Downloaded 55 times
More Related Content
Similar to FIDO Alliance - Simpler Stronger Authentication.pptx
FIDO Alliance - Simpler Stronger Authentication.pptx
- 1. © FIDO Alliance2025 1 © FIDO Alliance 2025 1 FIDO Alliance: Simpler, Stronger Authentication Andrew Shikiar CEO and Executive Director FIDO Alliance
- 2. © FIDO Alliance2025 2 What is the FIDO Alliance? The FIDO Alliance is an open industry association with a focused mission: reduce the world’s reliance on passwords.
- 3. © FIDO Alliance2025 3 Backed by 300+ global tech leaders + Sponsor members + Associate members + Liaison members + Government members
- 4. © FIDO Alliance2025 4 The FIDO Alliance works to fulfill its mission through… Define an open, scalable, interoperable set of mechanisms that reduce the reliance on passwords Technical Specifications Industry Certification Programs Market Adoption Programs Ensure interoperability, security and usability of products, services and components Promote the use of FIDO globally to drive adoption and education
- 5. © FIDO Alliance2025 5 FIDO since 2013: Simpler and stronger Security Usability Poor Easy Weak Strong = Open standards for simpler, stronger authentication using public key cryptography – Single Gesture – – Possession-based – – Phishing-resistant –
- 6. © FIDO Alliance2025 6 The global cost of online fraud surpassed $1 trillion in 2023. source: Global Anti-Scam Alliance New Zealand media company: Hackers directly targeting individuals after alleged data breach Phishing Emails Targeting Australian Firms Rise by 30% in 2024 Australian Organisations Targeted by Phishing Attacks Disguised as Atlassian Attacks in ANZ (and globally) continue to grow.. Nearly 13 million Australians impacted by MediSecure data breach
- 7. © FIDO Alliance2025 7 81% 43% 76% When our primary factor is passwords… Easily phished or socially engineered, difficult to use and maintain of hacking-related breaches are caused by weak or stolen passwords (Ping Identity) Gave up on a purchase because they forgot their password (FIDO Alliance) Rise in direct financial loss from successful phishing attacks from 2022-2023 (Proofpoint) 64% either use weak passwords or repeat variations of passwords (Keeper) The foundation of authentication is fundamentally flawed
- 8. © FIDO Alliance2025 8 Often still phishable, socially engineered, difficult to use and maintain The art of MFA Bypass: How attackers regularly beat two-factor authentication 4 Ways Hackers use Social Engineering to Bypass MFA …then our additional layers – while well-intended and necessary – are there to cover up password problems Multifactor Authentication Bypass: Attackers Refine Tactics: During the first quarter of 2024, nearly half of all security incidents involved MFA. New MFA-bypassing phishing kit targets Microsoft 365, Gmail accounts Layering on does not work
- 9. © FIDO Alliance2025 9 © FIDO Alliance 2025 9 Generative AI adds fuel to the phishing fire
- 10. © FIDO Alliance2025 10 © FIDO Alliance 2025 10 Generative AI adds fuel to the phishing fire 4151% Rise in malicious phishing emails since Q4 2022 & ChatGPT (Slashnext)
- 11. © FIDO Alliance2025 11 © FIDO Alliance 2025 11 Generative AI adds fuel to the phishing fire 4151% Rise in malicious phishing emails since Q4 2022 & ChatGPT (Slashnext) 53% of consumers reported more suspicious messages and online scams in 2024 (FIDO Alliance) 30x More affordable and equally efficient compared to humans (Harvard Kennedy School)
- 12. © FIDO Alliance2025 12 A fundamental pivot is needed… If phishing is now the primary threat, a single phishing-resistant authenticator is more valuable (in most cases) than two factors which are both easily phished.
- 13. © FIDO Alliance2025 14 Phishing-Resistant Authentication with Passkeys User verification Require user gesture before private key can be used Authenticator FIDO Authentication Private key dedicated to one app Public key stored at service provider Private key can be securely synchronized across devices
- 14. © FIDO Alliance2025 15 © FIDO Alliance 2025 15 The State of Adoption
- 15. © FIDO Alliance2025 16 © FIDO Alliance 2025 16 Chrome on Windows Edge on Windows Firefox on Windows Chrome on Mac Edge on Mac Safari on Mac Apps on Mac Chrome on iOS Edge on iOS Safari on iOS Apps on iOS Chrome on Android Edge on Android Apps on Android Chrome on Ubuntu Edge on Ubuntu Available Today!
