Passwordless authentication (パスワードレス認証) confirms identity without asking for a password, using biometric data or a device you hold instead.
Password authentication
Passwordless authentication
What the user presents
A memorised string
A fingerprint or face, or a registered smartphone or security key
What the user must remember
A password for each service
Nothing
Main weakness
Guessing, shoulder surfing, reuse, leaks
Re-registering after losing the device
Passwords can be guessed, spied on over someone's shoulder, or reused across other services. Passwordless authentication checks a body feature such as a fingerprint or face, or something you hold such as a registered smartphone or security key, so there is nothing to memorise and those password weaknesses disappear. Under the FIDO standard, for example, the fingerprint (or other biometric) match happens inside the user's own device, and the data used for matching never travels over the network.
AnalogyIt is like replacing a combination lock, where you must remember and key in a number, with a door that opens when you tap your registered staff badge or simply show your face.
How to rememberThe "-less" means "without", as in paperless or cashless; the Japanese name パスワードレス認証 borrows the same English suffix, so it reads as authentication without a password.
Exam points
Mix-upPasswordless authentication (パスワードレス認証) is the name for every method that does without a password. FIDO is one standard for achieving it, not the name of the whole approach.
SMS authentication (SMS認証) sends a one-time verification code by SMS (text message) to a registered mobile number and confirms identity when the user types that code in.
Enter ID and password
Code sent to the registered number
Enter the received code
Access granted if it matches
If the code entered matches the one sent, the user is accepted as genuine and let in.
4 / 4
Only someone holding the device for that phone number can receive the code, so having the device becomes the proof of identity. Combined with a password, which is a knowledge factor, it gives multi-factor authentication (多要素認証), stacking factors of different kinds.
AnalogyIt resembles a parcel locker whose pickup code goes only to the recipient's smartphone: only the person holding that phone can read the number.
How to rememberSMS stands for Short Message Service: short texts addressed by phone number alone, so holding the receiving device is the evidence.
Exam points
ExamWhen authentication factors are split into knowledge, possession and biometrics, SMS authentication (SMS認証) falls under possession (所持): something you have.
Single sign-on (シングルサインオン, SSO) lets a user authenticate once at the start and then reach multiple services they are permitted to use without signing in again.
← Scroll the figure sideways →
Users no longer type an ID and password for each service, and they have fewer passwords to remember. The flip side is that if the first authentication is broken, an intruder gets into every linked service, so the entry point should be hardened with multi-factor authentication or similar.
AnalogyIt is like an amusement park where your day pass is checked once at the gate, and you then ride every attraction inside without buying another ticket.
How to rememberSign-on is just another word for logging in, so the name reads literally: a single sign-on (login) is all it takes.
Exam points
ExamEach linked service that the user is permitted to use accepts the result of the first authentication, which already confirmed the user's identity, and grants access on that basis. The user therefore does not have to sign in again, which makes things more convenient.
Mix-upA password that works only once is a one-time password (ワンタイムパスワード), and authentication by body features such as fingerprints is biometric authentication (バイオメトリクス認証). Neither one is single sign-on (シングルサインオン).
EMV 3-D Secure (EMV 3-Dセキュア) is an international identity check for online credit card payments in which the card issuer confirms that the person using the card really is the cardholder.
Card details entered on the shop site
Shop asks the card issuer to verify
Issuer decides if it is the cardholder
Payment proceeds on the result
Only transactions confirmed as genuine go on to payment.
4 / 4
A stolen card number and expiry date can be typed in by anyone, so on their own they cannot stop someone posing as the cardholder. The issuer therefore checks, at the moment of payment, whether it is really the cardholder, at the request of the merchant accepting the card. In Japan, online merchants are now required to adopt this scheme.
AnalogyIt is like a shop that, instead of checking a customer's identity itself, phones the bank that issued the customer's card to ask whether it is really them before handing over the goods.
How to rememberEMV comes from the initials of Europay, Mastercard and Visa, and lives on in the name of EMVCo, the body that manages the standard. The 3-D stands for three domains: the merchant side, the issuer side, and the part that connects them.
Exam points
Mix-upEMV 3-D Secure (EMV 3-Dセキュア) checks identity at the moment of payment. That is a different job from protecting the connection that carries the card details in encrypted form.
3-D Secure 2.0 (3Dセキュア2.0) is EMV 3-D Secure called by its version number; it assesses risk from device and transaction data and asks for an extra check only on transactions it rates as high risk.
Assess risk from device and transaction data
Low risk: payment with no extra check
High risk: extra check by one-time password or biometrics
The earlier version (1.0) made shoppers type a fixed, pre-registered password on every payment, which was a chore and led some to abandon their purchase. In 2.0, the card issuer assesses risk from the device in use and the purchase details and history, and lets ordinary-looking transactions through without asking the shopper for anything. Scaling the strength of the check to the size of the risk in this way is called risk-based authentication (リスクベース認証).
AnalogyIt is like changing a checkpoint that stops every car into one that pulls over only the cars that look out of the ordinary.
Exam points
Mix-up3-D Secure 2.0 (3Dセキュア2.0) and EMV 3-D Secure (EMV 3-Dセキュア) are not two separate methods. From 2.0 on, the specification is set by the standards body EMVCo, which is why the scheme carries its name as EMV 3-D Secure.
Key points
Passwordless authentication uses biometrics or a device in hand, removing the need to memorise and type a password at all.
SMS authentication is a possession factor that relies on holding the device for a phone number, and paired with a password it becomes multi-factor authentication.
Single sign-on makes several services usable after one authentication, but if that entry point is broken, the damage spreads to every linked service.
EMV 3-D Secure (3-D Secure 2.0) has the card issuer confirm the cardholder in online card payments and asks for an extra check only on high-risk transactions.