To offer a truly secure authentication experience, we need to ensure your authentication data — biometric templates, passwords or private keys — is stored and verified by our network in a way that doesn't compromise on privacy.

In this post, we explain how Keyless leverages zero-knowledge proof (ZKP) cryptography to ensure that your private authentication data is kept secure at all times.

organizations struggling to protect their private databases against threats

, with the unprecedented amount of personal information being collected and stored in these centralized honeypots, highlights the need for zero-trust solutions to better manage private data.

Zero-knowledge technology allows us to authenticate users, without needing to store private information on centralized databases.

By leveraging zero-knowledge proofs, it’s possible for a user to authenticate with Keyless, without our network ever learning anything about them that could jeopardize their privacy or security.

How do zero-knowledge proofs improve security?

Today, most authentication systems rely on secrets to verify users, whether that be passwords, PINS or biometric templates. To protect user accounts from fraud and criminal activity, these secrets need to remain secret.

One of the greatest challenges with online security today is that, in order to verify our identities when we login, companies and organizations need to store copies of our secrets, whether that be cleartext versions or hashes of them (hashes are one-way encrypted passwords that in theory cannot be reversed, 

however in reality cybercriminals have figured out ways to crack hashes

Unfortunately, the issue with storing secrets is that 

methods used by cybercriminals are evolving

 to keep pace with even the most advanced encryption techniques, firewalls and security perimeters that aim to protect internal systems and databases.

Malicious actors can easily infiltrate systems to steal private information — including names, email addresses and passwords (hashed or not). This means that the information we share with organizations, whether willingly or unbeknowingly, ultimately leaves us exposed to security and privacy risks.

Zero-knowledge proofs have the power to disrupt standard authentication processes by allowing a user to verify their identity without having to reveal their “secret” — whether that be a password, PIN or biometric samples.

With zero-knowledge proof technology, there is always a 

What’s important to understand about zero-knowledge proofs is that 

the prover does not need to reveal anything about what they know, or have,

 in order to prove to the verifier that they know, or possess, something.

Here's an example of how zero-knowledge proofs are used to protect sensitive information

Imagine that you are the prover and that you’re in a maze with your friend, who is the verifier. Imagine that there is a circuit path within this maze with a door in the middle of it, and that this door can only be opened with a secret password.

You want to prove that you have this password to your friend, but you don’t want to share the password with them.

You and your friend decide to play a game to prove to your friend that you do in fact, have the password to open the door in the middle of the circuit.

While you enter the circuit path, your friend will wait just outside the entrance, so they don’t know which way you entered. Once you’ve gone into the circuit, your friend will come to the entrance point and they’ll call your phone.

To verify whether or not you have the password

, your friend will instruct you to appear from either the right-hand path of the circuit or the left.

If you have the secret password, then you’ll be able to appear from the correct side of the circuit every time.

If you don’t have the password, although you may get lucky a few times, the likelihood of you being able to appear from the correct side of the circuit will exponentially reduce as the game goes on. So your friend tests you about fifty times. 

The chance of you being on the correct side without actually knowing the password would be so small — 2ˆ-50. 

If you appear from the correct side of the path each time, then, because the chances of you cheating is so low, the verifier can confidently conclude that you know the secret password.

If you don’t know the password, and you’re not able to appear from the side your friend instructs each time, then he can be quite sure that you didn’t know the password, and assume that you were cheating.

How Keyless uses zero-knowledge proof to secure your biometric data

Rather than storing biometrics templates in cleartext, and using those stored samples to verify users, Keyless

uses a biometric-based zero-knowledge process that allows us to verify a user’s identity without needing to see or learn anything about their biometric template.

What makes the platform zero-knowledge is that 

the Keyless network itself learns nothing about the user’s private information. 

Even if a malicious actor were to infiltrate our network, sensitive information about our users would remain secure and uncompromised, making Keyless compliant with data privacy regulations such as GDPR, even as these changes over time and across jurisdictions.

To make authentication with Keyless even more secure, we leverage the unique combination of your personal hardware devices and unique biometric templates to provide a multi-factor authentication (MFA) solution that is private by design. To cheat the network, someone would need to not only look similar to you, they’d also need to have access to your registered device, which could be either your enrolled phone or laptop.

Enabling secure zero-knowledge authentication with Keyless

At Keyless, we hope to transform the way that private information is managed by leveraging and building upon zero-knowledge principles to build an authentication platform that is private and secure by design.

 is another advanced cryptographic technique that allows the Keyless network to ensure that a user’s biometric data match the template provided at registration, without having access to the biometric templates or the authentication data.

