{"componentChunkName":"component---src-templates-blog-list-template-js","path":"/140","result":{"data":{"allMarkdownRemark":{"edges":[{"node":{"excerpt":"This blog is part 1 of a series on gRPC. Part 1 will go over some important concepts, part 2 will be a walkthrough of a client-server…","fields":{"slug":"/engineering/getting-started-with-grpc-part-1-concepts/"},"html":"

This blog is part 1 of a series on gRPC. Part 1 will go over some important concepts, part 2 will be a walkthrough of a client-server implementation in Go, and part 3 will be about LoginRadius' experience migrating to gRPC!

\n

gRPC

\n

gRPC, simply put, is just another way to send data across networks. It can be used to communicate between services in a microservice architecture, where a single service can interact with multiple others. Similarly, in client-server models, there can be multiple clients communicating with a common backend server.

\n

\n

The gRPC framework was initially developed at Google and is now open-source. It is a modern implementation of the RPC (Remote Procedure Call) protocol, which has been around since the 80s. You will often see gRPC being compared to other technologies like SOAP, REST, and GraphQL.

\n

Some features:

\n\n

How is it used to send data?

\n

gRPC is based on the idea of calling a remote procedure just like a local one. A procedure is like a function or a method. So, ideally developers can treat remote and local calls similarly. A great thing about gRPC is that developers do not need to know the details of the remote interaction.

\n

Here is a diagram from the official grpc docs showing the flow:

\n

\n

Each client service will include a stub, which is like an interface containing the available remote procedures. These stubs are auto-generated files.

\n

But what does proto refer to? And what are stubs? How can we generate them?

\n

To answer these questions, we need to look at another technology called protocol buffers.

\n

Protocol Buffers

\n

Protocol buffers (protobufs), are a way to format data for storage and transport. gRPC uses protobufs to format data sent over the wire. It is comparable to other data serialization formats such as JSON, XML, and YAML.

\n

Some features:

\n\n

How is it used with gRPC?

\n

Step 1: Create proto definitions - methods, requests, responses.

\n\n
service AccountService {\n  rpc Find(FindRequest) returns (FindResponse);\n  rpc Update(UpdateRequest) returns (UpdateResponse);\n  rpc Delete(DeleteRequest) returns (DeleteResponse);\n}
\n\n
message FindRequest {\n  string Uid = 1;\n}\n\nmessage FindResponse {\n  string Uid = 1;\n  string Name = 2;\n  int32 Age = 3;\n  bool isVerified = 4;\n}
\n\n

Step 2: Compile proto file for auto-generated stubs in desired language.

\n\n
protoc account.proto --go_out=plugins=grpc:.
\n\n

Step 3: Use stubs in server and clients.

\n

The Big Picture

\n

\n

Why gRPC?

\n

One compelling reason to use gRPC is that it provides high performance

\n\n

How does it differ from REST?

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
gRPCREST
APIContract-based i.e. stubsResource-based and relies on HTTP verbs i.e. GET/PUT/POST/DELETE
Network protocolHTTP/2HTTP/1.1 or HTTP/2
Data serialization formatProtocol buffersJSON
StreamingBuilt-in support for client, server, and bi-directional streamingREST on HTTP/1.1 does not allow streaming
\n

Other Considerations

\n

Here, we briefly go over a few other things to consider with gRPC. These will be covered in more detail in another blog.

\n

Management of proto files
\nIf you plan to have multiple proto files and client services, you need some way to manage them for distribution and version control. One solution is to keep all proto files in a central git repository, and maintain versions using git tags.

\n

Using proto2 vs. proto3
\nProtocol buffers have two syntax versions: proto2 and proto3.

\n\n

Load-Balancing
\nSomething to note about load-balancing gRPC is that HTTP/2 requires L7 (Application Layer) load-balancers. Recall that in HTTP/2, TCP connections are long-lived and requests are multiplexed. This makes L4 (Connection Layer) load-balancers ineffective. This differs from HTTP/1.1 where TCP connections get cycled and can benefit from L4 load-balancers. 

\n

That's it for now! To learn more, check out the official gRPC and protobuf docs.

\n","frontmatter":{"date":"October 30, 2019","updated_date":null,"description":null,"title":"Getting Started with gRPC - Part 1 Concepts","tags":["Engineering","gRPC"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1,"src":"/static/23fcca8d49d96b5e61cc171769c93b38/a55b6/grpc.webp","srcSet":"/static/23fcca8d49d96b5e61cc171769c93b38/61e93/grpc.webp 200w,\n/static/23fcca8d49d96b5e61cc171769c93b38/a55b6/grpc.webp 246w","sizes":"(max-width: 246px) 100vw, 246px"}}},"author":{"id":"Andy Yeung","github":null,"avatar":null}}}},{"node":{"excerpt":"Introduction Cross-Site Request Forgery (CSRF) is a common web application attack where a victims’ authenticated session becomes compromised…","fields":{"slug":"/engineering/introduction-to-cross-site-request-forgery-csrf/"},"html":"

Introduction

\n

Cross-Site Request Forgery (CSRF) is a common web application attack where a victims’ authenticated session becomes compromised. This attack essentially tricks a victim into performing unintended tasks on a website they are authenticated in. There are variations to this attack, and a popular one we will discuss is utilizing authentication token to imitate api requests.

