Introduction to FIDO Alliance by Brett McDowell, FIDO Alliance, Executive Director from the FIDO Alliance Seminar in New York City on March 3, 2016, entitled "Key Trends in Strong Authentication" The FIDO Alliance invites you to learn how simplify strong authentication for web services. FIDO specifications can help all organizations, especially service providers who want to scale these features for consumer services over the web. Essentially, FIDO offers a simple, low-cost way to improve security and the online experience.

1. INTRODUCTION TO FIDO ALLIANCE
FIDO Seminar, New York City, 31 March 2016
Brett McDowell, Executive Director
brett@fidoalliance.org
All Rights Reserved. FIDO Alliance. Copyright 2016.

2. The Problem
The Solution
The Alliance
The Market

3. 781 data breaches in 2015
Data Breaches…
170 million records in 2015 (up 50%)
$3.8 million cost/breach (up 23% f/2013)

4. “A look through the details of these
incidents shows a common sequence of
phish customer ≥
get credentials ≥
abuse web application ≥
empty bank/bitcoin account.”
2015 Data Breach Investigations Report

5. The world has a PASSWORD PROBLEM
5Confidential

6. ONE-TIME PASSCODES
Improve security but aren’t easy enough to use
Still
Phishable
User
Confusion
Token
Necklace
SMS
Reliability
6Confidential

7. WE NEED A
NEW MODEL

8. WE CALL OUR
NEW MODEL
Fast IDentity Online
online authentication using
public key cryptography

9. The Problem
The Solution
The Alliance
The Market

10. THE OLD
PARADIGM
USABILITYSECURITY

11. THE FIDO
PARADIGM
Poor Easy
WeakStrong USABILITY
SECURITY

12. HOW OLD AUTHN WORKS
ONLINE
The user authenticates
themselves online by presenting a
human-readable “shared secret”

13. HOW FIDO AUTHN WORKS
AUTHENTICATOR
LOCAL ONLINE
The user authenticates
“locally” to their device
(by various means)
The device authenticates
the user online using
public key cryptography

14. Passwordless Experience (UAF Standards)
Second Factor Experience (U2F Standards)
*There are other types of authenticators
Second Factor Challenge
1
Authenticated
Online
3
Insert Dongle* / Press Button
2
Biometric Verification*
2
Authentication Challenge
1
?
Authenticated
Online
3

15. OPEN STANDARDS R.O.I.
FIDO-ENABLE ONCE
GAIN EVERY DEVICE YOU TRUST
NO MORE ONE-OFF INTEGRATIONS

16. USABILITY, SECURITY, R.O.I.
and
PRIVACY

17. No 3rd Party in the Protocol
No Secrets on the Server Side
Biometric Data (if used) Never Leaves Device
No Link-ability Between Services
No Link-ability Between Accounts

18. Better security for online services
Reduced cost for the enterprise
Simpler and safer for consumers

19. The Problem
The Solution
The Alliance
The Market

20. The FIDO Alliance is an open
industry association of over 250
global member organizations

21. Physical-to-digital identity
User Management
Authentication
Federation
Single
Sign-On
Passwords Risk-BasedStrong
MODERN
AUTHENTICATION
FIDO SCOPE

22. FIDO Alliance Mission
Develop
Specifications
Operate
Adoption Programs
Pursue Formal
Standardization
1 2 3

23. Board Members
23 23 23

24. Alliance Working Groups
Standards & Technology
1. FIDO UAF
2. FIDO U2F
3. FIDO 2.0
4. Certification
Market Adoption
5. Marketing
6. Privacy & Public Policy
7. Deployment-at-Scale
8. FIDO China
https://fidoalliance.org/working-groups

25. 25
Industry Partners
Our mission is highly
complementary to
many other
associations around
the world.
25

26. FIDO DEVELOPMENT TIMELINE
FIDO 1.0
FINALFirst
DeploymentsSpecification
Review Draft
FIDO Ready
Program
Alliance
Announced
FEB
2013
6 Members
DEC
2013
FEB
2014
FEB-OCT
2014
DEC 9
2014
MAY
2015
TODAY
>250
Members
Market
Adoption
JUNE
2015
Certification
Program
New U2F
Transports

27. The Problem
The Solution
The Alliance
The Market

28. “PayPal and Samsung Enable Consumer
Payments with Fingerprint
Authentication on New Samsung
Galaxy S5”
Feb 24, 2014
“Secure Consumer Payments Enabled for
Alipay Customers with Easy-to-Use
Fingerprint Sensors on Recently-Launched
Samsung Galaxy S5”
September 17, 2014
“Google Launches Security Key,
World’s First Deployment of Fast
Identity Online Universal Second
Factor (FIDO U2F) Authentication”
October 21, 2014
2014 FIDO ADOPTION

29. “Microsoft Announces FIDO
Support Coming to Windows 10”
Feb 23, 2015
“Qualcomm launches
Snapdragon fingerprint
scanning technology”
March 2, 2015
“Google for Work announced
Enterprise admin support for
FIDO® U2F ‘Security Key’”
April 21, 2015
“Largest mobile network in
Japan becomes first wireless
carrier to enhance customer
experience with natural,
simple and strong ways to
authenticate to DOCOMO’s
services using FIDO
standards.”
May 26, 2015
2015 FIDO ADOPTION
“Today, we’re adding Universal 2nd Factor (U2F) security
keys as an additional method for two-step verification,
giving you stronger authentication protection.”
August 12, 2015
“[T]he technology
supporting fingerprint
sign-in was built
according to FIDO
(Fast IDentity Online)
standards.”
September 15, 2015
“GitHub says it
will now handle
what is called
the FIDO
Universal 2nd
Factor, or U2F,
specification.”
October 1, 2015

30. “NTT DOCOMO is now
offering FIDO-enabled
biometric authentication for
customers using Apple iOS
devices”
Mar 7, 2016
2016 FIDO ADOPTION
“FIDO Universal 2nd Factor (U2F) authentication is now
being used to allow all UK citizens to easily and securely
access GOV.UK Verify digital public services.
Mar 23, 2016
“BC Card provides Token
and FIDO services to
strengthen security and
safety of Samsung Pay”
March 1, 2016
“KEB Hana’s new solution
is notably FIDO Certified.”
February 3, 2016

31. Deployments are enabled by
FIDO® Certified products
available today

33. Leading OEMs Now Shipping FIDO Certified Devices
Tab S, Tab S2S5, Mini Note 4, 5Alpha Note Edge S6, S6 Edge
Sharp Aquos Zeta Sony Experia Z5 Fujitsu Arrows
(Iris Biometrics)
Samsung
LG V10 & G5

34.  Available to anyone
 Ensures interoperability
 Promotes the FIDO
ecosystem
Steps to certification:
1. Conformance Self-Validation
2. Interoperability Testing
3. Certification Request
4. Trademark License (optional)
fidoalliance.org/certification

35. JOIN THE
FIDO ECOSYSTEM

36. JOIN THE
FIDO ALLIANCE

37. All Rights Reserved. FIDO Alliance. Copyright 2016.
THANK YOU FOR COMING!
@FIDOAlliance
www.fidoalliance.org
brett@fidoalliance.org