# Passwordless Authentication Using a Combination of Cryptography, Steganography, and Biometrics
## 2 Related Work
User behaviours such as typing, swiping, app usage, grip patterns, device gesture, and eye motion tracking are collected, and a profile is built with this data, to authenticate the user. One major advantage is the context-awareness of this model: if the system identifies behaviour inconsistent with that of the user, there is a chance that a third-party might have hijacked the user's session--the session is ended until the user is re-identified. A flaw [PERSON] et al. 's proposal, however, is that an enrolment procedure is not discussed. Authentication based on such a model requires some form of initial registration--it is assumed that this scheme will be an extended functionality (or second factor) for an existing authentication system, which might be password-based. The recurring theme from the schemes reviewed suggests that a secure authentication system with great user experience appears to be a holy grail for security researchers, influencing the decision of technologies being combined in a myriad of ways to achieve the desired result. [PERSON] et al. (2022) [4] proposed the use of certificates issued by a CA (Certificate Authority) as an improvement to an existing password-less scheme--FIDO2 [10, 11]. Considering that FIDO2 is dependent on hardware tokens and does not offer account recovery options besides registering at least a second token as backup, making it an expensive proposition, [PERSON] et al. (2022) [4], in their work, describe how certificates can address this gap, allowing users to potentially achieve password-less nirvana by combining a hardware token and a software authenticator, where the token is responsible for managing authenticators rather than authentication itself. However, it is crucial that users register a backup token for account recovery purposes; the difference between this and FIDO2 is that only a single backup token is needed, rather than multiple tokens in the case of FIDO2. A major weakness of password-based systems is that anybody in possession of the password can access the resource as it is not \"tied\" to the user. [PERSON] et al. (2022) [12] proposed to create a link between a user and their password using RFID such that even if someone else was in possession of that same password, they would not be authenticated as the user. According to [PERSON] et al. while setting their password, the user's body gives off bioelectrical signals that are captured and mapped to the password, such that the password does not have to be secret. Like earlier proposed brain-based and iris authentication systems, special hardware is required to capture the user's body signals during enrolment. Further, the authors describe that \"during the registration phase, users need to provide multiple sets of data (a minimum of 20 sets) as training data\" [12], which suggests that the system might be infeasible to replace the password on a large scale without additional research. Mobile operating systems have been observed to implement password-less authentication schemes, where the user authenticates by drawing patterns by joining dots on a grid of the device. [PERSON] et al. (2022) [13] built upon this concept and proposed an improved system based on a grid made up of different shapes like circles, stars, and triangles, instead of static dots. Further, the shapes change as the user draws the unlock pattern, making the system more secure. While this scheme is designed to work only on mobile devices (Android based), we argue that the scheme is also low on usability, like strong passwords of great length that users will find challenging to keep in memory and write in a text file. Another mobile technology that is considered to replace the password is SIM. [PERSON] and [PERSON] (2023) [14] proposed an expanded use of the SIM beyond authenticating users to mobile networks, considering that the technology is also capable of authenticating other digital resources and currently has a spare capacity that can be deployed for this purpose.