\n

Context

\n

In order to understand CSRF, it is important to know how cookies and authentication tokens are used for persisting user sessions. Cookies are information stored in the browser, and often used for managing state between HTTP requests. A key feature of cookies is that they are automatically passed as a header in HTTP requests. Authentication tokens are typically stored as cookies, and are a way to keep track of a users’ authenticated session. These tokens are set as cookies after a user successfully authenticates themselves by log in.

\n

How it works

\n

CSRF takes advantage of the storage of auth tokens in the browser, and constructs http requests to a target server on behalf of the user. Imitating http requests from the legitimate site requires research and preparation from the attacker beforehand, such as finding vulnerable websites and api’s suitable for the attack.

\n

\n

Here is a high-level example of an CSRF attack. Note that some details are excluded for simplicity, but the key aspects are included.

\n
    \n
  1. \n

    John is authenticated on banking.io

    \n\n
    2. \n
  2. \n

    On another tab, John clicks on an advertisement for free money, which leads to a malicious site.

    \n\n
    3. \n
  3. \n

    Malicious site makes a POST request to banking.io/setpassword, which is an api for setting a users password to anything.

    \n\n
    4. \n
  4. Victim is unable to authenticate with banking.io anymore, because the password was set to something else.
    5. \n
\n

Mitigation

\n

A common and effective way of mitigating CSRF is called the double submit cookie. Essentially the client will have two paired and encrypted tokens: one hidden in the page HTML and the other stored as a cookie.

\n

\n

When a request is made by the client, both tokens are sent to the server, and the server will then ensure the tokens are valid pairs before processing the request as normal.

\n

\n

Now the attacker will be unable to perform CSRF since they will not have access to the token hidden in the pages HTML, and the target server requires a valid token pair before processing the request.

\n

There are also many other mitigation techniques, such as using the Same-Site cookie attribute, and requiring user interaction such as CAPTCHA for requests. Learn more on the OWASP wiki).

\n","frontmatter":{"date":"October 30, 2019","updated_date":null,"description":null,"title":"Introduction to Cross-Site Request Forgery (CSRF)","tags":["CSRF"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.3333333333333333,"src":"/static/45655fcaf75e8e3352165b60c7cac47b/1f5c5/crosspath.webp","srcSet":"/static/45655fcaf75e8e3352165b60c7cac47b/61e93/crosspath.webp 200w,\n/static/45655fcaf75e8e3352165b60c7cac47b/1f5c5/crosspath.webp 400w","sizes":"(max-width: 400px) 100vw, 400px"}}},"author":{"id":"Andy Yeung","github":null,"avatar":null}}}},{"node":{"excerpt":"Cybersecurity awareness helps protect enterprises, employees, and customers. That’s why, more than ever, enterprises are working hard to…","fields":{"slug":"/identity/cloud-computing-security-challenges/"},"html":"

Cybersecurity awareness helps protect enterprises, employees, and customers. That’s why, more than ever, enterprises are working hard to protect sensitive data against breaches and hacks. Likewise, consumers want to change unsafe habits, so they can better protect their personal and vulnerable information.

\n

One answer may be a cloud-based customer identity and access management (CIAM) solution, like the one we have built at LoginRadius. This would enable more security features like single sign-on, passwordless logins, and multi-factor authentication. 

\n

5 Cloud Security Challenges that Businesses Face Today

\n

1. DDoS attacks

\n

DDoS or Denial-of-Service attacks are the number one concern of every cloud provider. These attacks cripple server performance and can take websites down for hours or days, hurting revenue and customer satisfaction. Meanwhile, attackers don’t need to invest in expensive hardware; they can relatively easily launch DDoS attacks over the internet.

\n

To combat cloud-based DDoS attacks, you'll need a responsive platform that can detect possible breaches, identify abnormal network behavior, and block DDoS attacks before they take down your website.

\n

2. Lack of cloud security architecture

\n

One of the main reasons organizations move to public clouds is the ability to seamlessly apply cloud security measures that are built into the cloud environment and take into account policies, identity, and compliance requirements.

\n

Cloud migration is a complex and challenging endeavor. Therefore, every aspect of the migration must be treated carefully in order to avoid critical business challenges such as data loss and security breaches.

\n

3. Data breaches

\n

This is the most common adoption concern when it comes to moving to cloud infrastructure. After all, IT professionals have had full control of everything related to security when it comes to on-premises infrastructure.

\n

It is important that you choose a provider with a proven track record in implementing strong security protocols in their own data centers. This will ensure that the security controls you have in place today remain intact and that any new, vital security controls are added as well.

\n

4. Insecure interfaces and APIs

\n

Cloud computing providers are expected to ensure the security of customer resources, even during times of high-volume system changes. This goal is particularly difficult because security must be built into the cloud API. Cloud API providers must rely on authentication and authorization tools to validate requests.

\n

\"Poorly designed APIs may lead to misuse of information or even data breaches. When an organization makes a change to an API, it must take into account how that change affects both internal and external consumers.\"

\n

5. Lack of proper education

\n

To keep your cloud security as strong as possible, you need to prioritize education, not just around best practices for traditional security but also on industry trends. And this is what most enterprises lack today.

\n

Team members should have a good understanding of the basics to start. For example, what is cloud computing and why do they need it? Then the team should identify experts within the organization to teach their colleagues more advanced cloud security, such as industry best practices.

\n

How safe is cloud computing? 

