Get All Access for $5/mo

Passwords Are Scarily Insecure. Here Are a Few Safer Alternatives. Here's what comes next to authenticate users and protect networks.

By Raz Rafaeli Edited by Dan Bova

Opinions expressed by Entrepreneur contributors are their own.

DragonImages | Getty Images

The password, the most common way to authenticate users around the globe, has been in slow decline for over a decade. Bill Gates famously asserted at an RSA conference in 2004, "There is no doubt that over time, people are going to rely less and less on passwords ... they just don't meet the challenge for anything you really want to secure."

To maintain acceptable security standards that protect company assets and employees, businesses need to start seriously considering how to implement alternatives to their password-based systems.

The main problem with passwords is twofold: For starters, passwords just aren't that secure. Every company in the world uses them to authenticate users to confirm they are who they say they are, but a recent Verizon study showed that a majority of hacks leverage weak or guessable passwords. Additionally, passwords are susceptible to being stolen or extracted by hackers using various methods, like impersonating someone you know or trust to gain login information or personal details.

Careless practices such as exposing hard or digital copies of passwords are also a major contributor to their becoming compromised. Think about that the next time you write down your work account password on a piece of paper and stick it in a desk drawer at the office.

There are numerous examples that demonstrate the vulnerabilities of passwords to theft. In 2017, online image sharing community Imgur made headlines when it had troves of user passwords stolen from the company database because of weak security protocols. The hack left 1.7 million accounts compromised.

In 2018, flaws were exposed that had been embedded on Intel processors for years, allowing hackers to gain device memory access and authentication credentials. Even more recently, US researchers identified the re-circulating of the Zyklon virus, a malware program that exploits vulnerabilities in Microsoft applications to steal passwords and other personal details. The list goes on.

A second aspect to the problem is that passwords require users to remember numerous letter/number/character combinations for most accounts, which if we're honest, is totally unrealistic. Limiting the variety of passwords by, say, simply repeating the same password for multiple accounts only increases security risk.

While passwords are still used across almost all industries and companies, a slew of alternative tools have begun to make their way into our daily routine and will, one day in the not so distant future, replace passwords altogether.

Here are some of the pros and cons of the most popular password alternatives that may be right for your company, since all passwords are going the way of the dodo.

Security tokens

Tokens, both soft and hard, provide a reasonable level of security in that they require any user to possess a specific item at the time of login. Tokens are not connected to a network, but rather generate one-time passwords based on a "seed record' synchronized with a central server. Many current token technologies don't even require a user to manually type a password but rather transmit them to a PC or laptop via a device's near field communications.

Related: The Dos and Don'ts of Cyber Security Measures to Help You Protect Your Business and Assets

One company making headway in this industry is the New York-based Tokenize. The product allows a full range of operations and devices to be synced to a small wearable ring-token, from credit card purchases to unlocking computers.

However, tokens present a serious logistical challenge to businesses for a number of reasons. First off, a token-based system is expensive to deploy, since every user is required to have their own device. Additionally, the method requires users to have their tokens with them any time they want to log on while also needing to safeguard them from loss and theft.


Biometrics are identifiers like fingerprint and facial scans. This method has become increasingly popular among users, with applications like Apple's Touch ID and Face ID now extremely common. What gives biometrics a leg up from a security perspective is that the technology is based on something that the user "is." A fingerprint, for instance, can't be lost or hacked the same way that other authenticators can be. Biometrics also tend to offer a better user experience as well, since many metrics are quick and easy to authenticate.

Many tech leaders have begun to offer scalable biometric solutions to authentication. Microsoft Hello for PCs now features fingerprint and face recognition options, and increasingly, more devices compatible with the application will be made available by the company in the future.

Biometrics has its drawbacks, though. Many common biometric systems still suffer from accuracy issues and may be prohibitively expensive. Biometrics are also vulnerable to hackers. Findings by Japanese researchers last year showed that biometric markers can be forged by simply using high resolution photographs.

More important, the infrastructure supporting biometrics has been decentralized in recent years to avoid a central database of biometric information that may be stolen by attackers. As a result, the authentication actually boils down to a private/public key-based exchange -- which means that merely stealing a key allows stealing a user's identity, even without forging or possessing any biometric data at all.

