FIDO Alliance Vision and Updates

All Rights Reserved | FIDO Alliance | Copyright 20171
TOKYO SEMINAR, DECEMBER 2018
FIDO Alliance VISION and UPDATES
BRETT MCDOWELL
EXECUTIVE DIRECTOR

Data breaches in 2016
that involved weak,
default, or stolen
passwords (VDBR)
81%
Phishing attacks were
successful in 2016
(VDBR)
Breaches in 2017, a 45%
increase over 2016
(ITRC)
1 IN 14
1,579
Annual cost to a large
organization for
password resets
(Forrester)
$1M/YR
Of helpdesk calls are
for password resets
(at $70/reset)
Password-driven cart
abandonment rate (Visa)
20-50%
49%
MEASURING THE COST OF PASSWORDS

FIDO Alliance is the global industry
collaboration dedicated to solving the
password problem
…with no dependency on “shared secrets”

Open Standards
Public Key Cryptography
Single Gesture
Phishing Resistant MFA
SECURITY
USABILITY
Poor Easy
WeakStrong

OLD AUTHENTICATION WITH PASSWORDS
DeviceSomething Authentication
Internet
Password could be stolen
from the server
1Password might be entered
into untrusted App / Web-
site (“phishing”)
2
Too many passwords to remember
(>re-use / cart Abandonment)
3
Inconvenient to type
password on phone
4

NEW AUTHENTICATION WITH FIDO
AuthenticatorUser verification FIDO Authentication
Require user gesture
before private key can
be used
Challenge
(Signed) Response
Private key (handle)
per account Public key
No secrets stored on the
server
1
Authenticator cannot be
“tricked” by phishing
2
Nothing to remember, no friction
added to transaction process
3
Single gesture
convenience for User
4

FIDO SPECIFICATIONS (2014 – 2018)
Passwordless Experience (UAF & FIDO2)
Authenticated Online
3
Biometric User Verification*
21
?
Authentication Challenge Authenticated Online
3
Second Factor Challenge Insert Security Key* /
Press Button
Second Factor Experience (U2F & FIDO2)
*There are other types of authenticators
21

WHO IS USING FIDO TODAY?
(Sample of deployments in production around the world)

BACKED BY CERTIFICATION (>500)
• Functional Certification (End-to-End):
• Conformance Testing
• Interoperability Testing
• Authenticator Security Certification Levels
• How well do you protect the private key?
• 3rd-party laboratory verification
• Complimented by new Biometric Component certification
• Universal Server:
• Ensures compatibility with all FIDO Certified Authenticators

WHAT’S NEW?

*NEW* FIDO IS NOW AN ITU STANDARD
x.1277 -- ITU ratification of FIDO UAF
x.1278 -- ITU ratification of FIDO2 CTAP (includes CTAP1/U2F)

12
*NEW* FIDO2 CERTIFICATIONS
• The first 20+ FIDO2 Certified products were
introduced September 26
• This week the latest FIDO2 Certified products
were announced, including offerings from
these companies based in Japan:

*NEW* FIDO IS A W3C SPECIFICATION (CR)
FIDO2 (CTAP & W3C Web Authentication)

*NEW* FIDO NOW IN THE WEB BROWSER & OS

*NEW* WELCOME YAHOO! JAPAN TO THE BOARD
FIDO Board Level Leadership from Japan
2015.5~ 2017.5~Today

FIDO ALLIANCE BOARD MEMBERS
BALANCE OF TECHNOLOGY & SERVICE COMPANIES
Yahoo! Japan has become a Board member

IN SUMMARY… SECURE BY DESIGN
Based on public
key cryptography
No server-side
shared secrets
Keys stay
on device
No 3rd party in
the protocol
Biometrics, if used,
never leave device
No link-ability between
services or accounts

18
IN SUMMARY… SECURE IN PRACTICE
85,000
employees
over 18 months
No ATO’s from
phishing since
using FIDO

Internet Day 2018:
“If I could start over again I would have
introduced a lot more strong authentication
and cryptography into the system. It is good
to see new internet standards from FIDO
Alliance and W3C filling that gap.”
-- Vint Cerf, Co-Inventor of the Internet

THANK YOU
WWW.FIDOALLIANCE.ORG

FIDO Alliance Vision and Updates

More Related Content

What's hot

Similar to FIDO Alliance Vision and Updates

More from FIDO Alliance

Recently uploaded

FIDO Alliance Vision and Updates

Editor's Notes