\n

Cloud security (AKA cloud computing security) is a set of policies, technologies, applications, and controls used to protect data and other material that is stored or run in the cloud. 

\n

It’s safe because your files are stored on servers all around the world. This is called a ‘distributed system.’ Your data is encrypted when it travels over the internet, so it’s completely private and protected from hackers and thieves.

\n

Luckily, SaaS companies like LoginRadius specialize in cloud security that keeps customer data secure and private. We also offer IDaaS with a number of user authentication services like multi-factor authentication, single sign-on, and identity management.

\n

What is IDaaS?

\n

IDaaS is a software platform that focuses on protecting and managing digital identities. At LoginRadius, cloud security is at the core of our customer identity and access management (CIAM) platform. Cloud security is built into the foundation of everything we do—and we have the credentials to prove it. 

\n

Which security credentials matter?

\n

LoginRadius has successfully passed multiple audits and earned several certifications in recognition of our commitment to security. These include SOC 2® and ISAE 3000 Type II audits, which we completed in July and August. The SOC 2, issued by the American Institute of CPAs, is considered to be the highest standard for ensuring the security, availability, processing integrity, and confidentiality of customer data. Meanwhile, the ISAE 3000, issued by the International Federation of Accountants, is a standard for assurance over non-financial information.

\n

In August, we also achieved the ISO 27001 Information Security Standard Accredited certification, which sets the international industry-standard for establishing, implementing, maintaining, and continually improving an information security management system.

\n

Our Privacy Shield compliance certification recognizes our compliance with data protection requirements when transferring personal data from the EU and Switzerland to the US.  

\n

In addition, we hold a Security Trust Assurance and Risk (STAR) certification issued by the Cloud Security Alliance (CSA). CSA describes the STAR program as the most powerful cloud security assurance program, \"encompassing key principles of transparency, rigorous auditing, and harmonization of standards.\"

\n

\n

Why choose cloud computing? 

\n

Cost-effectiveness

\n

Typically, on-premises security solutions require a substantial investment to engineer and maintain. 

\n

By contrast, with cloud computing, you don't need to pay anything upfront. That's because cloud security tools are built and operated by a third-party vendor. You only pay for what you need or use through a monthly or annual subscription. 

\n

Maintenance

\n

With cloud security, a third-party vendor is responsible for maintaining the system, not you. This vendor is the one spending their money and time on upgrading, integrating, and optimizing the system. The vendor also keeps the technology up-to-date, leaving you free to focus on growing your business. 

\n

Scalability

\n

Cloud servers are made to support massive sign-ins and sudden, dramatic surges of user actions (during a major sports game or popular TV voting system).

\n

In fact, the LoginRadius Identity Platform was designed with service provider-class scale in mind. The distributed CIAM network has regularly experienced peak transaction volumes in excess of 150,000 logins per second, and typically handles 10,000 requests per second with less than 500 milliseconds latency. Check our live status to see more.

\n

Compliance

\n

Any enterprise that stores customer data must comply with global privacy regulations. These regulations govern how you seek customer consent to use their data and what you do with that data.

\n

The European Union's General Data Protection Regulation (GDPR) is just one example of this kind of legislation. With cloud security, your third-party vendor is responsible for compliance and has the expertise to do so.

\n

At LoginRadius, our Identity Platform complies with all significant data security and privacy laws and with the terms of various social networks. We monitor these laws regularly for changes or updates. And being that our cloud data centers are in over 35 locations worldwide, you can choose where your customer data is stored to comply with local data regulations. 

\n

Secure Data Access

\n

Customer access to their data is a requirement of the California Consumer Privacy Act (CCPA), and non-compliance can result in hefty fines. However, data stored on cloud services is instantly available to authorized users. On the cloud, centralized data can be backed up regularly and restored quickly in case disaster recovery is ever necessary.

\n

\"SASE-approach\"

\n

Better Performance

\n

Just as cloud technology powers its way into transforming entire industries, so does its technology progressively cut down on latency times and work to improve overall performance.

\n

Moreover, a third-party data center provider can speed up your hardware refresh cycles and deliver the latest high-performance equipment. With a third-party data center provider, all you need to do is add more power or expand the floor space when you need it. You don’t have to worry about maintaining huge backup spares, or worry about the manufacturer’s end-of-life (EOL) replacement schedules.

\n

Speed to Market

\n

Cloud computing enables enterprises to provision resources for development and testing across a wide variety of environments. Once they are complete, applications can be rapidly deployed into an operational environment hosted on the cloud for a smooth launch.

\n

As these environments feature elastic scaling capabilities, organizations no longer need to worry about an incorrect capacity estimate impacting their ability to scale on demand.

\n

Cloud Security Alliance

\n

The Cloud Security Alliance is the world's leading organization dedicated to defining and raising awareness of cloud security best practices.

\n

LoginRadius is a member, along with other experts in cloud security. Together, CSA members share up-to-date developments about the cloud computing environment. We recognize emerging security risks so that we can improve cloud security for everyone.

