One of the main enablers for the escalation in cybercrime is the over-reliance on passwords. According to the FIDO (Fast Identity Online) Alliance, passwords are the root cause of more than 80% of data breaches. This is because passwords can easily be phished, intercepted in transit, and uncovered via a variety of attacks. Further, users are often overburdened with remembering passwords across, on average, 90 different online accounts. It’s no surprise then that 51% of people re-use non-complex passwords across multiple accounts. As a result, weak or re-used passwords are effortlessly accessed by criminals. So, rather than execute complex hacks, threat actors simply log in to accounts to execute cybercrimes. The good news is, there is a better way: passwordless authentication, also known as phishing-resistant Multi-Factor Authentication (MFA).

The post Axiad Blog: FIDO Series Part 1: What is FIDO Passkey and Why is it Important? appeared first on FIDO Alliance.

The post heise: Password: goodbye appeared first on FIDO Alliance.

The post PYMNTS: Delegated authentication helps speed the shift to passwordless future appeared first on FIDO Alliance.

The post The Federal: Explainer: What are passkeys, how to get them, why they’re safer than passwords appeared first on FIDO Alliance.

The post DocuSign Blog appeared first on FIDO Alliance.

The post Leaders: The slow phaseout of passwords appeared first on FIDO Alliance.

The post Security Brief: The FIDO Alliance releases UX guidelines all about passkeys appeared first on FIDO Alliance.

The post SC Media: New passkey milestones ‘ready for prime time,’ says FIDO Alliance leader appeared first on FIDO Alliance.

The post Security Intelligence: CISA, NSA Issue New IAM Best Practice Guidelines appeared first on FIDO Alliance.

The post TechRadar.pro: Bitwarden now lets you create passkeys for your business apps appeared first on FIDO Alliance.

The post Biometric Update: Consumers ready for passwordless technology and prefer biometrics; FIDO Alliance report appeared first on FIDO Alliance.

The post The Verge: 1Password is finally rolling out passkey management appeared first on FIDO Alliance.

The post PC Mag: How to Set Up Passkeys for Your Google Account appeared first on FIDO Alliance.

For this conversation, FF News’ Douglas Mackenzie is joined by Quentin Stephen of Giesecke + Devirent, Linda Weston of Barclaycard Payments and Andrew Shikiar of FIDO Alliance.

The post Fintech Finance News: Virtual Arena: Authentication in the World of Payments appeared first on FIDO Alliance.

The post Ars Technica: Passkeys may not be for you, but they <em>are</em> safe and easy—here’s why appeared first on FIDO Alliance.

The post IT Brew: At RSA, passkeys have the buzz appeared first on FIDO Alliance.

The presentation covered the following FIDO use cases for the EUDI Wallet:

• Enrollment of Person Identification Data to the EUDI Wallet with FIDO based eIDs
• Issuance of (Qualified) Electronic Attested Attributes with FIDO based eIDs
• The ISO 18013-5 mobile driving license
• PSD2 Strong Customer Authentication
• Access to remote QSCDs via the Cloud Signature Consortium API
• Access to cloud wallets, such as the Findy Agency web wallet

Presenters included:

Rayissa Armata, senior head of regulatory affairs, IDnow
Sebastian Elfors, senior architect, IDnow
Megan Shamas, senior director of marketing, FIDO Alliance

The post Video: FIDO Alliance Webinar: How to use FIDO with the EUDI Wallet appeared first on FIDO Alliance.

The post Wired: The war on passwords enters a chaotic new phase appeared first on FIDO Alliance.

The post The Verge: 1Password is finally rolling out passkey management appeared first on FIDO Alliance.

The post SC Magazine: The 2023 Identiverse Trends Report appeared first on FIDO Alliance.

The post Find Biometrics: Identity News Digest appeared first on FIDO Alliance.

The post PC Mag: How to set up passkeys for your Google account appeared first on FIDO Alliance.

The post The Wall Street Journal: Hate passwords? It’s time to try passkeys appeared first on FIDO Alliance.

“Eventually, it’s going to be like World Horse and Buggy Day, I think,” Shikiar says. “For the time being, it’s a good reminder of the challenge we have to get rid of passwords.”

The post Wired: Google is rolling out password-killing tech to all accounts appeared first on FIDO Alliance.

