For a while, passwordless authentication felt like the future everyone was waiting for. Phrases like “Goodbye passwords on the web” were everywhere. The idea was simple and appealing: no more forgotten passwords, no more sticky notes with logins, no more password managers, and fewer data breaches.
And to be fair, on mobile devices, we’ve gotten pretty close. Features like FaceID, TouchID, and fingerprint sensors already give us a taste of life without passwords. But on the web? Passwords still reign supreme.
That might change. Recently, I came across an experimental technology developed by researchers at the University of England called Sesame Auth. It’s an unusual but fascinating take on authentication that mixes together push notifications, public key cryptography, biometrics, and even steganography (yes, hiding data inside images). The promise is to move us one step further away from the password status quo.
Let’s unpack how it works.
Sesame Auth isn’t just a simple app; it’s an ecosystem. It consists of:
With those pieces in place, here’s the flow.
When you download the Sesame mobile app, setup feels a little strange. You pick a username and then type in your email multiple time (three times or more). It feels redundant, but this is where something clever happens.
Sesame uses those repeated inputs to measure your typing patterns, a technique called Keystroke Dynamics. By analyzing things like how quickly you hit keys and the rhythm of your typing, it generates a kind of typing fingerprint. To do this, Sesame leverages a library called TypingDNA, which creates a unique ID tied to your typing style.
That ID gets baked into a public key that the app uses whenever it communicates with the Sesame server.
Now you’re set up with the app. When you visit a website that supports Sesame, here’s how registration works:
Instead of creating a password, you’re asked to upload an image from your phone. After that, you confirm your identity with a biometric check (like FaceID or Fingerprint).
Here’s the twist though: Sesame takes that uploaded image, encrypts your Typing ID with a public key, embeds both into the image, and then sends the modified image back to your phone. To the naked eye, it’s the same picture. But hidden inside is your digital identity.
Let’s say you come back to that same website later. Here’s what login looks like:
At first glance, this just looks like a standard push notification login. But the magic is in what happens behind the scenes.
When your app contacts the Sesame server, it includes that “secret” image. Inside the image, the server finds your Typing ID and public key. It then verifies that your Typing ID matches what it has stored (encrypted with its private key). If everything checks out, you’re successfully authenticated.
Yes, on the surface this feels like a complicated way to achieve what push notifications already do. But Sesame Auth introduces some novel ideas:
It’s unusual, maybe even a little over-engineered, but definitely creative.
Will Sesame Auth become the standard for passwordless authentication? Honestly, I doubt it. While it’s an interesting leap forward, it only feels like a slight improvement over today’s approaches. Push notifications, biometrics, and WebAuthn already solve many of the same problems with fewer moving parts.
That said, Sesame Auth shows just how many different directions authentication technology can go. And who knows? Sometimes it takes an odd, experimental approach to inspire the next breakthrough.
For now, passwords aren’t dead yet—but they’re definitely on notice.