\n

\"book-a-demo-loginradius\"

\n","frontmatter":{"date":"October 24, 2019","updated_date":null,"description":"For business owners and IT professionals around the world, security in the cloud is still a pressing concern. There are a lot of things you need to consider when moving your business to a cloud environment; from data protection, getting the right platform for your needs, how to protect data during transit, and more.","title":"Cloud Security Challenges Today: Expert Advice on Keeping your Business Safe","tags":["cloud computing","ciam solution","cx"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.7094017094017093,"src":"/static/4eb7a20492e18259ebaaf31842d03695/9fd83/cloud-computing-security-challenges-cover.webp","srcSet":"/static/4eb7a20492e18259ebaaf31842d03695/61e93/cloud-computing-security-challenges-cover.webp 200w,\n/static/4eb7a20492e18259ebaaf31842d03695/1f5c5/cloud-computing-security-challenges-cover.webp 400w,\n/static/4eb7a20492e18259ebaaf31842d03695/9fd83/cloud-computing-security-challenges-cover.webp 626w","sizes":"(max-width: 626px) 100vw, 626px"}}},"author":{"id":"Rakesh Soni","github":"oyesoni","avatar":"rakesh-soni.webp"}}}},{"node":{"excerpt":"When it comes to online security, the battle cry among experts lately is: “The future is passwordless!” So, why is passwordless…","fields":{"slug":"/identity/passwordless-authentication-the-future-of-identity-and-security/"},"html":"

When it comes to online security, the battle cry among experts lately is: “The future is passwordless!” So, why is passwordless authentication so important?

\n

Simple. Passwords are just too easy to guess, hack, or intercept. What’s more, the legacy of password reuse is leading to constant attack and account vulnerabilities.

\n

However, modern-day passwordless authentication security goes beyond the use of password and username credentials.

\n

So, whether your organization wants to replace passwords or is determined to keep using them, you must first understand password weaknesses. Here are a few:

\n\n

Remember that we’re not dealing with bored, out-of-work hackers playing for thrills. Rather, these are often well-established criminal organizations using high-end machine learning (for big profit). 

\n

What is Passwordless Authentication?

\n

A passwordless authentication system is one that swaps the use of a traditional password with more secure factors. These extra-security methods may include a magic link, fingerprint, PIN, or a secret token delivered via email or text message.

\n

Why Do We Need Passwordless Authentication?

\n

Most people have questions regarding the reliability of passwordless authentication and they always question themselves- is passwordless more secure? Well, passwordless login eliminates the need to generate passwords altogether. There’s a lot of good in this new-age process for both users and organizations alike.

\n

For users, since one need not type passwords anymore, it leads to a better screen time experience. While for organizations, it will lead to fewer breaches and support costs.

\n

The good news is that the list doesn’t stop here. Let’s learn more. 

\n

Comparative Analysis: Passwordless vs Traditional Authentication

\n

Let’s quickly compare passwordless and traditional authentication and learn how secure is passwordless authentication:

\n

1. Security

\n\n

2. User Experience

\n\n

3. Cost-Effectiveness

\n\n

4. Vulnerabilities

\n\n

Passwordless Login for Businesses

\n

The use of passwordless authentication security in businesses is multifold. For example, you can go passwordless for internal security, online consumers, or even combine the two of them. 

\n

A few use cases of passwordless authentication include:

\n\n

With passwordless login, it is much easier to keep information about your users safe and implement tighter security measures for your employees.

\n

Passwordless Login for Non-Profits

\n

Speaking of non-profit organizations, passwordless authentication can do wonders to the security of the donation process. 

\n

Also, when a person donates to an NGO, they can have their payment information like name, card details, expiry dates etc. saved using passwordless options like email authentication. So the next time they plan to donate, they won't need to fill in the basic information. 

\n

Benefits of Passwordless Authentication

\n

We’ve learned how is passwordless more secure. Now let’s explore its benefits:

\n\n

What Does Passwordless Authentication Prevent

\n

With passwords out of the picture, the following are a few attacks that businesses can dodge by implementing passwordless authentication into their systems.

\n
    \n
  1. Password spraying: It is a method of cyber-attack that attempts to log in to a large number of accounts with commonly used password credentials.
    2. \n
  2. Brute Force Attack: Hackers use the trial-and-error method to guess the login credentials or encryption keys. They try all the possible combinations until the account is hacked.
    3. \n
  3. Spear phishing: It is an email spoofing attack that scams organizations and individuals to give away sensitive credentials for financial, military, or trade gains.
    4. \n
  4. Social Engineering: Hackers use psychological manipulation and scam users into giving away sensitive information or granting access to critical resources.
    5. \n
  5. Shoulder Surfing: It is a type of data theft where the intruder steals login credentials by peeking over the target's shoulder.
    6. \n
\n

\"Passwordless

\n

How Safe Is Passwordless Authentication as Compared to Other Login Methods

\n

A common issue with using passwords for authentication lies in the fact that customers want the quickest way to log in to their accounts. After all, the longer it takes for a consumer to sign-up, or make a purchase, they will more likely tend to bounce. Other reasons why passwords bounce include:

\n\n

Due to bad password practices, chances are consumers may be putting their accounts at risk. This is one of the strongest reasons why passwordless authentication is preferred by consumers and enterprises as their preferred method of authentication.

\n

Types of Passwordless Authentication

\n

In a typical application, passwordless authentication can be implemented through different approaches. Here’s a list of the most common ones.

\n

Email-Based Passwordless Authentication

\n

This is one of the most common login systems. The user is asked to enter the email address. A unique code (or magic link) is then created and sent to the associated email ID. When the user clicks on the link, the server triggers an action to verify if the code is valid within a certain timeframe (e.g. three minutes) and then swaps it for a long-time validation token. If the authentication is successful, the user is let in.