- 16. © FIDO Alliance2025 17 Passkey adoption by the numbers (Since October 2022) of the world’s top 100 websites and services 20% of the world’s top 250 websites and services 12% 96%+ of active browsers 98%+ of mobile devices 15B More than accounts can now leverage passkeys for sign in
- 17. © FIDO Alliance2025 18 Microsoft • 99% completion rate for passkey enrollment • 98% sign-in success rate • 3x faster sign-ins over passwords • 9x faster sign-ins over password + MFA PlayStation • 24% reduction in sign-in time on web • 29% of password resets resulted in passkey conversion, removing passwords completely • 88% of users engaging with passkey content completed the transition and eliminated their passwords Mercari • Sign-in success rate grew from 67.7% (SMS 2FA) to 82.5% – over a 21% improvement • Authentication time decreased from 17s (SMS 2FA) to 4.4s – nearly 4x faster • ZERO phishing incidents Air New Zealand • 30% opt-in in first 24 hours • 4.7x improvement time to complete & improvement in success rate • 50% reduction in abandonment rates • Reduced account recovery calls and call center attacks Consumer Adoption Snapshots
- 18. © FIDO Alliance2025 19 Passkey awareness is increasing Source: FIDO Alliance 57% of consumers are aware of passkeys – up from 39% in 2022 68% of organizations say passkey deployment is a high or critical priority
- 19. © FIDO Alliance2025 20 IBM • Conditional MFA approach, introduced synced passkeys June 2022 in addition to pre-existing device-bound passkeys • Prioritizing user education and adoption with education and manager incentives • Determines use of synced vs device-bound passkey via appropriate assurance level Alibaba • 19k employees actively using passkeys (10% increase from 2023) • 50,000 passkey requests weekly • 1,000,000 fewer 2FA texts in past year • User-reported issues have significantly decreased T-Mobile • 200,000+ YubiKeys deployed for employees, vendors and partners • Replaced passwords and OTPs with device-bound security keys for passwordless authentication • Deployment completed in under three months • Reduced phishing incidents, improved cybersecurity efficiency DocuSign • 20% reduction in password reset costs just 3-4 months post-rollout • Resulted in increases in Net Promoter Scores • Reduced documented customer complaints about login flows Enterprise Adoption Snapshots
- 20. © FIDO Alliance2025 21 myGov • Deployed in June 2024 • Adoption increased by 750% in first 8 weeks • 170,000 users by August 2024 • Adoption continues to rise as user education improves and more government agencies integrate passkeys into their systems UK NHS • 20+ services with sign-in integrated • 250,000 FIDO authorization requests a week • 25,000 new users per week with FIDO UAF biometric authentication • Reduced SMS OTPs by two-thirds, yielding significant cost savings USDA • Workforce device-bound passkey rollout in 2024 • Two device-bound FIDO options were piloted • 600+ applications protected from advanced MFA bypass techniques by using FIDO authentication in SSO system Taiwan Ministry of the Interior • TW FidO launched with UAF in 2019, and updated with FIDO2 to integrate with Mobile Citizen Digital Certificate in 2022 • Free PKI for Taiwanese businesses and agencies to accelerate adoption • 200+ apps from central & local governments, telecom and financial service providers as of June 2024 Government Adoption
- 21. © FIDO Alliance2025 22 UK NHS • 20+ partners and services integrated with NHS login • 250,000 FIDO authorization requests a week • 25,000 new users per week with FIDO UAF biometric authentication set up • Reduced SMS OTPs by two-thirds (1.5 per user per month from 4) yielding significant cost savings USDA • Workforce passkey rollout in 2024 • Two device-bound FIDO options were piloted • 600+ applications protected from advanced MFA bypass techniques by using FIDO authentication in SSO system myIR: Inland Revenue myIR passkeys launched in October 2024 • Users can authenticate using biometrics or device-based security features • Simplify access to tax- related services while improving security Michigan.gov MiLogin service with millions of public users, employees, contractors and partners: • Abandonment rates dropped from 85% to 13% • 34.7% Reduction in registration time • 30% Reduction in IT help desk calls Government Adoption Snapshots
- 22. © FIDO Alliance2025 23 © FIDO Alliance 2025 23 What FIDO is Doing Beyond Passkeys...
- 23. © FIDO Alliance2025 24 1 out of 4 reported feeling discrimination when using biometric face verification technologies. – FIDO Alliance Remote IDV Report, 2024 MGM Resorts Hackers Broke In After Tricking IT Service Desk Security Firm Accidentally Hires North Korean Hacker, Did Not KnowBe4 …strong IDV can detect deepfakes and improve IDV accuracy… – liveness and bias testing are needed to assure security, usability, and equity 'I was misidentified as shoplifter by facial recognition tech' How Wrongful Arrests Based on AI Derailed 3 Men's Lives Deepfakes and bias are problems today
- 24. © FIDO Alliance2025 25 © FIDO Alliance 2025 25 Account Lifecycle: Risks today Account Enrollment & Identity Verification Knowledge-based authentication Synthetic IDs Fabricated biometrics Injection attacks Presentation attacks Biased face verification results Account Recovery & Identity Re-verification Account take over Consumer and business fraud Stolen identities Business Email Compromise User Authentication Phishing Credential stuffing Man in the Middle Spear-phishing SIM swapping Social engineering
- 25. © FIDO Alliance2025 26 • Tests for authenticity of government-issued ID documents • Verifies the authenticity of government-issued documents during initial account set up and account recovery (i.e., employees, citizens) • Complements the FIDO IDV Face Verification program FIDO IDV and Biometric Authentication Solutions Face Verification • Tests for security, bias, accuracy, and liveness of facial biometrics • Verifies identities using “selfie- match” technology matched to the user’s government-issued ID (i.e., employee onboarding with I-9 and passport) • Complements the IDV Document Authenticity program Document Authenticity Biometric Components • Tests for security, bias, and accuracy of biometric performance during FIDO authentication • Assures performance, interoperability, and security of biometric components used in FIDO authentication • Complements the FIDO Certified Authenticator program
- 26. © FIDO Alliance2025 27 © FIDO Alliance 2025 27 Securing the Account Lifecycle: The FIDO Approach Secure Account Enrollment Certified Remote Identity Verification Phishing-resistant User Authentication Passkeys Secure Account Recovery
- 27. © FIDO Alliance2025 28 © FIDO Alliance 2025 28 THANK YOU
Editor's Notes
- #5 The FIDO Alliance has been operating since 2013 with a mission to provide open standards for simpler, stronger authentication using public key cryptography that are: Single Gesture Possession-based Phishing-resistant
- #6 Layering on does not work That being said, 2FA certainly is out there, and, yes, is much better than a password alone. However, legacy forms of 2FA are a bandaid to try and stem the damage from the flawed primary factor. It’s little wonder that we’re seeing damaging MFA bypass attacks that leverage a combination of social engineering and traditional phishing to access enterprise systems and/or user accounts. We saw this coming last year and were sadly correct. And from what we are seeing with the research predicting what's coming this year and beyond - phishing attacks are about to exponentially skyrocket – causing exponential damages. Phishing Emails Targeting Australian Firms Rise by 30% in 2024 Tech Republic Jan. 23, 2025 https://www.techrepublic.com/article/phishing-email-attacks-rise-australia/ Sophisticated Phishing Attack Bypasses Microsoft ADFS MFA Infosecurity Magazine Feb 4, 2025 https://www.infosecurity-magazine.com/news/phishing-attack-bypasses-microsoft/ Australian Organisations Targeted by Phishing Attacks Disguised as Atlassian IT Security News Sept 27 2024 https://www.itsecuritynews.info/australian-organisations-targeted-by-phishing-attacks-disguised-as-atlassian/
- #7 The foundation of authentication systems is rooted in passwords, which are increasingly proving to be fundamentally flawed. Relying on passwords as the primary factor of authentication has led to significant negative security and usability outcomes. The vast majority of hacking-related breaches stem from weak or stolen passwords. This alarming reality reflects the vulnerability of password-dependent systems and the devastating impact of compromised credentials on organizational security. Beyond security concerns, password-based systems significantly hamper the user experience. Nearly half of users have abandoned purchases simply because they could not remember their passwords. This highlights the direct cost of poor password usability on businesses. Phishing attacks have become increasingly successful, with dramatic rises in direct financial losses reported recently. Password vulnerabilities remain a key exploit in phishing schemes, emphasizing the dire need for stronger authentication methods. Most users either use weak passwords or reuse variations of the same password across multiple platforms. This widespread practice undermines security, enabling attackers to exploit credential reuse effectively. Passwords alone are no longer sufficient to ensure security in today's digital landscape. By addressing these inherent flaws, we can prioritize methods that balance strong security with better usability for individuals and organizations alike.
- #8 Layering on does not work That being said, 2FA certainly is out there, and, yes, is much better than a password alone. However, legacy forms of 2FA are a bandaid to try and stem the damage from the flawed primary factor. It’s little wonder that we’re seeing damaging MFA bypass attacks that leverage a combination of social engineering and traditional phishing to access enterprise systems and/or user accounts. We saw this coming last year and were sadly correct. And from what we are seeing with the research predicting what's coming this year and beyond - phishing attacks are about to exponentially skyrocket – causing exponential damages.
- #9 Since the launch of ChatGPT in the Fall of 2022, we’ve seen phishing continue to rise and rise to exponential rates that quite frankly are hard to measure.
- #10 Since late 2022, we have seen this type of trendline, and everything from credential phishing to targeted smishing is on the rise, for a cumulative percentage of 4151% since generative AI tools have been available to the public – and threat actors.
- #11 And phishing as an attack vector is predicted to get exponentially worse in 2025. Per the Harvard Kennedy school, today’s AI tools are as efficient as humans but are 30x more affordable. Knowing threat actors always take the easiest, cheapest path – this foreshadows the types of spikes in phishing attacks and password-related breaches we expect to see in the next few years. Meanwhile, consumers are noticing the uptick as well. In the independent research we’ve conducted at the FIDO Alliance in 2024, over half of consumers reported an increase in suspicious messages and phishing emails in the last year.
- #12 If phishing is now the primary threat, a single phishing-resistant authenticator is more valuable (in most cases) than two factors which are both easily phished. What if we could replace the outdated legacy model of “password + something else” and could replace it with a single factor that was much more secure – and easier to use?
- #13 Today’s FIDO authentication standard has the same underlying FIDO protocols with new syncing capability and terminology – the “Passkey.” What is a passkey? A passkey is any passwordless FIDO credential. Passkeys are a password replacement based on FIDO protocols that provide faster, easier, more secure sign-ins to online services. A passkey may be synced across a secure cloud so that it’s readily available on all of a user’s devices, or it can be bound to a dedicated device such as a FIDO security key. Passkeys can by synced – as is typical for large-scale implementations; and/or device-bound – typically on a security key or native app. Passkeys are 4x simpler to use since they don’t need to be remembered or typed. You just use your fingerprint, face scan, or screen lock to sign in across all your devices and platforms.
- #14 Same approach – with new syncing capabilities We always need a device in the middle, we call this the authenticator Step 1 - Local interaction between the user and authenticator – we call this user verification On the front end, we are very flexible – we require some user gesture and that gesture is verified by the authenticator directly Facial recognition, local PIN entry, security key – but we will talk more about the user experience in a minute Step 2: Once the user is verified by the authenticator, which lives on your personal device, the authenticator then authenticates you to the service. Not using your information or the evidence of who you are, but actually using public key cryptography. What’s beautiful about public key cryptography is you don’t ever have to give away your private key (your secret), with asymmetric cryptography – which is what we use – you use that private key to sign a challenge : proof of possession that you have the right private key. The service provider verifies that it is correct with the corresponding public key. Unique key pairs for each service – this is essential for privacy. No global identifiers with FIDO. Simple change of architecture turns the model upside down. The only thing now that is stored on a server are the public keys, which aren’t useful for scalable attack.
- #17 Clearly, the passkey vision has resonated with the marketplace. Passkey adoption by the numbers 20% of the world’s top 100 websites and services 96%+ of active browsers More than 13B accounts can now leverage passkeys for sign in. 12% of the world’s top 250 websites and services. 98%+ of mobile devices This all starts with addressable users, which is enabled by end point support. Thanks to collaboration with W3C and through support of major OS vendors, virtually every modern computing device can support passkeys.
- #18 Passkeys have been globally adopted and can also support a variety of consumer use cases. These are some of the thousands of companies have deployed passkeys for their consumers and end users. TikTok Within the first few months… • 97% login success rate • 14% eligible user adoption rate • 2% reduction in SMS OTP login Docusign • 20% reduction in password reset costs just 3-4 months post-rollout • Resulted in increases in Net Promoter Scores • Reduced documented customer complaints about login flows Mercari Sign-in success rate grew from 67.7% (SMS 2FA) to 82.5% – over a 21% improvement Authentication time decreased from 17s (SMS 2FA) to 4.4s – nearly 4x faster ZERO phishing incidents Air New Zealand 30% opt-in in first 24 hours 4.7x improvement time to complete & improvement in success rate 50% reduction in abandonment rates Reduced account recovery calls and call center attacks
- #19 As a result, we are seeing consumer awareness is increasing since passkeys were made available in 2022. According to one of our recent surveys of 10,000 consumers, 57% of consumers are now aware of passkeys – which is up from 38% in 2022. And 68% of organizations say passkey deployment is a high or critical priority.
- #20 IBM Conditional MFA approach, introduced synced passkeys June 2022 in addition to pre-existing device-bound passkeys Prioritizing user education and adoption with education and manager incentives Determines use of synced vs device-bound passkey via appropriate assurance level Alibaba 19k employees actively using passkeys (10% increase from 2023) 50,000 passkey requests weekly 1,000,000 fewer 2FA texts in past year User-reported issues have significantly decreased T-Mobile 200,000+ YubiKeys deployed for employees, vendors and partners Replaced passwords and OTPs with device-bound security keys for passwordless authentication Deployment completed in under three months Reduced phishing incidents, improved cybersecurity efficiency Docusign Passkeys for enterprise customers 20% reduction in password reset costs just 3-4 months post-rollout Resulted in increases in Net Promoter Scores Reduced documented customer complaints about login flows
- #21 We're pretty proud of these government agencies – which are modern success stories demonstrating how the government and their users can strengthen and accelerate sign-ins with FIDO authentication. Australia MyGov deployment: launched in July 2024, now serves approximately 26 million active accounts, making this one of the largest-scale government adoptions of passkey technology globally Integrating passkeys into a system that links multiple critical services (Centrelink, ATO, Medicare) demonstrates the feasibility of implementing advanced security measures across complex government platforms UK National Health Services US Dept of Agriculture Taiwan Ministry of the Interior - TW FidO unique free PKI = 200+ apps as of June 2024 Michigan.gov - State of Michigan Department of Technology, Management, and Budget Gov.uk Verify US Login.gov City of Virginia Beach, VA Canadian Digital Service Korea National Tax Service Korea Ministry of the Interior and Safety
- #22 Finally, not to be outshone by the consumer and enterprise success stories, we're pretty proud of these government agencies – which are modern success stories demonstrating how the government and their users can strengthen and accelerate sign-ins with FIDO authentication. US Dept of Agriculture UK National Health Services Michigan.gov (State of Michigan Department of Technology, Management, and Budget) Gov.uk Verify US Login.gov City of Virginia Beach, VA Canadian Digital Service Korea National Tax Service Korea Ministry of the Interior and Safety Taiwan Ministry of the Interior
- #24 Today, we’re faced with pressing issues: the rise of deepfakes and the real dangers of bias in biometric systems. These challenges highlight the urgent need for strong Identity Verification (IDV) solutions that can effectively detect deepfakes, ensuring accuracy while also addressing bias. Deepfakes pose a significant threat, capable of tricking even the most secure systems. Recent incidents, such as the hiring of a North Korean hacker by a security firm and hackers infiltrating MGM Resorts by socially engineering their help desk with a vishing attack, underscore the potential for identity deception that could undermine security protocols. Moreover, the implementation of AI in identification processes has sparked controversy. Cases of wrongful arrests due to misidentification by facial recognition technology have devastated lives, raising serious questions about the fairness and reliability of these systems. Alarmingly, a FIDO Alliance study found that one in four users felt discriminated against when utilizing biometric face verification technologies. To navigate these complexities of security, usability, and equity, we must prioritize liveness detection and conduct comprehensive bias testing. This will not only assure confidence in IDV systems but also foster a commitment to creating safe and equitable digital environments for all users. -- Source: FIDO Alliance Remote ID Verification – Bringing Confidence to Biometric Systems Consumer Insights 2024 Report. https://fidoalliance.org/wp-content/uploads/2024/05/Consumer-Insights-2024-May292024.pdf
- #25 User Authentication The most vulnerable point of the account lifecycle is user authentication. Phishing, credential stuffing, man-in-the-middle attacks, and social engineering tactics, such as spear-phishing and SIM swapping, continue to compromise user credentials and undermine account security. These increasingly sophisticated attack vectors exploit traditional authentication methods like passwords and temporary codes, making them insufficient in today’s threat landscape. So passkeys are critical as they block many of these threats, but they’re only part of the picture. Account Enrollment / Identity Verification Risks don’t stop at authentication—they also begin at account enrollment, where weak identity verification creates major vulnerabilities. Attackers use synthetic IDs, fabricated biometrics, and injection attacks to bypass identity verification processes. Presentation attacks and biased face verification systems further compound the problem, leading to accounts created with fraudulent or stolen identities. This is particularly concerning as such flaws allow attackers to establish seemingly legitimate account footholds. Account Recovery / Identity Re-verification Account recovery, often seen as a back door for hackers, inherits vulnerabilities from both previous stages. Poor enrollment and authentication practices expose recovery processes to account takeovers through stolen identities and/or fabricated credentials. These incidents result in significant consumer and business fraud, emphasizing the need for robust re-verification mechanisms.
