Cybersecurity and identity management company WWPass Corp., developer of authentication technology dubbed PassKey, today announced the release of a password manager for those people who haven’t yet been able to ditch passwords entirely.

The free password manager, PassHub, allows people to log in without a username using the WWPass login app PassKey Lite. The app makes use of encryption and a smartphone to allow a user to authenticate themselves without needing to enter a username and password, though high-security sites may still require a Personal Identification Number or PIN code.

To sign on, a website or service displays a Quick Response, or QR, code that is scanned by the app and that authenticates the user. In the case of PassHub, the user is required to scan the QR code and enter their PIN before the password manager releases their secured list of usernames and passwords.

PassKey Lite is available for smartphones at both the Google Play store and the iOS App Store. And users can sign up for PassHub via the web.

“Usernames and passwords are obsolete, and still result in lost time, resources, data, revenue and other countless frustrations for service providers and customers alike,” said Perry Chaffee, vice president of strategy for WWPass. “Since outdated logins are still widely exploited, we created PassHub as a way for people to safely organize their credentials until they are eventually replaced with passwordless sign-on.”

According to the 2017 Verizon Data Breach Investigation Report, 81 percent of breaches are the result of weak, lost or stolen usernames and passwords. Password managers themselves also represent a potential problem as the use of master passwords and usernames means that an attacker need only break that one to get at everything.

There are many password managers on the market, Chaffee told SiliconANGLE, but PassHub differentiates itself with the PassKey technology. By using the app on the smartphone to authenticate the user, it adds an extra layer of security that removes the username that could be stolen and protects the managed passwords with proof of access: To use the app, after all, the user has to unlock the phone.

Of course, even PassKey by itself cannot entirely do away with passwords.

For some high-security websites, the app does require a PIN code, which can be any combination of numbers or letters. In this way, PassKey provides what’s called multifactor authentication. The first factor is the phone and app — something you have. The second factor is the PIN code — something you know — which is important to add extra layers of security for logging into such sensitive activities as online banking and healthcare information.

As for lower-security accounts, Chaffee said, PassKey could be used to make sign-on much more convenient for users. For example, logging into a movie service on a smart TV can be a pain because it requires pressing arrow-keys to type into a virtual keyboard. With PassKey Lite, a QR code and a button press would be all that’s needed.

Business models that involve many logins and user access controls already see a lot of lost business because of lost passwords — and the burden on customer service to help people regain access — and stolen passwords that cause security breaches and public relation scandals. Making it easier for users to sign on while reducing potential security would be a win-win across the industry.

Meanwhile, usernames and passwords proliferate across lots of different services, from the web to smart devices to smartphones, creating a puzzle for cybersecurity. Password managers provide one key to that puzzle by making it easy to access all of those credentials securely.

With the free release of PassHub as a demonstration of the security technology behind PassKey Lite, Chaffee and WWPass believe that this could be yet another key piece of that security puzzle.

Image: WWPass