The post PC Mag: Misinformation, MFA Doubts, and AI: Everything We Saw at RSAC 2023 appeared first on FIDO Alliance.

The post CIO Review: Nok Nok Partners With Carahsoft to Provide Phishing-Resistant MFA Solutions to Federal, State and Local Government Agencies appeared first on FIDO Alliance.

The post Wealth Management: The Financial Industry’s 10 Most-Common Passwords appeared first on FIDO Alliance.

The post Biometric Update: FIDO Alliance paper positions protocol for EU Digital Identity Wallet authentications appeared first on FIDO Alliance.

The post Dark Reading: Twitter’s 2FA is a call for passkey disruption appeared first on FIDO Alliance.

The post The Fintech Times: Are passwords a thing of the past? A passwordless future: 1Password Report appeared first on FIDO Alliance.

The post Wired: The war on passwords enters a chaotic new phase appeared first on FIDO Alliance.

The post The Green Sheet: Passwordless future within reach, experts say appeared first on FIDO Alliance.

The post AARP: Fraud fighters are working to keep scam “epidemic” at bay appeared first on FIDO Alliance.

The post Digital Transactions: Why the password is going extinct appeared first on FIDO Alliance.

The post Futura Sciences: AI breaks most passwords in less than a minute: here are the ones that stand up appeared first on FIDO Alliance.

The post Compare the Cloud: The passwordless future appeared first on FIDO Alliance.

Passwords are everywhere with both enterprises and e-commerce organizations feeling the pain as much, if not more, than most.

At the Authenticate Virtual Summit: Authentication in Financial Services and Commerce on March 29, industry experts and practitioners outlined The FIDO Fit for Enterprise and Customer Sign-ins. Throughout the half-day event, the topic of passkeys was a primary theme, with speakers outlining how they work, where they fit in and why they are essential to helping the world move away from legacy passwords and less secure multi-factor authentication.

Andrew Shikiar, executive director and CMO of the FIDO Alliance opened the event with some insights on the many positive benefits that passkeys can bring to enterprise and commerce users. Those benefits include helping users to get online faster with higher levels of satisfaction. Passkeys may also be able to help improve the bottom line for e-commerce vendors as well.

“If you’re an e-commerce vendor, imagine reducing the shopping cart abandonment rate by even 10%,” Shikiar said. “Our data shows that 50% of consumers that had to abandon a purchase in the past six months did so because they forgot your password and that’s a huge opportunity cost.”

While FIDO authentication has been available for anyone to use for over a decade, Shikiar noted that there have been some adoption challenges. Passkeys are, in part, a solution to some of those adoption challenges. With passkeys, there is a more recognizable set of common terminology and the technology also provides a familiar flow for users that aims to reduce friction.

In the enterprise, Shikiar said that passkeys are a very natural fit for things like BYOD [Bring Your Own Device] authentication, allowing employees to sign in with apps on their phones.

“This is becoming more the norm than the exception, and passkeys are just a very natural fit for that environment,” Shikiar said.

The State of Authentication 2023 

Make no mistake about it, there are a lot of problems with passwords. To add some metrics to the argument against passwords, Jay Roxe, CMO at HYPR provided some insights from his firm’s State of Passwordless Security 2023 report.

Roxe noted that one of the things that really jumped out to him was that three out of five of the organizations that HYPR talked to for the report, had an authentication related breach over the past year. He added that each of those organizations had nearly $3 million dollars in costs associated with those breaches on a 12 month basis. Financial Services was the most highly attacked industry vertical with 81% of financial services organizations having recorded some type of attack or breach related to authentication.

The HYPR report also attempted to discover why organizations will move to deploy strong authentication passwordless approaches. Roxe emphasized that it’s critical to have a good user interface and flow, otherwise the technology won’t get adopted. In fact the report found the top reason why organizations are looking to adopt passwordless is to improve the user experience.

“Until we nail that user experience, we’re fundamentally not going to be any better off than we are today,” Roxe said.

Passkeys 101

Among the most interactive sessions of the event was one on the basics of how passkeys work, which kept moderator Megan Shamas, senior director of marketing at the FIDO Alliance very busy handling questions from the engaged audience at the end of the session.

