enter their email address to log into an application<\/a>. Once clicked, magic links instantly log users into their desired application.<\/p>\n\n\n\nExamples of magic links:<\/strong><\/p>\n\n\n\n\n- Signing into a new Slack instance<\/li>\n\n\n\n
- Signing into a Medium account<\/li>\n<\/ul>\n\n\n\n
How they work:<\/strong><\/p>\n\n\n\n\n- A user visits an application for the first time.<\/li>\n\n\n\n
- Upon registration, the application prompts the user to enter their email address.<\/li>\n\n\n\n
- The user enters their email address and clicks submit.<\/li>\n\n\n\n
- The application creates a magic link and assigns it a specific token.<\/li>\n\n\n\n
- Next, the application sends an email containing the magic link to the user.<\/li>\n\n\n\n
- The user clicks on the link.<\/li>\n\n\n\n
- The application parses the query parameters and searches an internal database for the token.<\/li>\n\n\n\n
- When an entry with a matching token is found, the user gets authenticated.<\/li>\n<\/ol>\n\n\n\n
Passwordless Authentication Best Practices<\/h2>\n\n\n\n
Implementing a passwordless authentication tool is a big undertaking that organizations have to prepare for. Without proper planning, you risk poor adoption, which opens the door to vulnerabilities rather than closing it on them.<\/p>\n\n\n\n
Your planning should center around leadership, user buy-in, and effective change management. To do that, you need to help users understand:<\/p>\n\n\n\n
\n- Why the change is happening.<\/strong> Most employees aren\u2019t big fans of change, especially when they don\u2019t have context for it. If they don\u2019t understand why passwordless authentication is important, they\u2019ll find ways to get around it, creating more problems for you and your team. Take time to document the problems with a password-driven culture and communicate why you\u2019re moving to a passwordless future.<\/li>\n<\/ul>\n\n\n\n
\n- How it will affect their day-to-day work.<\/strong> Employees usually equate security changes to more work on their end. Use the time before your rollout to emphasize the benefits of going passwordless \u2014 employees won\u2019t have to memorize passwords or create new ones every day. Signing into their applications with their face, a fingerprint, or a magic link will boost their productivity, not hinder it.<\/li>\n<\/ul>\n\n\n\n
\n- Steps users need to take before the rollout. <\/strong>Don\u2019t leave users in the dark. Make any pre-launch steps abundantly clear through writing and videos, customize them to every device, platform, and operating system, send reminders before and during the launch, and host day-of training sessions to walk users through the setup process. Consider investing in a passwordless authentication platform with built-in training for admins and end users.<\/li>\n<\/ul>\n\n\n\n
\n- Where to find information about the new solution.<\/strong> Consider creating and adding information about your passwordless solution setup, rollout, and support in your internal knowledge base or intranet. Make it easy for people to self-serve with FAQs, demos, troubleshooting tips, and portals to IT ticketing systems for more complex problems.<\/li>\n<\/ul>\n\n\n\n
Spending time laying the groundwork for a successful launch upfront will help you lighten your IT support load, encourage adoption, and decrease the chances of security issues down the line due to lack of use or misuse.<\/p>\n\n\n\n
Factor-Specific Best Practices<\/h3>\n\n\n\n
Companies must follow technical best practices as well. Broadly, the vendor you pick must work on the operating systems and devices your employees use. Double-check that\u2019s the case for all versions of those tools. Then, ensure you abide by hygiene tips specific to each authentication factor.<\/p>\n\n\n\n