Authentication plays a crucial role that is central to almost every Customer Identity and Access Management (CIAM) use case and the traditional method for validating a user has typically involved the use of a password. At least in a first-factor context.
However, the password-based method for user authentication — typically used as part of sign-up or sign-in — is progressively being replaced by more convenient passwordless approaches. I’m Peter Fernandez, and in this article, I’m going to be talking about Magic Link and One-Time Passwords (OTPs) as some of the most popular passwordless alternatives to password-oriented user authentication.
An Introduction to Passwordless
Traditional authentication methods typically rely on the use of a password credential. Passwords, however, pose several challenges:
- Password fatigue means they are often reused across multiple services,
- Vulnerable to brute force, phishing, and other types of attack.
- Create friction in the user experience given that people struggle to remember the type of complex password less susceptible to attack.
- Forgotten passwords are a source of friction for users, where forgotten passwords need to be securely reset either manually via a helpdesk or via some user self-service process.
- Password processing is an intensive operation. The computing and memory resources required to calculate and compare the password hashes — recommended for secure password storage — are not insignificant and can lead to increased costs when it comes to cloud-based implementations for user authentication.
To address these challenges, passwordless authentication has emerged to offer a more secure and user-friendly alternative. Passwordless eliminates the need for passwords entirely, and modern passwordless implementations include the likes of WebAuthn and Passkeys
Social and (Enterprise) Federation also provide a solution to the challenges of using passwords, however these push the password problem to an upstream identity provider rather than doing away with passwords altogether.
Magic Link and OTP Workflows
In addition, the classic solutions of Magic Link and OTP can also be used in a wide range of CIAM use-case scenarios. Both of these methods focus on simplifying the authentication process, and doing so in a security-conscious manner:
- Magic Link: A Magic Link is a unique URL sent to a user’s email or phone, which, when clicked, automatically authenticates them without requiring a password.
- One-Time Passwords (OTP): OTPs are temporary, one-time-use passcodes sent to users via email, SMS, or authentication apps. The user enters this code during the authentication process (as part of credential validation) to gain access.
Both methods eliminate the need for users to create, store, and remember passwords, which can reduce friction and help lower abandonment rates. This ease of use is especially crucial for B2C platforms, that deal with large numbers of customers, many of whom may prefer a simpler authentication process.
Magic Link and OTP workflows are also highly scalable. Since they don’t require extensive infrastructure for password management, businesses can easily handle large user bases without compromising security. Additionally, these methods can be adapted to different devices and channels, making them versatile and flexible for a wide range of use cases.
From a security perspective, the typically short lifespans associated with Magic Links and OTPs help reduce the window of opportunity for attackers seeking to intercept or reuse a user’s credentials.
Magic Link and OTP Use Cases
Having discussed some of the benefits of these passwordless authentication methods, let’s explore some key scenarios where Magic Link and OTP workflows can significantly improve CIAM integrations.
Onboarding New Users
Ensuring that new users can quickly and easily authenticate to access services is a key part of the user experience. Magic Links and OTPs can be excellent choices for streamlining the onboarding process, reducing friction, and improving conversion rates.
For example, in a typical scenario, users are often asked to provide their email or phone number during registration. After submitting the information, sending a Magic Link to their email or mobile device allows a user to be taken directly to the SaaS platform, bypassing the need to create a password. The benefits of this include:
- Frictionless Experience: Users don’t need to remember or create passwords which is often a major barrier during registration.
- Reduced Drop-off: The registration process becomes faster and simpler, leading to fewer abandoned sign-ups.
- Increased Security: Magic Links are typically time-limited and can only be used once, adding a layer of security during the registration process.
- Email address and/or phone number verification can be performed as part of the registration process. For example, phone number/device verification is particularly valuable in cases where Passkeys are also being employed.
Additionally, Magic Link processing offers a great solution for the user invite workflows typically encountered in B2B SaaS scenarios.
