How to Transition Online Service to Passwordless at No Cost
Passwordless Alliance
Session 197
ITU-T X.1280 Case Studies from Ecuador, France, and Korea
For the successful development of an information society, innovative ideas and technologies are essential to transform everyday inconveniences into convenient, safe, and economical solutions. This session presents the vision and case studies of creating a more secure and efficient information society by replacing user passwords—the core weakness of the current system—with passwordless technology.
User passwords can be leaked, reused by attackers, or exploited through phishing, pharming, and other attacks by fake service providers. To address these risks, technologies like OTPs, PKI certificates, mobile authentication, biometrics, and QR code authentication have been introduced. However, these measures have not yet fully realized the goal of a passwordless society.
The main reason is that existing authentication technologies place the entire responsibility of proof on users. Users must submit authentication values, and online services simply verify them. This model leaves users responsible for proving their legitimacy.
In 2024, ITU-T established X.1280, an international standard that changes this model. X.1280 uses out-of-band mutual authentication: the online service presents an automatic password to the user, who compares it to the automatic password generated on their smartphone and approves it with their smartphone’s biometric sensor. This shifts the responsibility of proof to the online service.
This approach frees users from entering, changing, or memorizing passwords, significantly improving convenience. It also provides stronger security against cyberattacks such as phishing and man-in-the-middle attacks, while reducing costs by enabling out-of-band biometric authentication through users’ smartphones without needing an additional biometric sensor on each user device.
Following the adoption of X.1280, global ICT experts formed the Passwordless Alliance, a non-profit organization headquartered in Geneva, Switzerland. The Alliance promotes passwordless standards and offers free products globally to build an information society without passwords.
To achieve this, the Alliance distributes Passwordless X1280, free software based on the X.1280 standard. This helps B2C and G2C online services transition to passwordless systems. Examples include online store, consumer support center, and universities in France, Ecuador, and South Korea that now use systems where users approve automatic passwords via their smartphones instead of entering passwords.
Additionally, IT associations and educational institutions in the U.S., Ecuador, and South Korea have adopted educational programs and materials on X.1280 and promote passwordless education.
The main takeaways of this session include:
- The ITU-T X.1280 international passwordless standard
- The role of the Passwordless Alliance in promoting passwordless standards and free software
- Case studies of passwordless software adoption across various online services in France, Korea, Ecuador
- Case studies of the adoption and implementation of passwordless education programs in the US, Korea, Ecuador
-
C3. Access to information and knowledge
-
C4. Capacity building
-
C5. Building confidence and security in use of ICTs
C3. Access to information and knowledge
This session directly supports C3 by promoting technologies that make online services more accessible, secure, and user-friendly. By eliminating the need for passwords through passwordless authentication (ITU-T X.1280), this session presents solutions that remove barriers for users who may face challenges with complex password systems, such as the elderly or those with low digital literacy. The promotion of Passwordless X1280 free software and the sharing of case studies demonstrate how people around the world can securely and conveniently access information and services without relying on vulnerable password-based methods.
C4. Capacity building
This session contributes to C4 by fostering capacity building at both individual and institutional levels. It introduces how the Passwordless Alliance provides free software, educational materials, and training resources that enable IT associations, educational institutions, and online service providers to adopt and operate passwordless technologies. Case studies from the U.S., Ecuador, and South Korea illustrate how education programs based on international standards help local communities and professionals enhance their digital security skills and promote secure service delivery.
C5. Building confidence and security in use of ICTs
This session strongly aligns with C5 as it focuses on enhancing trust and security in digital services. By presenting ITU-T X.1280 and related passwordless solutions, this session demonstrates how common cyber threats such as phishing, pharming, and man-in-the-middle attacks can be effectively addressed. The out-of-band mutual authentication model, which shifts the responsibility of proof from users to online services, provides stronger protection for users and helps build confidence in the use of ICTs.
Summary of linkages:
This session showcases how passwordless technologies promote inclusive and secure access to information (C3), strengthen capacity building through education and free tools (C4), and enhance trust and security in digital services (C5).
-
Goal 9: Build resilient infrastructure, promote sustainable industrialization and foster innovation
-
Goal 10: Reduce inequality within and among countries
-
Goal 11: Make cities inclusive, safe, resilient and sustainable
-
Goal 14: Conserve and sustainably use the oceans, seas and marine resources
-
Goal 16: Promote just, peaceful and inclusive societies
-
Goal 17: Revitalize the global partnership for sustainable development
This session on passwordless technology and the ITU-T X.1280 standard directly supports multiple Sustainable Development Goals by fostering innovation, inclusion, security, and global cooperation in the information society.
Goal 9: Build resilient infrastructure, promote sustainable industrialization and foster innovation
The session highlights innovative authentication technology that improves digital infrastructure resilience by replacing vulnerable password systems with a robust, secure, and standardized passwordless approach. By distributing free software and encouraging broad adoption, it fosters technological innovation accessible to many industries and services, strengthening sustainable ICT infrastructure worldwide.
Goal 10: Reduce inequality within and among countries
Passwordless authentication simplifies secure access to online services without financial or technical burdens on users. By promoting free, standardized tools globally—especially in developing countries —the initiative helps reduce digital divides and inequality in access to safe online environments, empowering marginalized communities.
Goal 11: Make cities inclusive, safe, resilient and sustainable
Secure, convenient online services are essential for smart, inclusive urban environments. The session’s technology improves user safety against cyber threats and increases trust in digital public and private services, contributing to resilient and sustainable cities where citizens can safely participate in digital life.
Goal 16: Promote just, peaceful and inclusive societies
By enhancing security through out-of-band mutual authentication and reducing risks of cybercrime like phishing and man-in-the-middle attacks, the session promotes trust in online interactions. This supports peaceful and inclusive societies by protecting individuals’ rights and fostering justice in digital communication and transactions.
Goal 17: Revitalize the global partnership for sustainable development
The formation of the Passwordless Alliance, a non-profit NGO headquartered in Geneva, exemplifies global cooperation among ICT experts, governments, academia, and private sectors. By sharing open standards and free software, the Alliance strengthens international partnerships and collective efforts to achieve a secure, accessible, and sustainable information society.
- Objective 1: Close all digital divides and accelerate progress across the Sustainable Development Goals
- Objective 2: Expand inclusion in and benefits from the digital economy for all
- Objective 3: Foster an inclusive, open, safe and secure digital space that respects, protects and promotes human rights