To Change Authentication Online by: (a) Developing unencumbered Specifications that define interoperable mechanisms that supplant reliance on passwords (b) Operating programs to help ensure industry adoption (c) Submitting mature Specifications for formal standardization
FIDO Alliance’s Role… “Paper” Specifications Interoperability and Conformance testing Trademark licensing against criteria Thought leadership, nurture ecosystem The Alliance does not ship products! Implementations left to commercial vendors
Why Authentication is Cybersecurity Priority #1 Poor authentication mechanisms are a commonly exploited vector of attack by adversaries; the 2013 Data Breach Investigations Report (conducted by Verizon in concert with the U.S. Department of Homeland Security) noted that 76% of 2012 network intrusions exploited weak or stolen credentials. -- NIST Roadmap for Improving Critical Infrastructure Cybersecurity,12-Feb-2014
Today’s Passwords REUSEDPHISHEDKEYLOGGED
Today’s Password Alternatives One Time Codes with SMS or Device SMS USABILITY DEVICE USABILITY USER EXPERIEN CE STILL PHISHABL E Coverage | Delay | CostOne per site | $$ | FragileUser find it hardKnown attacks today
Major Industry Trend Simpler, Stronger Local Device Auth PERSONAL DEVICES LOCAL LOCKING NEW WAVE: CONVENIENT SECURITY Carry Personal Data Pins & Patterns today Simpler, Stronger local authentication
Putting It Together The problem: Simpler, Stronger online The trend: Simpler, Stronger local device auth Why not: Use local device auth for online auth? This is the core idea behind FIDO standards!
FIDO Experiences LOCAL DEVICE AUTHSUCCESS ONLINE AUTH REQUEST PASSWORDLESS EXPERIENCE (UAF standards) SECOND FACTOR EXPERIENCE (U2F standards) Show a biometric Transaction Detail Done Login & Password Insert Dongle, Press button Done
State of Market Adoption
Version 1.0 is in Public Review
13+ products have participated in and satisfied the requirements of our testing program and are conferred the right to use the FIDO Ready™ mark.
OEMs SHIPPING FIDO-READY ™ PRODUCTS New and existing devices are supported OEM Enabled: Samsung Galaxy S5 OEM Enabled: Lenovo ThinkPads with Fingerprint Sensors Clients available for these operating systems : Software Authenticator Examples: Voice/Face recognition, PIN, QR Code, etc. Aftermarket Hardware Authenticator Examples: USB fingerprint scanner, MicroSD Secure Element
First FIDO Deployment already live… Customers can use their finger to pay with PayPal from their new Samsung Galaxy S5 because the FIDO Ready™ software on the device securely communicates between the fingerprint sensor on their device and PayPal’s service in the cloud. The only information the device shares with PayPal is a unique cryptographic “public key” that allows PayPal to verify the identity of the customer without having to store any biometric information on PayPal’s servers.
From July 2014… Alipay – formerly a part of Alibaba Group in China Processed $519 Billion in transactions in 2013 Launched FIDO-based payments using Galaxy S5
How it works
FIDO Registration REGISTRATION BEGINSUSER APPROVAL REGISTRATION COMPLETENEW KEY CREATED USER APPROVAL KEY REGISTERED 12 Using Public key Cryptography 43
FIDO Login LOGINUSER APPROVAL LOGIN COMPLETEKEY SELECTED LOGIN CHALLENGE LOGIN RESPONSE Login Using Public key Cryptography
Decouple User Verification Method from Authentication Protocol LOGINUSER APPROVAL REGISTRATION COMPLETEKEY SELECTED LOGIN CHALLENGE LOGIN RESPONSE Leverage public key cryptography ONLINE SECURITY PROTOCOL PLUGGABLE LOCAL AUTH
No 3 rd Party in the Protocol
No secrets on Server side
Key Benefit for Service Providers
FIDO’s Focus on User Privacy Biometric data (if used) never leaves device No link-ability between Services No link-ability between Accounts
Call to Action FIDO is ready for use o launch a Proof-of-Concept & Pilot Get involved: o Adapt your strategy & roadmap to include FIDO o Join the Alliance – we are non-profit & volunteer Contact Brett McDowell –