Account Recovery
One of the major challenges in user authentication is ensuring that users can recover their access if they forget their credentials or lose their devices. Using Magic Links and OTPs can offer a highly effective solution to facilitating account recovery.
Recovery workflows should only ever use verified email addresses and/or phone numbers — a process that can be performed as part of user registration (discussed above).
If a user forgets their password, for instance — or, perhaps, loses the device on which their Passkey is registered — instead of going through a tedious reset process, they can receive a Magic Link to their registered and verified email. Clicking the Magic Link will allow them to instantly authenticate and perform the necessary reset processing, ultimately resulting in a
- Simplified Process: Magic links streamline the recovery process, offering a smooth and easy path for users to regain access to their accounts.
- Reduced Support Burden: By eliminating the need for lengthy reset procedures, organizations can reduce the volume of support tickets related to access issues.
OTPs for Two-Factor Authentication (2FA)
For higher security, users can be prompted to authenticate/re-authenticate using an OTP when performing sensitive operations (e.g., transferring funds, or changing account settings). After entering their credentials, the system will send an OTP to their registered email or phone. The user must then input the OTP to confirm their identity, providing:
- Enhanced Security: 2FA significantly enhances security by adding an additional layer of protection beyond just a password.
- User Flexibility: OTPs can be delivered via multiple channels, ensuring that users have access to them no matter their location or device.
Continuous Authentication for High-Risk Transactions
Continuous authentication, which evaluates user behaviour over time, can help mitigate fraud and unauthorized access, especially during high-risk transactions. Again, the use of OTPs and/or Magic Links is extremely beneficial to this type of dynamic authentication process.
For example, during high-risk operations such as transferring money, updating account information, or authorizing payments, the system can trigger an OTP workflow. The user receives an OTP via SMS or email and must input it to verify their identity:
- Time-Sensitive Authentication: OTPs help ensure that the user attempting the transaction is legitimate and currently authenticated.
- Fraud Prevention: By requiring an OTP for every high-risk transaction, organizations can minimize the potential for fraudulent activity.
Additionally, if a user accesses sensitive parts of a platform after a period of inactivity, they can be prompted to re-authenticate through a Magic Link sent to their email. This ensures that the user is still authorized to perform the desired actions. The benefits of this include:
- Seamless Security: Magic links offer a smooth re-authentication process without requiring users to enter passwords.
- Enhanced User Experience: Users don’t have to go through cumbersome re-authentication steps but can still be confident that their session is secure.
Initiating Out-Of-Band (OOB) Workflows
There are situations — such as when utilizing native device authentication via Apple ID or Google ID — where interactive user authentication is never/seldom performed (within the context of a SaaS application). In such situations, it can be difficult to initiate workflows involving progressive profiling and the like.
Situations where progressive profiling is performed often include such things as updates to terms and conditions and where re-verification of contact information is required.
Magic Link processing can offer a way of addressing this challenge, by signalling to the user — either via email or SMS — that their attention is required, and providing a link that both initiates the process and validates the user at the same time.
Challenges and Considerations
While the use of Magic Links and OTPs can be highly beneficial, they do come with some challenges:
- Email and SMS Delivery Issues: Both methods rely on email or SMS channels for credential delivery, where delays or failures (in delivery) can cause frustration for users.
- Security Concerns: OTPs and Magic Links are vulnerable to man-in-the-middle attacks or SIM-swapping if the proper security controls are not implemented.
- User Experience: Over-reliance on email or phone numbers for delivery could create issues, especially for users who don’t have easy access to these communication channels.
- Email address and/or phone number verification should always be performed for any situation using these as part of Magic Link or OTP processing.
Businesses must consider the challenges and implement safeguards to mitigate risks like delivery failures and security vulnerabilities, however, ultimately, adopting these passwordless workflows can greatly enhance both user satisfaction and overall security within a CIAM solution.
Leave a Reply