How many times you reset your password, forgetting it? Step towards Passkeys and Passwordless authentication. RBI Guidelines for Banks in India.

According to a study conducted by SplashData, the average person has to remember login credentials for at least 90 different online services. Since the day, the password mechanisms have been identified for authentication, it has been the primary method for authentication for all online accounts and devices. This goes back in time to 1960’s when MIT (Massachusetts Institute of Technology) developed a password-based authentication system. But it was widely adopted as secure mechanism in late 1990’s when the internet began to expand.

The reason why people often forget the passwords is because of the complexity, reuse, lack of relevance, distraction, lack of use and human error.

To overcome these difficulties, people started reusing same passwords for multiple accounts or change first/last few characters to understand the password. For Example: T@lkt0meN is for Netflix, T@lkt0meG is for Google, T@lkt0meT for Twitter or similar. While this can make it easier to remember, it also increases the risk of a security breach if one of the accounts is compromised.

Top 200 Common Passwords list - Nordpass

Nowadays people have lot of things to remember which creates a distraction and human error. Sometimes, people remember the password correctly but instead of Upper case, they could have typed a lower case for a character which resulted in a password mismatch.

Technology organisation have realised this difficulties and to help with this issue, they have started adopting passwordless authentication methods such as biometric, smart card or token-based, or one-time passcodes. Additionally, there are many password manager’s available to store and generate complex passwords that help remember passwords at ease. While recently we have witnessed breaches on few password manager’s as well.

FIDO (Fast Identity Online) Alliance started with the mission to provide simpler and stronger authentication methods to reduce the world's dependence on passwords. These can be technically complex to implement and maintain, and it may require additional resources and expertise. This also requires additional hardware which increases the cost for the company to implement as a replacement for password.

In the year 2019, WebAuthn was developed as a API standard that can be used as passwordless authentication on the web. This is based on FIDO alliance’s specifications and it enables the use of various authenticators such as USB security keys, near-field communication (NFC) devices, and biometric devices (fingerprint and facial recognition) for authentication.

With WebAuthn, financial institutions can authenticate users without the need for passwords, making it more difficult for attackers to steal login credentials through phishing or other methods. The adoption rate for this slow compared to other standards, but there are few banks like Bank Of America, Wells Fargo and Capital One have already adopted these technologies.

In India, many financial institutions are evaluating or implementing this standard. Reserve Bank of India (RBI) has also been pushing for the implementation of two-factor authentication and biometric-based authentication in India's banking sector. This aligns with the use of WebAuthn, which is considered as a more secure way of authentication and it's a good indication that financial institutions in India are also looking into adopting this standard.

The Reserve Bank of India (RBI) has issued guidelines for two-factor authentication and biometric-based authentication for the banking sector in India. These guidelines recommend the use of additional forms of authentication, such as biometrics, One-time passwords (OTP), or tokens in addition to traditional passwords, to strengthen the security of online transactions and protect customers' sensitive information.

The RBI has also been promoting the use of Aadhaar-based authentication, which is a form of biometric authentication, for banking transactions. The use of biometric authentication, such as fingerprints and facial recognition, aligns with the use of WebAuthn, which is considered a more secure way of authentication.

The RBI has also been pushing for the use of digital signatures and electronic signature, which is another way of strengthening the security of online transactions and aligns with the use of WebAuthn, which uses public key cryptography as the foundation for authentication.

In conclusion, forgetting passwords is a common problem for many people. However, by understanding the reasons why people forget their passwords and implementing passwordless authentication methods, we can make the process of authentication more convenient and secure for users.