By leveraging the power of both of these advanced cryptographic techniques, Keyless authentication software has the potential to put an end to personal data breaches altogether, since there are no centralized repositories of private data to steal from. The unique combination of these technologies allows us to guarantee that private user information is kept safe and secure at all times.

We believe that the need for privacy-preserving authentication solutions will continue to rise alongside our ever-growing dependence on smart technology. By transforming how personal information is stored and managed, we hope to protect both businesses and consumers from the risks of cybersecurity threats like identity theft and fraud, making the internet a far more secure place.

How Keyless uses zero-knowledge proofs to protect your private data

How Keyless uses zero-knowledge proofs to protect your biometric data

With remote security threats at an all time high, it’s important to get acquainted with the most common types of threats that your workforce is most likely to encounter. 

To help, we’ve put together a list of the top 10 cybersecurity threats that you need to look out for in 2022.

Malware, short for malicious software, is an attack where a person’s computer is taken over with malicious code that can spread between devices using the same network. Malicious code can allow a hacker to wreak havoc on a victim’s device; from downloading important files, like credential lists, to turning the computer into a botnet that infects more devices.

Phishing attacks aim to gather personal information from victims through the use of fake websites and deceptive emails. Since users tend to recycle passwords, one set of compromised credentials could give hackers control over all the victim’s personal accounts, allowing them to commit fraud and identity theft.

Credential stuffing is a type of attack where hackers, who have already accessed a large database of usernames and passwords, launch a series of automated login requests against websites or services until there is a match. Once successful, hackers hijack the accounts for their own purposes, usually to steal private information for fraud, or for launching further attacks.

Man in the middle attacks are where hackers intercept communications between two parties who believe that they are directly communicating with each other. These kinds of attacks allow hackers to listen in on private conversations, video calls and even read confidential emails and documents.

Trojan is a specific type of malware that masquerades as a legitimate piece of software. It could be in the form of a file, or an application. These corrupted files are designed to wreak havoc on the infected device’s systems, allowing hackers to steal private data and corrupt entire networks.

Ransomware is a type of malware that steals private data, and threatens to publish it or block access to it until the victim pays a ransom to the hacker. This is done by encrypting files and holding them hostage, until the hackers’ demands are met.

Hospitals and healthcare services around the world have been struggling to deal with an 

 in the last month, proving just how opportunistic and ruthless the dark web’s extortionists can be.

7. Distributed Denial of Service (DDoS) attack

A distributed denial of service attack (DDoS) is where multiple compromised computer systems flood traffic to a target, such as a server, website, or other network resource, with the intent to disrupt its services.

This can be done by sending “packets” of data to the target’s server, causing it to run slowly, or crash altogether. Usually, these kinds of large-scale attacks are motivated by revenge, activism or blackmail, rather than petty theft.

When users think about securing their smart devices, they don’t usually think about their smartwatch or home assistant. Smart devices fall under the broad term “Internet of Things”.

Often, users fail to either change the default security settings or install updates on these devices, giving hackers a backdoor into the user’s entire network. When connected to the same network, these “smart devices” act as a gateway to a user’s other devices. Once in, hackers can launch malware and phishing attacks that compromise all of the user’s devices.

Spamming attacks are usually deceptive emails, ads or websites designed to trick victims into making purchases. These attacks can compromise the victim’s credit card details, personal details and of course, result in the victim losing cash.

SIM swapping attacks are specifically designed to by-pass two-factor authentication security. If the hacker has obtained the victim’s personal details, like username and password and phone number, they can then register the compromised phone number to a new SIM card, essentially “swapping” their SIM and rerouting all messages and phone calls.

Eliminate cyberthreats by going passwordless

Most of the time, those perpetrating these attacks are looking to compromise one thing only: passwords. These weak authentication credentials are the jackpot prize that hackers are betting on when they launch most attacks.

Therefore, it makes sense that the best way to secure your remote workforce is to eliminate passwords from the authentication equation altogether. Eliminating passwords will greatly reduce the chance of your business’ systems being compromised, while simultaneously allowing you to improve the authentication experience for workers and clients.

Interested in trialing Keyless to enable secure work from home?

If you’re interested in how Keyless™ authentication can help deliver secure and seamless digital experiences, whether for your end-users or for an ever more important and dynamic digital workplace, or if you’d simply like to learn more about our platform, then please feel free to get in touch with our team. You can email us at 

We’re always keen to have a chat about how we can help businesses on their journeys toward a complete zero-trust security model.

