Enzoic Navigation
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Enzoic APIs
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Enzoic APIs
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP
Login friction: Don't add unnecessary steps.

Login Friction: Diminish the Risk, Not the User Experience

The Authentication Situation. How Can Companies Evaluate Risk without Impacting the User Experience?

According to Riskified, losses from account takeover increased 122% from 2016 to 2017 and grew by 164% in 2018. This percentage is expected to be even higher by the end of 2019. In this environment, it is critical that companies find a way to secure credentials. At the same time, however, users are demanding a seamless online experience and companies are in a difficult position trying to address ATO without introducing login friction.

Two-factor authentication (2FA) is an example of an authentication technology that most people simply do not want to use. If given the choice, many prefer not to implement it at all—for example, fewer than 10% of Google users have signed up for 2FA to protect their Google accounts. It’s clear that 2FA will need to evolve in order to meet companies’ competing priorities of security and a low friction customer experience.

There are other authentication alternatives for companies besides 2FA, that can alter friction at login:

  • Adaptive authentication. Adaptive authentication cross-references IP address, geolocation, device reputation, and other behaviors to assign a risk score to an inbound login session and step-up factors accordingly. These systems are typically tuned aggressively to increase effectiveness, meaning that additional authentication steps are often added in relatively benign cases. As such, while the approach sounds good in theory, in practice it frequently frustrates customers and is not the most effective means of striking the right balance between security and user experience.
  • Biometric authentication: This technology is appealing from a customer experience standpoint. However, the widespread use of biometric authentication is impractical because not all current technologies and devices are equipped with biometric capabilities. In addition, while biometrics go a long way in providing a frictionless customer experience, they default back to password-based authentication when the biometric fails or is unavailable. And once your fingerprint and facial patterns are exposed, there is nothing stopping a criminal from accessing your accounts.

So, how can organizations get a handle on the authentication situation and achieve the holy grail of low friction and robust security?

At Enzoic, we believe the most critical step is ensuring password security without adding a lot of login friction. With our credential and password screening products, users’ credentials are compared against our continuously updated database of exposed username and password pairs. Because this process happens behind the scenes, it has zero impact on the customer experience if the credentials have not been compromised.

If it’s determined that a user’s credentials have been exposed, companies can take a range of actions—for example, requiring an additional authentication factor or forcing an immediate password reset.

We believe that credential screening provides organizations with an unparalleled ability to truly evaluate risk at login. It’s a known fact that people frequently reuse passwords across multiple sites in both their personal and professional lives and other authentication solutions will ultimately fail to protect the account if the credentials themselves are not secure. This, coupled with users’ demand for a frictionless experience, make credential screening of paramount importance in the current landscape where breaches happen on a daily basis.

Protecting accounts without introducing login friction is a complex problem. Various methods of authentication may be appropriate based on industry, perceived risk-level and a variety of other factors. But it’s critical that companies include credential or password screening in their security arsenal to ensure security at the password layer.

Adaptive AuthenticationLogin FrictionMFA

Search

Assess your cyber vulnerabilities with a free password audit tool
Start Now

Browse blog categories

  • Account Takeover (28)
  • Active Directory (44)
  • all posts (159)
  • Continuous Password Protection (24)
  • COVID-19 (7)
  • Cracking Dictionaries (6)
  • Credential Screening (21)
  • Cybersecurity (66)
  • Data Breaches (31)
  • EdTech (3)
  • Enzoic News (18)
  • Financial Services Cybersecurity (5)
  • GovTech (4)
  • Healthcare Cybersecurity (15)
  • Law Firm Cybersecurity (2)
  • NIST 800-63 (28)
  • Password Security (30)
  • Password Tips (51)
  • Regulation and Compliance (11)

Stay up to date

Research, news, and more right to your inbox

More

  • Learning about strong, but unsafe passwords
  • What is a credential stuffing attack?
  • What is account takeover (ATO) fraud?
  • Eliminating password reuse to prevent ATO fraud
  • Developer Documentation (APIs)

Recent blog posts

  • Back to Basics: IDSA Trends in 2022 are all about Preventable Cyber Incidents
  • Active Directory is an Active Vulnerability 
  • The Biggest Takeaway from the 2022 Verizon DBIR
  • [ Sign Up for a Free Account ]
  • Contact Us
  • 1-720-773-4515

Enzoic ©2022 | Privacy Policy | Acceptable Use

3800 Arapahoe Avenue, Ste 250 l Boulder, CO 80303

Enzoic’s password auditor provides a great baseline for assessing password vulnerability. Get next level of compromised credentials protection and try the full Enzoic for Active Directory at no cost.

Cookies

This website uses cookies to improve your experience. Continue to use the site as normal if you agree to the use of cookies. To find out more about our use of cookies or to opt-out, please see our Privacy Policy.

More Information
This site is for EDUCATIONAL PURPOSES ONLY.
Your password will be sent securely to the Enzoic servers to check if it is compromised. We do not store your password or use it for any other purpose. If you are not comfortable with this, do not enter your real password.
What is this?

Password Check is a free tool that lets you determine not just the strength of a password (how complex it is), but also whether it is known to be compromised. Billions of user passwords have been exposed by hackers on the web and dark web over the years and as a result they are no longer safe to use. So even if your password is very long and complex, and thus very strong, it may still be a bad choice if it appears on this list of compromised passwords. This is what the Password Check tool was designed to tell you and why it is superior to traditional password strength estimators you may find elsewhere on the web.

Why is it needed?

If you are using one of these compromised passwords, it puts you at additional risk, especially if you are using the same password on every site you visit. Cybercriminals rely on the fact that most people reuse the same login credentials on multiple sites.

Why is this secure?

This page, and indeed our entire business, exists to help make passwords more secure, not less. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater. Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. Thus, it is necessary for us to submit a hashed version of your password to our server. To protect this data from eavesdropping, it is submitted over an SSL connection. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. Many of the passwords we find on the web are not plaintext; they are unsalted hashes of the passwords. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. We do not store any of the submitted data. It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. Our server-side infrastructure is hardened against infiltration using industry standard tools and techniques and is routinely tested and reviewed for soundness.

More…
  • Visit our FAQ to learn more
  • Contact us for press or sales inquiries
  • Add a free password strength meter to your website