Passwordless authentication

Passwordless authentication is an authentication method in which a user can log in to a computer system without the entering (and remembering) a password or any other knowledge-based secret.
Passwordless authentication relies on a cryptographic key pair – a private and a public key. The public key is provided during registration to the authenticating service (remote server, application or website) while the private key is kept on a user’s device and can only be accessed when a biometric signature, hardware token or other passwordless factor is introduced. In most common implementations users are asked to enter their public identifier (username, mobile phone number, email address or any other registered id) and then complete the authentication process by providing a secure proof of identity in the form of an accepted authentication factor.
These factors classically fall into two categories:
Some designs might also accept a combination of other factors such as geo-location, network address, behavioral patterns and gestures, as long as no memorized passwords are involved.
Passwordless authentication is sometimes confused with Multi-factor Authentication (MFA), since both use a wide variety of authentication factors, but while MFA is used as an added layer of security on top of password-based authentication, passwordless authentication doesn't require a memorized secret and usually uses just one highly secure factor to authenticate identity, making it faster and simpler for users.
"Passwordless MFA" is the term used when both approaches are employed and the authentication flow is both passwordless and uses multiple factors, providing the highest security level when implemented correctly.
History.
The notion that passwords should become obsolete has been circling in computer science since at least 2004. Bill Gates, speaking at the 2004 RSA Conference predicted the demise of passwords saying "they just don't meet the challenge for anything you really want to secure." In 2011 IBM predicted that, within five years, "You will never need a password again." Matt Honan, a journalist at Wired, who was the victim of a hacking incident, in 2012 wrote "The age of the password has come to an end." Heather Adkins, manager of Information Security at Google, in 2013 said that "passwords are done at Google." Eric Grosse, VP of security engineering at Google, states that "passwords and simple bearer tokens, such as cookies, are no longer sufficient to keep users safe." Christopher Mims, writing in the Wall Street Journal said the password "is finally dying" and predicted their replacement by device-based authentication.
Avivah Litan of Gartner said in 2014 "Passwords were dead a few years ago. Now they are more than dead."
The reasons given often include reference to the usability as well as security problems of passwords.
Bonneau et al. systematically compared web passwords to 35 competing authentication schemes in terms of their usability, deployability, and security. (The technical report is an extended version of the peer-reviewed paper by the same name.) Their analysis shows that most schemes do better than passwords on security, some schemes do better and some worse with respect to usability, while "every" scheme does worse than passwords on deployability. The authors conclude with the following observation: “Marginal gains are often not sufficient to reach the activation energy necessary to overcome significant transition costs, which may provide the best explanation of why we are likely to live considerably longer before seeing the funeral procession for passwords arrive at the cemetery.”
Recent technological advancements (e.g. the proliferation of biometric devices and smartphones) and changing business culture (acceptance of biometrics and decentralized workforce for example) is continuously promoting the adoption of passwordless authentication. Leading tech companies (Microsoft, Google) and industry wide initiatives are developing better architectures and practices to bring it to wider use, with many taking a cautious approach, keeping passwords behind the scenes in some use cases. The development of open standards such as FIDO2 and WebAuthn have further generated adoption of passwordless technologies such as Windows Hello. On June 24, 2020, Apple Safari announced that Face ID or Touch ID would be available as a WebAuthn platform authenticator for passwordless login.
Benefits and drawbacks.
Proponents point out several unique benefits over other authentication methods:
While others point out operational and cost-related disadvantages: