Download as PDF, PPTX
![Confidential & Proprietary
Passwords are broken
Phishing has become increasingly sophisticated
● More than ⅔ of incidents [in 2015] … involved phishing. With a 23%
effectiveness rate*
● OTPs help against shared password, but it’s not safe to rely on them for
phishing
* http://www.verizonenterprise.com/DBIR/2015/
REUSED PHISHED KEYLOGGED](https://image.slidesharecdn.com/05gdasherbecomingunphishable-170628165802/85/Becoming-Unphishable-4-320.jpg)
Uploaded byFIDO Alliance
Becoming Unphishable
The document discusses the inadequacies of traditional passwords and the rise of phishing attacks, highlighting the introduction of security keys based on the FIDO U2F standard as a more secure, user-friendly authentication solution. It emphasizes Google's implementation and benefits of security keys, including faster authentication and fewer support incidents compared to one-time passwords. The document also outlines potential use cases and resources for adopting this technology.
More Related Content
More from FIDO Alliance
Becoming Unphishable
- 1. Confidential & Proprietary BecomingUnphishable Towards simpler, stronger authentication Grant Dasher CIS 2017
- 2. Confidential & Proprietary Introductionand Agenda Part of the team responsible for authentication at Google Agenda ● Passwords are broken ● Introducing Security Key ● Google’s Experience ○ Some numbers ○ We’re not quite done ● How can you get started?
- 3. Confidential & Proprietary Passwordsare broken
- 4. Confidential & Proprietary Passwordsare broken Phishing has become increasingly sophisticated ● More than ⅔ of incidents [in 2015] … involved phishing. With a 23% effectiveness rate* ● OTPs help against shared password, but it’s not safe to rely on them for phishing * http://www.verizonenterprise.com/DBIR/2015/ REUSED PHISHED KEYLOGGED
- 5. Confidential & Proprietary IsPhishing Effective?
- 6. Confidential & Proprietary Today’ssolution: One Time Passwords SMS USABILITY Coverage Issues - Delay - User Cost DEVICE USABILITY One Per Site - Expensive - Fragile USER EXPERIENCE Users find it hard PHISHABLE German Police re: iTan: ".. we still lose money"
- 7. Confidential & Proprietary IntroducingSecurity Key
- 8. Confidential & Proprietary IntroducingSecurity Key Designed to solve authentication challenges ● For enterprises ● For consumers Based on FIDO U2F standard ● Safe: Unphishable / UnMITMable ● Easy: Insert and press button ● Compact: One device, many services
- 9. Confidential & Proprietary Simpleoperation 1 2 3 Userid & Password Insert, Press button Successful Sign in
- 10. Confidential & Proprietary Basedon Asymmetric Cryptography Core idea - Standard public key cryptography ● User's device mints new key pair, gives public key to server ● Server asks user's device to sign data to verify the user. ● One device, many services, "bring your own device" enabled
- 11. Confidential & Proprietary Google’sexperience
- 12. Confidential & Proprietary Deploymentat Google ● Enterprise use case ○ Mandated for Google employees ○ Corporate SSO (Web) ○ SSH ○ Forms basis of all authentication ● Consumer use case ○ Available as opt-in for Google consumers ○ Adopted by other relying parties too: Dropbox, Github, Facebook
- 13. Confidential & Proprietary Timeto authenticate
- 14. Confidential & Proprietary Timeto authenticate Security Keys are faster to use than OTPs "If you've been reading your e-mail" takeaway:
- 15. Confidential & Proprietary SecondFactor Support Incidents
- 16. Confidential & Proprietary SecondFactor Support Incidents Security Keys cause fewer support incidents than OTPs "If you've been reading your e-mail" takeaway:
- 17. Confidential & Proprietary We'renot quite done...
- 18. Confidential & Proprietary Ongoingwork ● Wireless protocols ○ NFC, BLE ● More browsers ○ Firefox, Edge, more? ● More platforms ○ Android, Windows, OS X/iOS? ● V2 of the protocol ○ Device-centric authentication
- 19. Confidential & Proprietary Howcan you get started?
- 20. Confidential & Proprietary U2Fuse cases ● Internal enterprise authentication (B2B) Authenticate to your own web applications, mobile applications, etc ● Authenticate to your service providers (“token necklace”) U2F works well in a non-federated environment Complete isolation between various RPs ● External customer authentication Authenticate your high-value customers using U2F
- 21. Confidential & Proprietary Resources ●To use with Google Enable 2-Step Verification on your account Go to: https://security.google.com Click: 2-Step Verification Click on the Security Keys tab ● Also use with GitHub, Dropbox, Facebook ● And / or play with some code https://github.com/google/u2f-ref-code https://github.com/google/pyu2f https://developers.yubico.com/U2F/Libraries/List_of_libraries.html
- 22.