Post

The Guardian is always better when you’re signed in. Benefits include the ability to comment on articles or subscribe to any of our newsletters (which cover subjects and themes in more depth) and readers on the app have access to My Guardian, where you can see stories on topics you’ve chosen to follow and stories from your favourite writers. It’s also helpful for us. Signing in allows us to learn about the usage of our digital products from signed in readers. This data helps us generate more revenue, by, among other things, enabling us to improve what we offer to our readers and subscribers, which is used to support the Guardian’s independent journalism.

If you support the Guardian, either through a subscription or regular payment or have made a recent contribution, signing in also means you will no longer see frequent messages asking you to support our journalism. For subscribers, signing in is how you get access to your paid-for features, such as ad-free browsing.

The Identity and Trust team, part of the Product and Engineering department at the Guardian, build and maintain the platform that readers use to sign in to the Guardian, and protect access to over 13 million readers’ data. Recently we’ve continued work to modernise our identity platform, further improve security around reader data, and enhance the reader experience when it comes to trusting the Guardian with their data.

The team provides unified authentication journeys across all Guardian websites and mobile apps, which all use our secure, web-based identity portal at https://profile.theguardian.com . Our readers can sign in, create an account, reset their password or delete their account through here. Using a single portal across all our applications significantly reduces the effort and development time required to integrate sign-in into new apps, like the Feast app . It also reduces the engineering effort for new sign-in features and security updates, which is key for features like passwordless, where all apps will automatically receive it, for free, without the need for other teams to integrate it later. It also guarantees privacy and safety as our journeys were designed and developed using penetration tests and security reviews.

Our aim was to improve the number of readers completing the account creation process, and for us to maintain the same number of readers continuing to authenticate after removing password authentication as the default option. This blog post covers how we’ve now removed the need for readers to have a password, and improved their authentication experience along the way.

To protect access to reader data, we have to secure the way that a reader accesses, and gives us access to, their personal information. The classic model to do this is to use a password to prove your identity. However the use of passwords is the greatest friction and security risk for our readers. The 2024 Verizon DIBR report found that for data breaches in web applications, 77% of attackers gain access via hacking with the use of stolen credentials, usually an email and password combination, while 21% of attacks used brute force, usually from easily guessable passwords.