The 10 most common cybersecurity threats

Password managers do more harm than good when it comes to securing your organization's most critical systems and data. 

From storing master passwords in plain text, to leaving users susceptible to keylogging and phishing attacks, to users still choosing sharing weak passwords — password managers are ineffective solutions that fail to address the inherent security risks associated with passwords. 

Instead they provide a cover-up solution that only masks the real problem: passwords are a weak and ineffective method for authenticating users in the digital world, and reliance on them to authenticate users puts everyone at risk.

Memorized secrets shared between user and platform, better known as passwords, are the biggest design flaw of the internet. Hackers have been figuring out ways to crack passwords since the sixties.

Today, cyber threats are growing increasingly sophisticated, yet the way we authenticate has not evolved. Instead of rethinking how to authenticate and identify users, cybersecurity has centered around bolstering the password so that it is less susceptible to security threats. Unfortunately, none of these solutions addresses the fundamental problem: so long as there is a “password”, there is something for hackers to guess or steal.

“Password fatigue” describes the overwhelming burden users experience when it comes to managing their accounts. With the average user having an estimated ninety separate accounts — mandatory password changes, and complex password requirements backfire — forcing users to choose weak passwords that they can easily remember.

Password managers aim to solve the issues caused by password fatigue. They take memorizing passwords out of the hands of users, so that they can choose more complex passwords that meet password guidelines and policies.

How come password managers do more harm than good?

While password managers may solve issues with password fatigue, by allowing users to choose more complicated passwords, 

 against an onslaught of password-related attacks — like password phishing, keylogging attacks and Man-In-the-Middle attacks.

Password managers actually collate all of a user’s private credentials and store them in a single, centralized place. Just like other centralized platforms, password managers are vulnerable to being hacked. If a malicious actor manages to successfully break into the password manager, then all the stored credentials will be breached.

Password managers have known security flaws. What are they?

If a hacker gets access to the password management system, they gain unlimited access to the credentials stored within it. Independent research of some of the most popular password managers highlights clear security vulnerabilities.

master password was stored in plaintext on the user’s device

; for a savvy hacker, backdoors like this become easy hits. In fact, hackers are actually more inclined to attack password managers: For users, a breach would be a huge inconvenience that could lead to fraud and identity theft and loss of access to accounts. For an organization, this could be catastrophic.

Password managers are also vulnerable to attacks launched by “rogue” apps — fake apps designed to look like the real deal. Researches at the University of York fooled 

40% of password managers into giving away passwords

1. Password managers provide a false sense of security

Unfortunately, employees still choose their passwords, and ultimately decide how they manage them. For example, an employee could put corporate systems at risk by sharing their password around, or choosing a common password. Password managers can also be added by employees without the organization’s consent.

2. Password managers fail to solve resource and budget issues associated with passwords 

Password managers also fail to eliminate costs associated with maintaining passwords. These costs can be a heavy burden on businesses. The average cost of password reset is US $70, and in the midst of the pandemic, these costs have put massive financial strain on businesses. According to Security Brief, online retailers 

It’s not just password managers that pose a risk to security — all security solutions aimed at bolstering passwords adds further complexity to the issue, disrupting the user-journey and creating new entry points for attacks.

In order to properly safeguard systems and private data, we need to completely overhaul the way we authenticate.

At Keyless, we use a combination of advanced cryptographic techniques to eliminate fraud, phishing and credential reuse — all while enhancing customer and employee experiences and protecting their privacy. Our biometric authentication solution offers multi-factor security across devices and platforms with just a look.

Interested in trialing Keyless to secure your remote workforce?

We’re always keen to have a chat about how we can help businesses on their journeys towards a complete zero-trust security model.

Password managers are just a band-aid solution to a deeply-rooted problem with authentication

How to protect your company, employees and customers against fraud and phishing.

phishing attacks around the world rose by over 600%

.  The sudden shift, along with a lack of adequate cybersecurity training, the unprecedented use of personal devices for work, and sheer volume of personal data being shared on the web created new opportunities for bad actors and scammers.

Today, it's relatively easy to gather information about someone – for example from their LinkedIn profile – allowing bad actors to launch increasingly elaborate attacks. Exploiting our anxieties and fear, bad actors trick their victims into handing over sensitive account data (like their usernames and passwords), or downloading malicious software onto their devices.