The session actually got started with Tim Cappalli, identity standards architect at Microsoft outlining the historical path of FIDO standards. The big milestones along the path include the debut of the U2F specifications in 2014, FIDO2 in 2017, WebAuthn in 2019 and just last year the emergence of passkeys.

“It has been a journey,” Cappalli said. “We think that in the last two to three years, we really have been moving towards the last step to moving people beyond passwords.”

Cappalli outlined how passkeys works and what the primary advantages are for the approach. He explained that a passkey is fundamentally a FIDO credential with some new properties. Among the properties highlighted by Cappalli are:

• Autofill. With Autofill, much like the experience users have today with a password manager, a passkey can be automatically injected into an authentication flow into existing websites.
• Cross Device Authentication. Instead of a credential being tethered strictly to a single device, passkeys enable a credential to be durable across environments, enabling a phone for example to be able to bootstrap another device or ecosystem.

Championing FIDO adoption at scale

Few professionals have had as much experience deploying FIDO at scale as Marcio Mello, who has led efforts at PayPal, Intuit and eBay.

Mello outlined in great detail the steps that organizations can and should take to support FIDO strong authentication. In his view, the benefits are obvious.

“As soon as we could, we started doing WebAuthn deployment at eBay and saw the benefits almost immediately,” Mello said.

For Mello, passkeys are the next massive step forward as it’s an approach that will reduce consumer friction and hopefully enable adoption at scale. It is fundamentally the ease of use that passkeys promise that is literally the key.

“Consumers expect to see and use a password,” he said. “Yes, everybody’s tired of them, but it’s like smoking, most smokers would like to stop but they can’t, sure they know it’s bad, but you need to have the motivation and a very low bar of ability to be able to drive a habit change.”

FIDO and Zero Trust

In the security world, zero trust is an increasingly common concept that advocates an approach where users and entities need to be constantly validated to limit risks.

For Kurt Johnson, chief strategy officer at Beyond Identity, there is a clear intersection between FIDO authentication and zero trust. After all, a core foundation of zero trust is the need to constantly authenticate users and if organization’s aren’t using strong authentication, that’s a weak link.

Johnson said that with zero trust there is a need to assess and establish a high level of trust in the user identity. That just can’t be done effectively through passwords and that’s where there is a need for FIDO Certified authentication, that’s unphishable.

Helping Amazon’s drive to be customer-obsessed

Amazon operates one of the world’s largest e-commerce sites and it’s also a strong advocate and supporter of the FIDO Alliance.

Yash Patodia, principal product manager, tech, world wide consumer at Amazon said that his team is always looking to improve usability. One of the efforts to improve has been a move to remove passwords wherever possible. Patodia said that Amazon uses FIDO security keys for its own internal security which has worked well.

While security keys have worked for Amazon’s own internal needs, he noted that they can be difficult for consumers to adopt. That’s one of the many reasons why he’s particularly excited about passkeys.

“I think it’s a great leap forward from the password, OTP (one time passwords) and the security keys world,” Patodia said. “Some of the benefits I can see for passkey is that it really makes it very easy for the customer to use.”

Making it easier for consumers is critical for Amazon overall as it’s core to the company’s mission.

“We have this term at Amazon we use a lot called customer obsession,” Patodia said. “And this fits perfectly for us in that this is actually a customer obsessed product where we are making it very easy for the customer to do what they want to do.”

PNC BANK looks to protect its users with FIDO

Susan Koski, CISO of PNC Bank, knows all too well the challenges of password, that’s why she’s such a strong advocate and supporter of FIDO.

She noted that criminals are going after user passwords in a bid to take over accounts. Among the risks that she is trying to help limit is that of phishable credentials, such as passwords.

“We really do want to reduce those phishable  credentials but we do it in a way that a customer wants to use the service,” Koski said. “Balancing security and the customer experience. I think that’s just been a mantra for us in information security in cyberspace for a while.”

Koski said that PNC Bank has embraced FIDO as a way to help move towards passwordless over time. The importance of taking a standardized approach that benefits from the support and participation of a broad array of participants is critical as well.

“Passwords have been around for 50 plus years and it’s time, it’s beyond time for us to move past passwords,” Koski said.

