The war on password use has been waging on for some time now. Passwords are a relic of the days when computers were stand-alone boxes and hardly ever networked; the damage of a bad login was limited to one account at one location. But a networked computer can do far more damage.

FIDO Takes a Stab

The FIDO Alliance was one of the first organizations to experiment with a viable password alternative. According to the group, the goal is “to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to securely authenticate users of online services.”

Those are lofty aspirations, to be sure. The group first concentrated on specs and standards for hardware such as dongles and fingerprint readers embedded in devices. But the effort has never really gained traction in the authentication field and has so far come up short of developing widely adopted solutions.

Google Tests a Password Variant

Google has begun a test of another authentication system that uses a common hardware device: your smartphone. An individual who was granted early access to the technology recently posted the details on Reddit.

It seems simple enough: To sign on, an email address is entered and the phone number associated with that address receives a notification. One of the three numbers present in the notification is pressed, depending on the instructions from Google. Once this challenge is completed, login proceeds. The mobile device must have a secured lock screen so only the owner can access it.

This approach gets around the rigidity of biometrics. Fingerprints never change; once they are used as a key, invariance is a big problem. If stolen somehow, they can be used by a bad actor who knows that the print will always be valid.

This new method is different than the two-factor authorization Google uses in its Authenticator app. It’s easier to use because no additional typing by the user is needed. That could lead to greater adoption since ease of use is always a bonus when trying to get users to accept new practices.

Yahoo Did It First

The Yahoo Account Key was introduced by Yahoo in 2015 as part of its Mail redesign. It’s basically a push notification sent to a smartphone that allows account login. It links your Yahoo account to a mobile device, likely a smartphone.

It works this way: When logging in to Yahoo Mail on the Web, the email address is entered, then the password field selected. Yahoo recognizes that the feature is enabled and sends a push notification to the phone. Approval or denial of the login can then be performed from the phone.

While Yahoo said at the time of introduction it would implement this approach to its other services, that has yet to happen. But now that Google has jumped on board, Yahoo may seek to catch up.

The Smartphone Is the New Dongle

The latter two approaches use the smartphone as the hardware key to the account. To gain access, one must have an active mobile device on hand.

The true question here is how many users will adopt this approach. If the old, cumbersome method of passwords can be supplanted by these new ways, companies that adopt them will be in a better position to deliver services with less bother to users. If cybercriminals or even petty thieves catch up to this technology, however, it could have dire consequences.