- #26 Our three related certification programs— for Face Verification, Document Authenticity, and Biometric Components—are designed to establish the highest standards for secure, private, and equitable biometric systems. our Document Authenticity program, which meticulously verifies the authenticity of government-issued identification documents. This is vital during both initial account setups and recovery processes. Whether for employees or citizens, this program fortifies the identity verification lifecycle, making it increasingly difficult for fraudulent documents to compromise security. Complementing this is our Face Verification program, which rigorously tests for security, bias, accuracy, and liveness of facial biometrics. By utilizing “selfie-match” technology, it ensures identities are verified against official government-issued IDs, such as during employee onboarding processes. This is critical in combating the threats posed by deepfakes and ensuring that our systems are resistant to the nuanced tactics of identity spoofing. Lastly, we have the Biometric Component certification program, which tests for accuracy, performance and bias in biometric products. This certification program assures that technology meets the highest benchmarks for each biometric modality used to ensure the biometric component can reliably verify identities. Each of these FIDO programs works in concert, setting a new standard across the marketplace. They emphasize not only the importance of robust security but also the need for equitable access and treatment in biometric identification processes. As reports of discrimination and misidentification from biometric technologies continue come out in the news headlines, the FIDO Alliance is taking action to address the emerging requirements for bias testing and liveness detection to fostering trust and safety with biometric technology. As we look ahead to how the global landscape is evolving in the next years, especially in the age of AI, the FIDO Alliance is focused on the assurance of not only security but also privacy and fairness in our passwordless future. Our commitment to establishing these benchmarks is essential for all stakeholders – the people, organizations, and governments using passkeys and biometrics to verify identities and authenticate users – that biometrics can be harnessed securely and effectively in our global society. Together, we can build a future where identity verification is not only reliable but also equitable for everyone.
- #27 So coming back to where we started – FIDO is deeply committed to securing the entire account lifecycle, and I encourage all of you to think in the same holistic way. We’ve made and will continue to make great headway on putting passwords in the rearview mirror, but it is becoming increasingly important to look at your security at the point of account creation as well – which ultimately de-risks account recovery, which currently serves as an open door for social engineers to make mayhem. Click FIDO Alliance has certification programs to address each of these steps, with dozens of interoperable b2b solutions that businesses can use to start hardening their identity infrastructure today. In today's fast-evolving digital landscape, leaders can leverage FIDO standards and certification to enhance resilience throughout the account lifecycle. This approach significantly mitigates risks associated with identity verification, user authentication, and account recovery. By focusing on these three critical phases - account creation, user authentication, and account recovery - security teams can ensure that accounts are established only for individuals with verified identities. They can also provide strong, phishing-resistant authentication for every login and prevent unauthorized access during recovery or re-verification processes. Starting with the Account Enrollment phase, users now require secure and efficient remote identity verification. Given the multitude of password-related vulnerabilities leading to costly breaches for organizations and serious fraud risks for individuals, the FIDO Alliance is at the forefront of securing user authentication. Moving to Account Recovery, this phase is critical when taking the FIDO approach to Account Lifecycle Management. With the cornerstones of remote identity verification and phishing-resistant authentication in place - secure recovery processes can be established to form a strong, rock-solid foundation for complete account lifecycle management. In a passkey-driven ecosystem, effective account recovery demands FIDO Certified, standards-based solutions to promptly and safely re-verify a user’s identity. This process involves utilizing FIDO authenticators, including certified hardware and software, biometric components, and identity verification tools that align with the FIDO Certification programs for Face Verification and Document Authenticity. The FIDO approach to account lifecycle management prioritizes the integration of open standards and thorough certification protocols to tackle contemporary challenges, such as deepfakes, identity spoofing, and bias in biometrics. With FIDO Certified programs like Document Authenticity and Face Verification, solutions undergo rigorous independent testing for liveness detection, document authenticity, and selfie matching. This testing guarantees an exceptional level of security, trust, and compliance readiness. By merging security, accuracy, privacy, and equity, FIDO sets the benchmark for secure, trusted, and inclusive identity verification and authentication solutions. Through these advancements, we are not just enhancing security but also building resilience within the digital economy to confront today's most urgent threats.
- #28 Thank you!