\n

Social Login Authentication

\n

Social login is the method of authentication using a social network provider like Facebook, Twitter, or Google. The user enters your application and selects a social network provider. A login request is then sent to the provider and after the provider approves it, the user is allowed to access their application. There is no need for passwords at all.

\n

SMS-Based Passwordless Login

\n

Here’s a convenient, easy-to-implement way to onboard a user. SMS-based login eliminates the need to create additional credentials, thereby easing the basic authentication process. The steps are simple: A user must enter a valid phone number; then the server sends a single-use code to that number which the user must enter to log in to the service. 

\n

Biometrics-Based or Passwordless Authentication for Logged-In Users

\n

Biometric authentication services focus on growing technologies like fingerprint, face, or iris scans. The technology works on smartphones where users press their thumbs on their smartphone scanners to authorize their identities and gain access to their accounts. Both Android and Apple offer biometric login options that are popular for their convenience.

\n

\"image

\n

How Does Passwordless Authentication Work

\n

The technology behind passwordless login is similar to that of digital certificates. There are cryptographic key pairs that include a private and public key. 

\n

To understand how this works, think of the public key as the padlock. The private key, on the other hand, is what unlocks the padlock. To sum up, there is only one key for the padlock and in return, one padlock for the key. 

\n

This means that whenever a user wishes to create a secure account, a public-private key pair must be generated. This is usually done via tools like a mobile app or a browser extension. Here are the steps:

\n\n

Today’s passwordless authentication follows the FIDO2 standard. It includes WebAuthn and CTAP that help organizations keep their passwords secure.

\n

\"flowchart

\n

Wondering how it works? 

\n

Let’s assume you’re a service provider and you store customer public keys in “public”.

\n

That may sound risky, but here’s the catch. If a hacker obtains that public key, the data will be of no use without the private key that unlocks it. The best part is that the private key remains with the end-user.

\n\n

As the landscape of cybersecurity evolves, several emerging trends in passwordless security are reshaping how we protect digital identities:

\n

1. Biometric Authentication

\n

Biometric authentication methods, such as fingerprint scanning, facial recognition, or iris scans, are gaining traction. These methods offer a seamless and secure way to authenticate users without the need for traditional passwords.

\n\n

The use of magic links sent via email is becoming popular. Users can simply click on a unique link to access their accounts, eliminating the need to remember passwords. This method enhances user experience and streamlines the login process.

\n

3. Social Login Integration

\n

Integrating social media accounts for authentication is a rising trend. Users can leverage their existing social media profiles to log in to various platforms, reducing the burden of creating and managing multiple passwords.

\n

4. Hardware Tokens and Smart Cards

\n

Hardware tokens and smart cards provide physical, secure methods of authentication. These devices generate unique codes or require physical presence for access, adding an extra layer of security to passwordless authentication.

\n

Implementing Passwordless Authentication with LoginRadius

\n

The best way to provide seamless registration and authentication for your customers is with a passwordless login solution. This gives them a hassle-free way to access their accounts—with no passwords needed! 

\n

The LoginRadius Identity Platform is an out-of-the-box way for you to do this easily. The identity and access management platform is fully customizable too, so you can simplify your customer experience to suit your company’s needs.

\n

Here’s how the platform works.

\n

\"activating

\n

Passwordless authentication with LoginRadius is a three-fold process. 

\n

Step 1: On the website login page, a customer will be asked to enter the email address. It will act as their username too.

\n

Step 2: LoginRadius will send a temporary verification link to the associated email address. You can custom-set the duration that link will remain active before it expires.

\n

Step 3: The customer is prompted to click the verification link, which is then authenticated and redirected to the website the customer originated from.

\n

It’s as simple as that!

\n

Conclusion

\n

Not only is remembering password characters a pain but logging in by password alone is not very secure. By removing passwords, you can reduce costs to your IT and customer service departments. The icing on the cake is that passwordless logins improve customer experience. That’s great for your brand reputation and your bottom line.

\n

If your company is not on board with passwordless authentication yet, the time to act is now.

\n

FAQs

\n

Q: Is passwordless authentication safer?

\n

A: Yes, passwordless authentication is considered safer as it eliminates the vulnerabilities associated with traditional passwords, such as phishing and brute force attacks.

\n

Q: What is the difference between passwordless and OTP?

\n

A: Passwordless authentication eliminates the need for a password entirely, relying on methods like biometrics or magic links. OTP (One-Time Password) is a temporary code sent to a user's device, often used as a second factor in authentication.

\n

Q: What is the difference between passwordless and SSO?

\n

A: Passwordless authentication focuses on eliminating passwords, while Single Sign-On (SSO) allows users to access multiple applications with one set of login credentials.

\n

Q: What is 2FA or passwordless?

\n

A: 2FA (Two-Factor Authentication) requires two forms of verification for access. Passwordless authentication, on the other hand, allows users to log in without using a traditional password, using methods like biometrics or email links.