So what's the best defence against phishing, account takeover fraud? 

Cutting out the lowest hanging fruit: passwords .

Phishing is a type of attack that aims to compromise a user’s sensitive information. Usually, hackers masquerade as a legitimate business, entity or person, tricking the victim into opening an email, link or downloading an attachment.

Most often, phishing attempts seek to compromise sensitive information like login credentials or credit card details.

Sometimes the goal of a phishing attack is to install malicious software onto the victim’s device. Once installed, the hacker is able to control the user’s device, allowing them to launch further attacks that infect more devices. Malware has the potential to compromise the private data in an entire network.

Phishing falls under the broader umbrella of “social engineering” — a term that describes the use of deceptive means to trick victims into divulging sensitive information that can be used for fraud and other illegal purposes.

Most phishing attempts are made via email, however with the adoption of smart devices, attacks launched via text, social media and digital advertising are rising.

The most common kinds of phishing attacks

A vast majority of phishing attacks are launched via email. These emails are designed to masquerade as a legitimate entity. To do this, hackers register an email address that looks legitimate and then use that address to launch thousands of phishing emails to a database of users.

These are usually stolen or obtained through the dark web, however with so much personal information being made online, it wouldn’t be too hard for smart criminals to create their own databases.

In 2020, there was an explosion of attacks impersonating government and healthcare officials – preying on people’s anxieties and fears about the virus and its economic consequences.

Spear phishing is a more sophisticated form of phishing where the hacker targets a specific person. To launch these attacks, hackers have usually obtained some of the victim’s personal information, like their name, job description and employer, email address and so on.

Today, this information is freely available to the public through social media channels like LinkedIn, so obtaining it is easy, posing a real risk to individuals, businesses and public entities.

In these attacks, hackers usually send emails or direct messages to victims impersonating their colleagues or superiors. Because the victim trusts the person who’s had their identity hijacked, they are more likely to click on malicious links/download malicious attachments.

With remote work now a reality, spear phishing attacks targeted specifically at employees pose significant risks to corporate security.

Whaling attacks are similar to spear phishing attacks, except that they are target high-ranking members of an organization or corporation.

Hackers masquerade as senior executives, or other individuals in powerful positions, like politicians or well-known journalists, to try and trick the victim into divulging sensitive information.

Whaling attacks can be highly sophisticated and drawn out, with hackers devoting weeks or months of their time establishing trust with the victim, before finally launching their attack.

Smishing and vishing attacks are where hackers either text or call the victim. They either send malicious links via text message, or they call the victim impersonating an official from a bank or government agency. The primary purpose of these attacks is the same, to get the victim to disclose sensitive information — usually usernames and passwords or credit card details — to the hacker.

In times of heightened public anxiety, these kinds of attacks can be extremely effective. For example, hackers are taking advantage of the COVID-19 pandemic to send

These work as governments will from time to time send mass health or weather alerts via text. If the victim clicks on the link, it could either take them to a false website, or it could install malicious software onto their devices, allowing the hackers to launch further attacks.

Angler phishing is virtually the same as all other phishing attacks, except the hacker takes a different route of attack — through social media and private messaging apps.

With the amount of personal information users share online, coupled with the lower barriers to entry for making a fake persona, hackers are able to easily clone social media profiles to create believable spoof accounts, or entirely new aliases.

They can then use these accounts to send malicious links to victims, or they can impersonate trusted friends and family members, getting the victim to divulge sensitive information, like passwords or credit card details.

How can you protect your business from phishing attacks?

Most advice for stopping phishing scams online reads the same, don’t open suspicious emails or attachments. While this is all great advice, one of the best ways to protect your corporate network and company data from being compromised is to change the way that you authenticate your employees, users and partners.

The link between phishing and stolen credentials

Passwords are the gateway to our personal life on the web, yet if the internet had one distinguishable flaw, it would be passwords. The web as we know it is fraught with security threats that are all designed to steal login credentials. Yet, despite the overwhelming risks, poor password hygiene is rampant. It’s not the user’s fault; maintaining proper control over passwords has become impossible thanks to users having hundreds of accounts that all have their own varying requirements. This coupled with mandatory password updates has caused password fatigue — prompting users to recycle their passwords, using the same password across platforms or slightly different variations of it.

Hackers exploit this; they know that it only takes a single compromised password to unlock access to a user’s entire digital life. Once they have this “key” to the user's online world, hackers can launch all kinds of attacks. This poses serious threats to businesses as their employees transition to remote work.

