Passwordless MFA

Authenticate with Verified Identity

After employment verification, organizations typically issue weak credentials such as user ID and password or some type of biometric that assumes identity on each use. The 1Kosmos approach to identity verification generates as an artifact a passwordless MFA credential workers then use to access their endpoints, the corporate VPN and any required business applications.

Verified identities are matched to the user’s biometric captured at enrollment, and since the platform is certified to FIDO2 standards and bound to a public / private key pair, the biometric can’t be spoofed and their session can’t be compromised. Every access attempt physically verifies the user identity leaving no chance for impostors to login.

In a typical deployment, workers are given the option to login via their user ID and password or use 1Kosmos to go passwordless via a QR code placed on the same screen. This side-by-side deployment option accelerates adoption.

With 1Kosmos organizations deploy a single authentication platform where users can authenticate with a high authenticator assurance level via a QR Code.

Deploy What You Need, When You Need It

Many believe passwordless authentication is difficult to deploy. Others just want to migrate from their antiquated 2FA systems and go passwordless gradually. Still, others have some passwordless capabilities but are looking to adopt a more strategic approach for the enterprise.

1Kosmos offers several deployment models. Some use the app to replace antiquated 2FA authentication workflow and consolidate legacy authentication methods such as OTP, TOPT, SMS, and push notifications into one experience.

Another option is to start passwordless authentication at the desktop, enabling users to login using biometrics into Windows or Mac, for example, even when in restricted environments or offline. For access into the VPN or other business applications, 1Kosmos can be implemented as a replacement or enhancement to existing SSO, providing access by identity-backed biometrics.

Others want to target passwordless authentication opportunistically by worker, department, application, or by specific use case (e.g, privilege access management) or by risk level. For example, a QR code can be placed on a login page for workers to select the option they prefer.

This level of flexibility means organizations can go passwordless all at once or one step at a time and tailor the authentication method and level of assurance to the specific requirements and risk tolerances of individuals or groups of users.

Address All of Your Authentication Needs

Some passwordless systems provide biometric authentication, but not much more … no identity verification, no support for legacy applications that can’t go passwordless, and limited support for a particular operating system with no backward compatibility for prior OS levels.

The platform comes with several convenient features, such as password reset for legacy or incompatible business applications. The password reset feature utilizes user biometrics to ensure the validity of the request.

For mobile, Windows and Mac workers can authenticate via any of eight identification methods including: device biometrics, LiveID, push message, 1Key, email/SMS/Token, 3rd party hardware token, Windows Hello, and Mac TouchID.

1Kosmos also integrates via industry authentication standards such as OAuth, OIDC, SAML, and FIDO. It also offers legacy support via RADIUS and supports interoperability across Windows, Microsoft Entra ID, iOS, Android, Linux, and Unix operating systems.

Give Admins and DevOps the Tools They Need

As a cloud-based identity provider, 1Kosmos comes with several exciting administration features.

The Administration portal provides easy access to the configuration and management of the platform. Starting with over 50 out-of-the-box integrations and a robust API framework enabling quick and easy integrations into common technologies including Microsoft Entra ID, Ping, Okta, and more. It connects to any enterprise directory residing behind a firewall through a lightweight broker to build a read-only access view of your users.

For developers, comes with a developer-friendly SDK that complies with the strictest GDPR, SOC2, and ISO 27001 certification standards. The DevX portal provides a hosted sandbox to test FIDO-based authentication and features a guided tour for developing NodeJS WebAuthn applications. Developers can test use cases in the sandbox using the available APIs for FIDO-based authentication, WebAuthn, and drivers license verification, to name a few.

For enterprises looking to implement a passwordless pilot program, we offer a cloud-based user store where new identities can be created and managed.