\n

\"book-a-free-demo-loginradius\"

\n","frontmatter":{"date":"October 11, 2019","updated_date":null,"description":"The war cry among experts lately when it comes to online safety is: The future is passwordless! So, why does passwordless authentication matter so much?","title":"The Role of Passwordless Authentication in Securing Digital Identity","tags":["passwordless authentication","digital identity management","cx"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.4598540145985401,"src":"/static/4e610fa1793a4c84532bd855d762bbbf/58556/passwordless-auth.webp","srcSet":"/static/4e610fa1793a4c84532bd855d762bbbf/61e93/passwordless-auth.webp 200w,\n/static/4e610fa1793a4c84532bd855d762bbbf/1f5c5/passwordless-auth.webp 400w,\n/static/4e610fa1793a4c84532bd855d762bbbf/58556/passwordless-auth.webp 800w,\n/static/4e610fa1793a4c84532bd855d762bbbf/cc834/passwordless-auth.webp 1024w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Rakesh Soni","github":"oyesoni","avatar":"rakesh-soni.webp"}}}},{"node":{"excerpt":"At LoginRadius, we are passionate about creating efficient processes to provide seamless online login experiences. At the KuppingerCole…","fields":{"slug":"/identity/kuppingercole-ciw-presentation/"},"html":"

At LoginRadius, we are passionate about creating efficient processes to provide seamless online login experiences. At the KuppingerCole Consumer Identity World event in Seattle, our CEO, Rakesh Soni, gave an insightful presentation on the importance of Marketing and Engineering collaboration to achieve this goal. In essence, working together maximize's each team's strength by eliminating each team's limitations. His presentation can be downloaded here and you can read the summary below. 

\n

What is Consumer Identity World?

\n

Consumer Identity World is a three-day annual conference hosted by KuppingerCole for leaders who secure consumer digital identities. Topics for discussion often include Customer Identity & Access Management (CIAM) strategies, customer privacy and consent management, and methods for improving customer experience.

\n

KuppingerCole is a renowned, independent analyst organization that specializes in neutral advice, thought leadership, and practical relevance regarding CIAM, as well as IAM. The latter acronym stands for Identity & Access Management. Simply put, IAM is a platform built for managing and securing employee identities, rather than customer identities. More information about the difference between IAM vs. CIAM can be found here.

\n

Improving security and service for customer digital identities

\n

Throughout the three days at Consumer Identity World, attendees networked and learned about the latest news in data security, privacy regulations, and login authentication. Our CEO, Rakesh, contributed to this conversation with a presentation on the vital need for Marketing and Engineering teams to unite. By combining the skills and insights of both teams, companies can better serve today’s modern digital user. 

\n

Characteristics of the modern digital user

\n

Society is constantly becoming more digitalized. Online services completely changed consumer behavior—we shop, pay bills, and call rides online. So, when businesses provide services, they should understand the characteristics of today’s digital users. Here are a few:

\n\n

Rakesh also stressed that digital users want quick, hassle-free service when: 

\n\n

Challenge: Marketing & Engineering teams are so different

\n

Marketing Team Strengths

\n\n

Marketing Team Weaknesses

\n\n

Engineering Team Strengths

\n\n

Engineering Team Weaknesses

\n\n

Solution: Marketing and Engineering teams can collaborate.

\n

 By combining their different skills and insights two teams become a stronger whole.

\n

Initiating collaboration

\n

There are two main ways to join Marketing and Engineering teams, so you can create a modern online experience. Here’s how your Executive Team can help implement this.

\n

The first way is for the Executive team to create a culture of collaboration between Marketing and Engineering. 

\n

Make it clear that they both have the same goal:

\n

Both teams want to provide a frictionless online experience for customers. 

\n

\"kuppingercole\"

\n

Next, highlight each team’s strengths and how the other team contributes to the overall goal. Management should ensure their teams feel empowered and excited to work with each other. 

\n

Additionally, the Executive team should seek to build a team of experts. This team should be responsible for developing and maintaining a high-performance system. 

\n

Vital features of this system include:

\n\n

Your collaborative dream team should include individuals who specialize in identity, DevOps, third-party integrations, UX, and consumer behaviour. They should continue to research and develop a high performing customer ID and experience engine. Once this in place, this team of experts should work to continuously maintain it. 

\n

Conclusion

\n

Creating collaboration between Marketing and Engineering can greatly improve online services. This culture and structure of working together is key in meeting these needs and evolving in the future. And it is up to the Executive team to ensure that this collaboration is successful. 
\nClick here to download a PDF of the full presentation.

\n","frontmatter":{"date":"October 04, 2019","updated_date":null,"description":"We are enthusiastic about building successful processes at LoginRadius to provide smooth online login experiences. Our CEO, Rakesh Soni, gave an informative presentation at the KuppingerCole Customer Identity World event in Seattle on the importance of collaboration between Marketing and Engineering to achieve this objective. In essence, working together maximises the power of each team by minimising the shortcomings of each team. It is possible to download his presentation here and you can read the review below.","title":"LoginRadius presents at KuppingerCole Consumer Identity World","tags":["media-and-publication"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.3333333333333333,"src":"/static/f623b52e92b5b2b069bd4bd056b1ca35/7f8e9/kuppingercole-ciw-presentation.webp","srcSet":"/static/f623b52e92b5b2b069bd4bd056b1ca35/61e93/kuppingercole-ciw-presentation.webp 200w,\n/static/f623b52e92b5b2b069bd4bd056b1ca35/1f5c5/kuppingercole-ciw-presentation.webp 400w,\n/static/f623b52e92b5b2b069bd4bd056b1ca35/7f8e9/kuppingercole-ciw-presentation.webp 768w","sizes":"(max-width: 768px) 100vw, 768px"}}},"author":{"id":"Rakesh Soni","github":"oyesoni","avatar":"rakesh-soni.webp"}}}},{"node":{"excerpt":"In business, digital identity management primarily refers to the way a customer’s personal information is safely collected, stored, and…","fields":{"slug":"/identity/digital-identity-management/"},"html":"

In business, digital identity management primarily refers to the way a customer’s personal information is safely collected, stored, and accessed.