Enterprise guidance for passkeys is on the way

Looking forward, Megan Shamas of FIDO Alliance outlined a series of efforts that are underway to help provide more enterprise guidance for passkeys.

“We will be publishing a group of five papers that address what we hope to be the majority of the use cases that are out there on the enterprise,” Shamas said.

The five papers include:

• Introduction to passkeys in the enterprise
• How to replace password-only authentication with passkeys
• How to displace password + SMS OTP authentication with passkeys
• FIDO authentication for moderate assurance use
• High Assurance Enterprise FIDO Authentication

“If you would like to be part of the conversation around enterprise requirements, please do get in touch with us,” Shamas said. “This is the time now really to give your input on how we’re looking at passkeys from an enterprise perspective.”

Registrants can now view the event recording online. If you missed the event and would like to view the recording, visit the event website to register for access.

The post Recap: Authenticate Virtual Summit: Authentication in Financial Services and Commerce appeared first on FIDO Alliance.

The post Tech Radar: This identity management firm is the first big player to ditch passwords appeared first on FIDO Alliance.

The post WEB.de: AI fraud with a stolen voice appeared first on FIDO Alliance.

The post Blog NT: NordPass announces support for passkeys appeared first on FIDO Alliance.

Called Enterprise Passkeys for Microsoft Azure, the program supports integration with Microsoft Entra. It aims to provide the flexibility and security features of FIDO2 authentication while removing costs associated with hardware security keys.

The post Biometric Update: HYPR turns smartphones into FIDO2 virtual security keys for passwordless authentication appeared first on FIDO Alliance.

Big Tech companies have recently made headlines by pledging to move away from traditional passwords in favour of a more modern solution: passkeys. But for Anna Pobletts, the advent of passkeys is nothing new.

Two years ago, Pobletts co-founded and was CTO of Austin, Texas-based startup Passage, which focused on making the predecessor to passkeys, an API called WebAuthn, accessible to developers and businesses that were looking to implement passwordless authentication.

In only the second year of its existence, Passage caught the eye of another major player in the authentication space: 1Password, the password manager used by millions and one of Canada’s most valuable tech companies.

The post Beta Kit: How 1Password plans to build a passwordless future appeared first on FIDO Alliance.

The post Infosecurity Magazine: November’s M&A News Roundup appeared first on FIDO Alliance.

The post Silicon: Cybersecurity: automation, to the delight of attackers? appeared first on FIDO Alliance.

The post Global Security Mag: FIDO Alliance Predictions 2023 appeared first on FIDO Alliance.

The post ChannelPartner: How Apple’s password alternative works in practice appeared first on FIDO Alliance.

The post ZDNet: Phishing-resistant multifactor authentication appeared first on FIDO Alliance.

The post SC Magazine: Five ways security teams can respond to the Uber breach appeared first on FIDO Alliance.

The post ComputerWorld: NCSC publishes cyber guidance for retailers appeared first on FIDO Alliance.

The post Journal du net: How FIDO keys will accelerate a password-free future appeared first on FIDO Alliance.

The post heise: Mastercard to introduce payment with face or hand scan appeared first on FIDO Alliance.

The post Google Watch Blog: Google wants to abolish passwords and replace them with passkeys – this is how the new FIDO system works appeared first on FIDO Alliance.

The post Electropages: Major tech companies looking to move away from passwords appeared first on FIDO Alliance.

Bob Lord, who oversaw information security for Yahoo and Twitter before and—most recently—the Democratic National Committee, was made senior technical advisor at the Cybersecurity and Infrastructure Security Agency, according to a press release Monday.

The post Nextgov: CISA’s Newest Advisor Could Soon Have Agencies Asking: ‘Does This Spark Joy?’ appeared first on FIDO Alliance.

The post Global Security Mag: NEOWAVE launches the Winkeo-C FIDO2 security key for fixed and mobile terminals appeared first on FIDO Alliance.

The post Sicherheit: Passwordless Authentication Receives Extensions appeared first on FIDO Alliance.

The post Tech Tribune: 5 Easy Tasks to Reinforce Your Security appeared first on FIDO Alliance.