Put a stop to phishing for good by adopting passwordless 

Switching to passwordless authentication eliminates the security risks associated with weak login credentials like usernames and passwords, as well as solving the security risks with one-time passwords like SMS-2FA.

Phishing is much less of a threat if there are no passwords to steal from your employees or users. When they are removed from the equation, passwords can’t be stolen and used to launch other attacks.

If your corporate systems do become compromised by malware, switching to

also greatly reduces the chances of sensitive user data being stolen in a breach. If a large-scale breach was successful, hackers would find that there are no login credentials to steal, making your business less of a target.

Everything you need to know to protect your business from phishing attacks

The pandemic has forced offices all around the world to adjust to remote working. Unfortunately, remote environments introduce unique security challenges that need to be dealt with.

To help protect companies during this period of unease and uncertainty, we’ve listed our top tips for implementing remote-work security:

1. Utilize secure collaboration tools and set clear communication guidelines

Some employees may never have worked from home before, meaning that they don’t have the prior experience to gauge what a “normal” method for communication is from their colleagues now that they are out of the office.

Hackers will no doubt be looking to take advantage of this — and may seek to impersonate members within your organization. Implementing official communication guidelines and using more secure collaboration tools like Slack will help ensure your employees are not tricked into disclosing sensitive information to criminals.

2. Teach your employees to spot phishing and malware attacks

Phishing is one of the top cybersecurity threats to businesses, responsible for roughly 

 of all breaches. With criminals looking to exploit public anxiety, coronavirus-related phishing attacks are on the rise, with 

 being created daily that aim to compromise the login credentials of remote-workers.

Malware attacks usually come in the form of infected files. If these are downloaded, they can allow a malicious party to control the users device, and can even infect other devices using the same network.

Training employees to detect potential phishing and malware scams is essential to implementing remote-work security. Implementing passwordless authentication is another tactic for securing your corporate systems from malicious takeover.

3. Train employees in cybersecurity hygiene

There are basic measures every remote worker can take to protect themselves and their devices from targeted cybersecurity threats. Some of the most crucial yet simple things you can teach your employees are: the 

 and smart devices by changing the default passwords, and why regular 

4. Secure your business VPN by turning on multi-factor authentication (MFA)

If your employees aren’t already using a VPN to access your company’s private systems, then they should be.

, is just that, a private network. VPNs reroute all web activity so that it passes through a private network. These are generally protected with robust security systems. Generally speaking, VPNs are far more secure than any network your employee may be using while they work from home.

5. Implement mandatory multi-factor authentication (MFA)

If you haven’t already, you should make multi-factor authentication (MFA) mandatory for all of your businesses systems. While it may be frustrating for employees to continuously authenticate throughout their working day, MFA is a critical defence against hacks and unauthorized access to your company’s systems.

Keyless offers seamless, biometric authentication. You can read more about it 

6. Implement a passwordless authentication solution, like Keyless

Keyless offers military-grade biometric authentication solutions for the enterprise. Our solution eliminates passwords, allowing employees to access business systems and applications by using their unique biometrics.

Eliminating passwords helps minimize the consequences of phishing attacks, as criminals no longer have passwords to steal.

Our platform is designed to be ubiquitous — meaning it can be integrated with all operating systems, and can be installed on any smart-device with a built in front-facing camera.

7. Review who has privileged access to your IT systems

Unfortunately, most cyber attacks launched against businesses are perpetrated by employees. That’s why it’s an important time to review who has privileged access to your corporate information systems, and limit all unnecessary privileges where possible.

A privileged user is someone with a relatively high level of access to a company’s corporate information systems. Usually employees with privileged access system administrators, database administrators, developers, architects, application owners, and IT managers.

8. Teach employees how to backup data to avoid lost work

Unfortunately, when employees work from home there is a risk of important work being lost, whether due to system crashes or misplaced devices. Consider investing in automated cloud-based backup and recovery systems for the time being. This will help ensure that important work and systems changes aren’t lost.

9. Teach your employees how to encrypt their data

With employees now working from their personal devices, it’s likely that there will be some point in time that your private files will end up on their personal computers or mobile devices. This poses a big security risk if the computer is somehow taken over by a malicious party.

That’s why it’s important to teach your employees how to encrypt their “at-rest” data.

Most modern devices actually have in-built encryption functionality. For Mac’s 

10. Implement a “lost/stolen devices” policy

If an employee loses their personal device, they may not think to tell you. The failure to report a lost/stolen device can put your company at significant security risks, and is considered failure to report a data breach in some jurisdictions.

