A password is a secret character sequence used with a username to log in and control access to an application. It is familiar and easy to add, but it creates security and usability problems that become serious when many services depend on it. section 2.1
Password-based login commonly fails in three connected ways:
- Weak passwords are easier to remember, but easier for attackers to guess. section 2.1
- Password reuse lets a breach at one service expose accounts at unrelated services. section 2.1
- Secure server-side storage is difficult, costly, and requires ongoing attention as attack techniques change. section 2.1
A safer application can avoid storing passwords by delegating authentication to a single sign-on service through OpenID Connect (OIDC). Passwordless options provide another path: WebAuthn supports biometrics and phishing-resistant physical security keys, while one-time passwords expire quickly and do not need to be remembered. section 2.3 section 14.3
Figure 2.1 An authentication form (commonly referred to as a login form) is the primary interface through which users enter their credentials to log in to and access the system.
Use the authentication form to visualize the ordinary interface where users enter password credentials. section 2.1