With all of these risk factors in mind, it's no surprise that the National Institute for Standards and Technology has recommended against the use of biometrics as a lone method of authentication.

Phone-based authenticators

Phone authenticators are quickly becoming the leading solutions within the tech world. There are currently three methods that utilize mobile phones for authentication.

Related: How Digital Wallets and Mobile Payments Are Evolving and What It Means for You

Push notification apps work by a user sending an access request to a server, which responds immediately with either a security challenge or a message that authentication has taken place. One of the big advantages of this approach is that it offers a smooth user experience, since there's no need to look up one-time passwords or carry an otherwise redundant device.

Additionally, user experience is good since there's no need to remember passwords or carry an additional device. Push only requires the response to an app's notifications, which are sent straight to the user's mobile device.

Secret Double Octopus leverages secret sharing encryption to provide password-free, high-assurance access to a user's online platforms, internet applications and networks such as Active Directory.

Software tokens, or soft tokens for short, are similar in concept to hard tokens. However, instead of carrying around an extra piece of hardware, it uses a smartphone to calculate the one-time code using the smartphone's clock and the algorithm contained in an app's software installed on the device.

Among the leaders in authentication software is the Dutch company CM offers a range of one-time-password generating apps specifically designed to be applied at the enterprise level.

Soft tokens have a downside, though. Because soft token one-time passwords are located on a network-connected device, they become inherently more vulnerable because they are left open to the threat of hackers remotely intercepting and copying the app's passwords.

Related: Here Are the 25 Worst Passwords of 2017

Text messaging a one-time password is known as SMS authentication. Initially, SMS was used in addition to passwords. However, since the password itself can be reset with the acceptance of an SMS, the value of the password diminished, and more applications began using SMS as a password alternative. The biggest advantage of SMS one-time passwords is that they do not require the installation of any app on the user's mobile device.

Gemalto, a digital security company operating out of Belcamp, Maryland, offers a user-friendly, business-compatible solution for SMS password delivery. The company's one-time-password application allows users to configure settings that optimize security based on the business environment and can be synced with a PC or laptop.

The downside is that SMS messages are weak on security. Passwords delivered via SMS can be compromised in any one of three ways: impersonating a phone's owner, hacking a cellular network and secreting malware onto a mobile device itself.

A coming paradigm shift

All the signs are pointing to a shift away from password authentication. Big tech firms have been busy producing innovative alternatives, and users are also beginning to demand replacements. Armed with the knowledge of the pros and cons of different methods, companies and individual users can find the authentication solution that best fits their needs.

Raz Rafaeli

CEO and Co-Founder

Raz Rafaeli is the CEO and co-founder of Secret Double Octopus, a mobile-based keyless and password-free authentication technology. Rafaeli holds an M.Sc. in Computer Science from the Technion Institute of Technology.

Want to be an Entrepreneur Leadership Network contributor? Apply now to join.

Editor's Pick


How to Close the Trust Gap Between You and Your Team — 5 Strategies for Leaders

Trust is tanking in your workplace. Here's how to fix it and become the boss your team needs to succeed.


6 Cost-Effective Ways to Acquire Brand Ambassadors

Boost your brand's visibility and credibility with budget-friendly strategies for acquiring brand ambassadors.

Health & Wellness

Get a Year of Unlimited Yoga Class Downloads for Only $23 Through June 17

Regular exercise has been proven to increase energy and focus, both of which are valuable to entrepreneurs and well-known benefits of yoga.

Growing a Business

He Immigrated to the U.S. and Got a Job at McDonald's — Then His Aversion to Being 'Too Comfortable' Led to a Fast-Growing Company That's Hard to Miss

Voyo Popovic launched his moving and storage company in 2018 — and he's been innovating in the industry ever since.

Side Hustle

'The Work Just Fills My Soul': She Turned Her Creative Side Hustle Into a 6-Figure 'Dream' Business

Kayla Valerio, owner of vivid hair salon Haus of Color, transformed her passion into a lucrative venture.

Business Culture

Why Remote Work Policies Are Good For the Environment

Remote work policies are crucial for ESG guidelines. Embracing remote work can positively impact your business and employees.