It’s important to remember that data-privacy laws are still in effect. In most jurisdictions, you only have 72 hours to report a data-breach before you risk being fined. having to pay hefty fines. To help protect your business against the significant financial and reputational costs of a data breach, it’s important to implement processes so that your employees report any potential breaches as soon as possible.

11. Have processes for reporting suspicious activity

Perhaps your employee got a suspicious email, or a strange phone call. Perhaps they opened a link. Whatever it is, you should not only train your employees to spot potential threats, you should implement processes for reporting them.

It’s likely that hackers will target multiple employees in an organization. Having such processes in place will help your security teams investigate and intercept attacks sooner.

While a rushed transition to remote-working environments may have caught many businesses off-guard, there are simple steps that your business can take to safeguard your corporate systems while working from home.

How to protect your company from cybersecurity threats during the COVID-19 pandemic

Authentication is a process used to verify that someone is who they claim to be. Each of us completes the process of authentication multiple times a day. 

In fact, authenticating ourselves has become so ingrained in our everyday lives, that most of us don’t give a second thought to what we’re actually doing in the process.Unlocking our devices, entering our PIN numbers, swiping into our office buildings, scanning our passports at airports — these are all acts of authentication. We’re proving who we are, or that we have ownership over something, to a platform or service.

In this piece, we’re going to delve into the evolution of online authentication methods and the inherent security problems with how our private credentials are managed by companies today. We’ll then focus on how our team is leveraging the latest advancements in cryptography and biometrics to work towards building a privacy-focused future.

The evolution of online authentication methods

Technology has evolved at an incredible speed since the launch of the World Wide Web in 1991. So much so that today, our entire lives entirely revolve around mobile devices and the platforms on them. Today most of us work, socialise, make payments, shop for groceries, and even bank online.

Yet, the way we authenticate online and manage private information has failed to evolve at the same pace. Despite being introduced over half a century ago, usernames and passwords are still the most popular authentication method used today.

Usernames and passwords have been the most common form of online authentication for decades. Users choose a “secret”, an easy to remember password that nobody else knows.

The password is shared with the platform or service, and then stored on their internal systems so that it can be cross-referenced when someone attempts to login.

While still the most popular means of authentication on the internet, guessing passwords has proven to be relatively easy. To protect users against this, most platforms have imposed their own set of password requirements, some more lax than others, and most require user’s to change their passwords periodically.

This strategy has arguably made it harder for users to keep their passwords secure. In reality, being forced to remember dozens of different password combinations forces users to either overuse the same password, or keep copies of them stored in insecure places.

Hashing is a one-way encryption function that’s used by platforms to securely store passwords. With hashing, raw or unaltered passwords are transformed into an unrecognizable alphanumeric “hash”.

The one-way function makes it more difficult for an attacker to uncover a user’s password.

To authenticate a user, passwords entered during login are converted to a hash, and then the system compares that with the stored hashed copy saved on file. If there is a match, then the user is granted access.

Unfortunately, hashing alone is generally not strong enough to completely dissuade malicious actors, as cybercriminals can still steal hashed passwords from databases.

These can be easily broken by a dictionary attack, or by brute force attacks where the malicious party plays trial and error until they discover the original password or secret.

1980s: Two-factor authentication — Hardware tokens

Two-factor authentication (2FA) is essentially the idea of presenting the user an authentication challenge that is 

 to the first. This creates another security perimeter that hackers need to bypass, making it much more difficult to break into a user’s accounts.

Hardware tokens are registered to a user’s accounts, and produce one-time passwords (OTP) were introduced as a method to do this. Essentially, the user’s possession of the hardware token is another challenge.

If the user knows their username and password, and has possession of the hardware token, then the service can be sure that the user is who they say they are.

Hardware security tokens like YubiKey, are modern examples of 2FA solutions that still use this technology today.

Unfortunately, hardware token solutions are costly, disruptive to the user experience, as they can often be misplaced or lost entirely.

Widely used today amongst those that own digital assets, public key cryptography relies on pairs of “keys” to authenticate users: one private, and one public. Keys are random alphanumeric numbers that are so long and random that they’re considered impossible to guess (or remember).

Instead of needing to store a user’s private information to be able to authenticate them, the only data that systems must store is the 

 along with a username. To authenticate, a server sends a message to the user’s device, and the user creates a digital signature with their private key.

Blog