# Passwordless Authentication Using a Combination of Cryptography, Steganography, and Biometrics
## 5 Evaluation and Discussion  
The objective of this study was to ascertain the feasibility of implementing a scalable password-less authentication system that effectively reconciles security and usability, resulting in the creation of a proof-of-concept (POC) designed to address this problem. In retrospect, our findings from implementing the POC suggest that the feasibility of such a system is high. However, the system must be objectively evaluated to ensure that new compromises are not created. The framework by [PERSON] et al. [2] assesses whether the system indeed has addressed the shortcomings of password-less authentication solutions identified in their research.  
As evident in Tables 1-4, SA presents a notable advancement over memory-based passwords; however, it falls short of some of the framework's criteria. Realistically, achieving an ideal state may prove challenging in certain aspects, given that passwords themselves, as well as other existing passwordless alternatives (e.g., FIDO2), lack several of the benefits outlined in the framework. On the contrary, we submit that the benefits offered by the system are adequate to position it as a feasible passwordless authentication system.  
Figure 14: Typing pattern capture screen prompt.  
\begin{table}
\begin{tabular}{l c} \hline \hline
**Framework Benef** & **Sesame Auth (SA)** \\ \hline Accessible & A user who can use passwords can also use SA. \\ \hline Negligible-Cost-per-User & There is some negligible-fixed cost incurred in implementing SA. \\ \hline Server-Compatible & SA is compatible with text-based passwords; the server simply swaps out the authentication logic. \\ \hline Browser-Compatible & SA is browser-agnostic as users do not need to install any browser plugins/software for it to be compatible. \\ \hline \multirow{2}{*}{Mature} & SA is a proof-of-concept; it has not yet been deployed on a large scale. Therefore, it is low on this benefit. \\ \hline Non-Proprietary & SA is proprietary as implementers have to pay some negligible royalty. \\ \hline \hline \end{tabular}
\end{table}
Table 2: Evaluating SA using [PERSON] et al. deployability framework [2].  
\begin{table}
\begin{tabular}{l c} \hline \hline
**Framework Benef** & **Sesame Auth (SA)** \\ \hline Resilient-to-Physical-Observation & An attacker cannot impersonate the user by physically observing them during authentication using SA. \\ \hline Resilient-to-Targeted-Impersonation & An attacker cannot impersonate the user on SA by having any knowledge of the user’s personal data. \\ \hline Resilient-to-Throttled-Guessing & In a rate-limited scenario, an attacker cannot guess the 2048-bit RSA private keys for SA. Further, the challenge code is a cryptographic pseudo-random number that has a 1:1,000,000 relationship. \\ \hline Resilient-to-Unthrottled-Guessing & Constrained only by computing resources, it is computationally infeasible to guess 2048-bit RSA keys. Further, the attacker would need physical access to the user’s device, making SA high on this benefit. \\ \hline \hline \end{tabular}
\end{table}
Table 3: Evaluating SA using Bonneau et al. security framework (a) [2].