Joon Hyuk Lee and Atsuhiro Tscuhiya, APAC Market Development Team

[Snapshots of AMF Inauguration Members]

As the world struggles to contain the global pandemic, cybercriminals are launching their attacks and taking advantage of the anxiety and uncertainty that people are feeling. They impersonate trusted authorities or brands to mislead their victims. This is not surprising as cybercriminals are always on the lookout for opportunities and vulnerabilities.

Cybersecurity ranks amongst the top ten global risks, and reducing cyber-risk exposure has become a priority for business leaders, according to the World Economic Forum’s 2020 Global Risks Report.

Meanwhile, cybersecurity and technology experts overwhelmingly agree that reliance on passwords should be reduced if not totally scrapped: 80 percent of all data breaches involve weak or stolen passwords, and 29 percent of all attacks leverage the latter.

The use of passwords poses many challenges. As we increasingly live our lives and perform mission critical work online, safe access to connected devices and online services is more important than ever. The need to raise authentication standards and reduce reliance on passwords is now more urgent than ever.

APAC Marketing Forum

Since 2012, the FIDO Alliance has been working with organizations across Asia Pacific (APAC) to reduce the reliance on passwords and encourage the adoption of simpler and stronger approaches to authentication. Today, we have close to 40 members from both the public and private sector in this region.

Recently, more than 30 representatives from these member organizations got together for the very first FIDO Alliance APAC Marketing Forum (AMF). The AMF, held virtually, was an informal marketing related discussion.

The event provided a platform for members to connect, learn about each other’s markets and share best practices. It facilitated communication and cooperation amongst members, and the authentication industry as a whole.

Recent Initiatives in APAC

FIDO members in APAC also have made tremendous progress in recent months.

Companies that deployed FIDO authentication include PrivyID in Indonesia, and Japan-based NTT Docomo and KDDI. Furthermore, VinCSS became the first company in Vietnam to develop FIDO2-certified strong authentication servers.

FIDO also was included in official standards documents developed by the Taiwan Association of Information and Communication Standards (TAICS) and SEMI (Semiconductor Equipment and Materials International) Taiwan. 

Also in Taiwan, the Taiwan-Cathay United Bank has added the FIDO logo to the latest version of its app, which was released to customers in August.

Additionally, we had successful events like the FIDO Security Key Support Campaign, and 2020 FIDO Hackathon – Goodbye Password Challenge that offered member organizations opportunities to interact with each other despite physical distancing.

Activities in the Pipeline

Moving forward, we aim to organize more of both digital and onsite collaborative marketing events where members can promote their innovations and share case studies. Currently, planned initiatives include:

• FIDO Alliance virtual AMFs to be organized once every quarter, where post discussion updates will be shared through the FIDO Blog
• FIDO Alliance quarterly member newsletter 
• Updated FIDO Alliance orientation material with contents customized for the needs of APAC members

We look forward to seeing you at the next virtual meeting in October!

—

If you wish to take part in these exciting new initiatives, or have any inquiries, please do not hesitate to contact tsuchiya@fidoalliance.org.

By joining AMF, you will not only get to connect with key authentication players in APAC, but also gain benefits of participating in FIDO branded awareness and promotional activities together with global champions.

The post FIDO Alliance Members Meet Virtually in Inaugural APAC Marketing Forum appeared first on FIDO Alliance.

Agenda:

The post 2020 FIDO Seoul Virtual Seminar: Day 2 appeared first on FIDO Alliance.

Agenda:

The post 2020 FIDO Seoul Virtual Seminar: Day 1 appeared first on FIDO Alliance.

The post Webinar: Deployment Case Study: Login.gov & FIDO2 Presentation appeared first on FIDO Alliance.

The post Webinar: Deployment Case Study: Login.gov & FIDO2 appeared first on FIDO Alliance.

FIDO will conduct a complimentary Seminar for prospective members, and for companies interested in deploying the FIDO Standards. There will be both Business and Technical tracks to the program, addressing the UAF and U2F Specifications, FIDO’s Compliance Program, case studies of FIDO 1.0 deployment, and the relationship between FIDO, Federation and the Internet of Things. There will also be a panel discussion of the future of authentication as viewed from the perspective of Government. Member companies will demonstrate FIDO Ready products.

AGENDA

https://www.regonline.com/Register/Checkin.aspx?EventID=1694442

The post FIDO Alliance Seminar — Dublin appeared first on FIDO Alliance.