\n

While this may appear simple, many businesses fall prey to misconceptions about building or managing a customer’s digital identity. To help you leverage customer identity data, let’s discuss the top three misconceptions that trip businesses up.

\n

\n

3 Common misconceptions around digital identity

\n
    \n
  1. “A digital identity must use highly personal identifiable information.”
    2. \n
\n

Many businesses make the mistake of putting sensitive personal information like full names or social insurance numbers in their system to track customer identities. Due to the proliferation of data breaches, this is risky. Safer methods should be used instead, such as coded customer numbers.

\n

2. “You can only get customer insights from surveys or forms.”

\n

Sure, one way of getting consumer insights is having them fill out a form on your site. Another way is to use a device ID to identify customer behavior

\n

But what about consumers who own multiple devices, have separate digital IDs at work and home, and access the internet through multiple IP addresses or 3rd-party apps? When you gather data from multiple sources, you’ll need to compile this and store it in one place. But how?

\n

With customer identity and access management (CIAM) software, you can access an individual’s extensive data from multiple sources. Even “anonymous” user data can help you create a customer identity. You can even gather data through progressive profiling—a gradual, more natural way for customers to share their personal information. 

\n

3. “Consumer behavior analytics is all you need.”

\n

Due to marketing’s reliance on user experience mapping, session analytics, and content engagements, this myth is rampant. As a result, many businesses mistakenly think “behavioral” data is all they need for digital identity management. Not true. In the next section, we’ll explain why.

\n\n

Why is digital identity management important?

\n

We live in an era where data is the most valuable commodity in the world. However, where there is value, there is also risk. For instance...

\n

Did you know that 60% of companies fail within 6 months of a cyber attack?

\n

Malicious software, hackers, online fraud, and user errors all pose a danger to the digital identification data that you collect or store. 

\n

\"digital-identity-trends-2019\"

\n

For businesses that collect or store customer data, security is vital to winning and maintaining customer trust. If you’re uncertain how, here are 5 methods that can help.

\n

5 Gold Standards for Winning Customer Trust

\n

1. Collect only what’s needed

\n

Many businesses are quick to collect an array of customer data during the registration process. If you don’t take the time to consider if/why/how you’ll use all of this data— or determine the right time to collect this information—you’ll run into a lot of issues. 

\n

Collecting unnecessary data wastes resources and increases the risk of identity theft. Plus, gathering too much data also causes customers to abandon registration, as it slows down the process and feels intrusive.

\n

2. Invest in data encryption and hashing.

\n

When data is in transit from one server to another, it’s at its most vulnerable. That’s why encryption in transit is crucial to data protection. Likewise, encryption at rest is necessary for data governance and compliance efforts. 

\n

When it comes to hackers, anything that has been coded can be decoded. Thus, utilizing one-way hashing for safeguarding sensitive data like passwords is a must-do.

\n

Safety Tip: When you implement encryption at rest and encryption in transit, be sure that you’re using a platform with an ISO 27001 certification. This ensures that your system complies with industry-leading standards for information security and risk management. 

\n

3. Limit access to data.

\n

Not all data is in use continuously. That’s why sensitive customer data should not be accessible to everyone, all the time. 

\n

Utilizing field-level encryption allows you to set up access based on an individual’s role. In other words, field-level encryption is the ability to encrypt data within specific data fields, making this data unreadable to anyone who lacks access or the keys to decrypt this data.

\n

4. Require safer authentication.

\n

While some tech-savvy users know how to look after their personal information, many are unaware of how digital identity verification impacts security. 

\n

To reduce risk, it’s important to invest in systems that enable a higher level of passwordless login. One method, multi-factor authentication (MFA), uses an SMS or a call-in code, and/or an email link as extra levels of security. 

\n

Another method, risk-based authentication (RBA), recognizes user patterns and alerts your system if this pattern suddenly changes. For example, if someone tries to log in from a foreign country or a new IP address, an email will be sent to the registered user, asking them to validate the action. 

\n

5. Respect your customers.

\n

In the past, digital identity management practices were not very respectful of customer privacy. But soon, customers demanded better—and compliance regulations were born. 

\n

Compliance regulations require businesses to communicate with customers about why their data is collected, by whom, and what will be done with it. It also demands customer consent before collecting their data.

\n

Did you know that requesting consent can also strengthen your brand reputation and build customer trust? That’s why it’s smart to employ a compliance-ready platform now. This will prepare your business for global data regulations while also fostering customer loyalty.

\n

Conclusion

\n

Is there one way to achieve all 5 gold standards?

\n

Yes—with CIAM software. LoginRadius CIAM offers a variety of highly-secure customer identity management features. For added peace of mind, LoginRadius keeps its platforms ahead of emerging data regulations and consistently performs rigorous updates.

