CIS13: Fast IDentity Online (FIDO) Enables Better Authentication for the Open Mobile Ecosystem
15
Introducing Standards for Simpler Stronger Authentication
-
Upload
cloudidsummit -
Category
Technology
-
view
931 -
download
1
description
Brett McDowell, Senior Manager, Ecosystem Security, PayPal The mobile ecosystem needs simple and strong authentication capabilities that provide better user experiences—and better security—than today's passwords, PINs or OTPs.The FIDO Alliance members are working together to develop an open, interoperable, standards-based ecosystem that will enable seamless integration of online services with any certified authentication solution (such as biometrics on mobile devices). Find out what use cases FIDO addresses and how your organization can be an early beneficiary of this game-changing initiative.
Transcript of CIS13: Fast IDentity Online (FIDO) Enables Better Authentication for the Open Mobile Ecosystem
Introducing
Standards for Simpler Stronger Authentication
Goal: Simpler Stronger Auth
INTERNET SERVICES COMPONENT & DEVICE VENDORS SOFTWARE & STACKS
User Auth Online
Do you want to login?
Do you want to transfer $100 to Joe?
Do you want to ship to a new address?
Do you want to delete all of your emails?
Do you want to share your dental record?
Auth today: Ask user for a password (and perhaps a one time code)
Passwords Too many to remember, difficult to type,
and not secure
REUSED PHISHED KEYLOGGED
One Time Codes Improves security but not easy enough
SMS USABILITY
DEVICE USABILITY
USER EXPERIENCE
STILL PHISHABLE
Coverage | Delay | Cost One per site | Fragile User confusion Known attacks today
Megatrend Easy Local Device Auth
PERSONAL DEVICES LOCAL LOCKING NEW WAVE: CONVENIENT SECURITY
Carry Personal Data Pins & Patterns today Easy local device auth
2F
Putting it together
The problem: Easy, Safe online auth
The trend: Easy, Safe local device auth
Why not: Use local device auth for online auth?
This is the core idea behind FIDO standards!
FIDO Experiences LOCAL DEVICE AUTH SUCCESS ONLINE AUTH REQUEST
PASSWORDLESS EXPERIENCE
SECOND FACTOR EXPERIENCE
Show a biometric Transaction Detail Done
Login & Password Insert Dongle, Press button Done
FIDO Registration REGISTRATION BEGINS USER APPROVAL
REGISTRATION COMPLETE NEW KEY CREATED
USER APPROVAL
KEY REGISTERED
1 2
Using Public key
Cryptography
4 3
FIDO Login LOGIN USER APPROVAL
LOGIN COMPLETE KEY SELECTED
LOGIN CHALLENGE
LOGIN RESPONSE
1 2
4 3
Login
Using Public key
Cryptography
FIDO Standardization LOGIN USER APPROVAL
REGISTRATION COMPLETE KEY SELECTED
LOGIN CHALLENGE
LOGIN RESPONSE
1 2
4 3
Leverage public key cryptography
ONLINE CRYPTO PROTOCOL
PLUGGABLE LOCAL AUTH
2F
Options for Internet Services
UAF: Universal Auth Framework
• User carries client device with UAF
stack installed • User presents a local biometric or PIN • Website can choose whether to retain
password
Simpler Stronger Authentication
U2F: Universal Second Factor
• User carries U2F device with built-
in support in web browsers • User presents U2F device • Website can simplify password
(e.g, 4 digit PIN)
What's the Benefit?
For Users
• Easy to use • No more worrying about passwords • Be safer on the Internet
For Internet Services • Greatly improved PKI based security • Increased user engagement • User brings own device • Build server once: Leverage any auth
method
For Vendors • Standardization ignites market • Move past fragmented custom solutions
The Ecosystem
INTERNET SERVICES
COMPONENT & DEVICE VENDORS
SOFTWARE & STACKS
FIDO Today
• Technical Working Groups active o Public Spec Drafts late 2013 o Early Pilots late 2013 o Complement to existing standards & efforts
§ e.g., Federation, OpenID, SAML etc • Actively adding to FIDO membership
o Targeting Internet Services, Client Platform Owners, Device & Component Vendors, System Integrators
JOIN US!! [email protected]
Simpler Stronger Authentication
![AMD White Paper · AMD White Paper Fast Identity Online: Password-less Authentication Page 3 FIDO Protocols The FIDO Alliance[1] defines three sets of technology agnostic specifications:](https://static.fdocuments.us/doc/165x107/5ec90b805d6be622377e1997/amd-white-paper-amd-white-paper-fast-identity-online-password-less-authentication.jpg)
![T/Key: Second-Factor Authentication From Secure Hash Chains · authentication using a protocol standardized by the FIDO industry alliance [59]. Nevertheless, for desktop and laptop](https://static.fdocuments.us/doc/165x107/603f4b528f4f877fd246ec26/tkey-second-factor-authentication-from-secure-hash-chains-authentication-using.jpg)
