characteristics can’t be guessed or cracked.

Advances in machine learning, including deep learning, have substantially boosted the security and reliability of facial recognition systems, which have enabled new research directions in novel authentication modalities, like behavioral biometrics; where users are authenticated by how they interact with smartphones and desktops rather than via their physical characteristics.

These authentication techniques allow us to authenticate users based on how they interact with their devices, rather than via their physical characteristics. They don’t require user attention and can, therefore, be used for continuous authentication. With continuous authentication, the user’s device continuously monitors the user (by processing keystrokes or smartphone movements in the background) and makes frequent authentication decisions based on this data.

New authentication protocols that combine these advancements with emerging privacy-preserving technologies, such as secure multi-party computation and zero-knowledge cryptography, allow for biometric data to be stored securely.

As with all emerging technology, despite its readiness and potential, widespread adoption can be slow; but unprecedented events can also often lead to decisive action.

Lockdowns’ silver lining for cybersecurity

The pandemic and subsequent cyber threats are the most significant disruption to organizational security in modern history. It has presented, however, a silver lining; the unplanned shift to remote environments has helped push us forward into an era of enhanced security and privacy – something that sorely needed. 

Blog