\n

\"LoginRadius

\n","frontmatter":{"date":"October 01, 2019","updated_date":null,"description":"In industry , digital identity management relates specifically to how the personal information of a customer is obtained, processed, and accessed safely.","title":"Digital Identity Management: 5 Ways to Win Customer Trust","tags":["digital identity management","ciam solution","cx"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.7241379310344827,"src":"/static/8714c2a907a14fa58a5ebfc556e430b7/7f8e9/digital-identity-mngmnt.webp","srcSet":"/static/8714c2a907a14fa58a5ebfc556e430b7/61e93/digital-identity-mngmnt.webp 200w,\n/static/8714c2a907a14fa58a5ebfc556e430b7/1f5c5/digital-identity-mngmnt.webp 400w,\n/static/8714c2a907a14fa58a5ebfc556e430b7/7f8e9/digital-identity-mngmnt.webp 768w","sizes":"(max-width: 768px) 100vw, 768px"}}},"author":{"id":"Rakesh Soni","github":"oyesoni","avatar":"rakesh-soni.webp"}}}}]},"markdownRemark":{"excerpt":"Identity is evolving, and developers are at the forefront of this transformation. Every day brings a new learning—adapting to new standards…","fields":{"slug":"/identity/developer-first-identity-provider-loginradius/"},"html":"

Identity is evolving, and developers are at the forefront of this transformation. Every day brings a new learning—adapting to new standards and refining approaches to building secure, seamless experiences.

\n

We’re here to support developers on that journey. We know how important simplicity, efficiency, and well-structured documentation are when working with identity and access management solutions. That’s why we’ve redesigned the LoginRadius website—to be faster, more intuitive, and developer-first in every way.

\n

The goal? Having them spend less time searching and more time building.

\n

What’s New and Improved on the LoginRadius Website?

\n

LoginRadius’ vision is to give developers a product that simplifies identity management so they can focus on building, deploying, and scaling their applications. To enhance this experience, we’ve spent the last few months redesigning our interface— making navigation more intuitive and reassuring that essential resources are easily accessible.

\n

Here’s a closer look at what’s new and why it’s important:

\n

A Developer-Friendly Dark Theme

\n

\"This

\n

Developers spend long hours working in dark-themed IDEs and terminals, so we’ve designed the LoginRadius experience to be developer-friendly and align with that preference.

\n

The new dark mode reduces eye strain, enhances readability, and provides a seamless transition between a coding environment and our platform. Our new design features a clean, modern aesthetic with a consistent color scheme and Barlow typography, ensuring better readability. High-quality graphics and icons are thoughtfully placed to enhance the content without adding visual clutter.

\n

So, whether you’re navigating our API docs or configuring authentication into your system, our improved interface will make those extended development hours more comfortable and efficient.

\n

Clear Categorization for LoginRadius Capabilities

\n

\"This

\n

We’ve restructured our website to provide a straightforward breakdown of our customer identity and access management platform capabilities, helping you quickly find what you need:

\n\n

This structured layout ensures you can quickly understand each capability and how it integrates into your identity ecosystem.

\n

Developer-First Navigation

\n

\"This

\n

We’ve been analyzing developer workflows to identify how you access key resources. That’s why we redesigned our navigation with one goal in mind: to reduce clicks and make essential resources readily available.

\n

The new LoginRadius structure puts APIs, SDKs, and integration guides right at the menu bar under the Developers dropdown so you can get started faster. Our Products, Solutions, and Customer Services are also clearly categorized, helping development teams quickly find the right tools and make informed decisions.

\n

Quick Understanding of Integration Benefits

\n

\"This

\n

Developers now have a clear view of the tech stack available with LoginRadius, designed to support diverse business needs.

\n

Our platform offers pre-built SDKs for Node.js, Python, Java, and more, making CIAM integration seamless across popular programming languages and frameworks.

\n

Over to You Now!

\n

Check out our revamped LoginRadius website and see how the improved experience makes it easier to build, scale, and secure your applications.

\n

Do not forget to explore the improved navigation and API documentation, and get started with our free trial today. We’re excited to see what you’ll build with LoginRadius!

\n","frontmatter":{"date":"February 21, 2025","updated_date":null,"description":"LoginRadius’ vision is to give developers a product that simplifies identity management so they can focus on building, deploying, and scaling their applications. To enhance this experience, we’ve redesigned our website interface, making navigation more intuitive and reassuring that essential resources are easily accessible.","title":"Revamped & Ready: Introducing the New Developer-First LoginRadius Website","tags":["Developer tools","API","Identity Management","User Authentication"],"pinned":true,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.7857142857142858,"src":"/static/80b4e4fbe176a10a327d273504607f32/58556/hero-section.webp","srcSet":"/static/80b4e4fbe176a10a327d273504607f32/61e93/hero-section.webp 200w,\n/static/80b4e4fbe176a10a327d273504607f32/1f5c5/hero-section.webp 400w,\n/static/80b4e4fbe176a10a327d273504607f32/58556/hero-section.webp 800w,\n/static/80b4e4fbe176a10a327d273504607f32/99238/hero-section.webp 1200w,\n/static/80b4e4fbe176a10a327d273504607f32/7c22d/hero-section.webp 1600w,\n/static/80b4e4fbe176a10a327d273504607f32/1258b/hero-section.webp 2732w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Rakesh Soni","github":"oyesoni","avatar":"rakesh-soni.webp"}}}},"pageContext":{"limit":6,"skip":834,"currentPage":140,"type":"///","numPages":164,"pinned":"ee8a4479-3471-53b1-bf62-d0d8dc3faaeb"}},"staticQueryHashes":["1171199041","1384082988","2100481360","23180105","528864852"]}