FIDO Alliance Paris Seminar 2024

1. © FIDO Alliance 2024
1 © FIDO Alliance 2024 Confidential
1
A Deep Dive on
Passkeys
Roland Atoui
Security Secretariat, FIDO Alliance

2. © FIDO Alliance 2024
2
Security
Usability
Poor Easy
Weak
Strong
=
Single Gesture
Possession-based
Phishing-resistant
Authentication
Open standards for simpler,
stronger authentication using
public key cryptography
FIDO since 2013: Simpler and stronger

3. © FIDO Alliance 2024
3
2
1
3
Provide great alternative to traditional smart card deployments in high-risk
environments
Offer phishing-resistant multi-factor authentication in a single authenticator
Increase the security of consumer two-factor authentication
The very positives …

4. © FIDO Alliance 2024
4
2
1
3
Inconvenience of physical security keys
Higher barrier to adoption for users who don’t (want to) use two-factor
authentication at all, and are stuck with passwords
Challenges with embedded authenticators as a second factor
But challenges for scale

5. © FIDO Alliance 2024
5
We haven’t solved the main problem
Because our primary factor is passwords…
of hacking-related breaches
are caused by weak or stolen
passwords
(Ping Identity)
81%
76%
gave up on a purchase because they
forgot their password
(FIDO Alliance)
43%
rise in direct financial loss from
successful phishing attacks from
2022-2023
(Proofpoint)
either use weak passwords or repeat
variations of passwords
(Keeper)
64%
Easily phished or socially engineered, difficult to use and maintain

6. © FIDO Alliance 2024
6
Focus on fixing the foundation
What if we could replace the outdated legacy model of
“password + something else” and could replace it with a single
factor that was much more secure – and easier to use?”
If phishing is now the primary threat - a single phishing-resistant
authenticator is more valuable (in most cases) than two factors
which are both easily phished.

7. © FIDO Alliance 2024
7
Enter: Synced passkeys
Passkey
/’pas, kē/
noun
A FIDO Authentication credential that provides passwordless sign-ins
to online services.
A passkey may be synced across a secure cloud so that it’s readily
available on all of a user’s devices, or it can be bound to a dedicated
device such as a FIDO security key.

8. © FIDO Alliance 2024
8
A bit deeper on new(er) terminology
A passkey is any passwordless FIDO credential
Raises the bar for both security and UX
Is most commonly synchronized across a user’s devices – but doesn’t have to be
A passkey provider might be a platform/OS vendor, or 3rd-party software
such as a password manager.
Facilitates new device bootstrapping and simplifies account recovery
Security of synced passkeys is the responsibility of the passkey provider
Live passkey providers include Apple, Google, Dashlane, 1Password

9. © FIDO Alliance 2024
9
Same standards-based approach, new capabilities
User verification
Require user gesture before
private key can be used
Authenticator
FIDO
Authentication
Private key dedicated
to one app
Public key stored at
service provider
Private key can be securely
stored in cloud for
synchronization across devices

10. © FIDO Alliance 2024
10
Synced passkeys Device-bound passkeys

11. © FIDO Alliance 2024
11
Cross-device authentication
Enables passkeys to be
used to sign-not to
services not only on
their device, but on
nearby devices, too.
Image Credit: Google

12. © FIDO Alliance 2024
12
Stronger, More Usable – Now More Scalable
Security
Weak
Strong
Usability

13. © FIDO Alliance 2024
13
Some commonly needed clarifications
Are passkeys a new specification or standard from FIDO Alliance?
The same standards, commonly known as FIDO2 (WebAuthn and CTAP), are leveraged to deploy FIDO with
passkeys for sign-in. The WebAuthn standard covers the browser API that manages passkeys.
Are passkeys vendor-specific?
Vendors support passkeys, but the passkey sign-ins are enabled by open standards.
Are all passkeys synced?
A FIDO security key can house a device-bound passkey
Can passkeys only be used to sign-in on phones?
Passkeys can sync to multiple form factors – phone to PC, to your TV, gaming console, etc.

14. © FIDO Alliance 2024
14
Takeaways
Passkeys are…
Phishing-resistant FIDO credentials​
Add features to reduce with account recovery the need for password
resets
A superior alternative to passwords and legacy MFA, and a path
towards passwordless​
Able to drop in and ready for browsers (especially if you’re already
using WebAuthn)​
Already being used at scale! (Watch Andrew’s session to see the state
of passwordless adoption)​

15. © FIDO Alliance 2024
15 © FIDO Alliance 2024 Confidential
15
Questions?

16. © FIDO Alliance 2024
16 © FIDO Alliance 2024 Confidential
16
Thank you