Passwords are so 1990

@sambego
Passwords are so 1990

@sambego
Developer evangelist
Auth0
Google developer Expert
I&S Meetup London
Fronteers
Sam Bellen

@sambego
First, something
important!

@sambego
Summary
A bit of history on passwords 
Types of passwords
Passwordless authentication
Web authentication API

@sambego
Passwords date back
to the Romans!
Somewhere BC

@sambego
Open sesame
10th century

@sambego
Fernando Corbató
-
Time-Sharing System
1961

@sambego
Robert Morris Sr
-
Hashing
1970s

@sambego
Hacking became
more an issue
1990s

@sambego
NameOfMyPet1988
A string

@sambego
hotdog*
A string
* This was my first password, true story!

@sambego
Zbety6FZiH6XNn3ds
ziGRB6+MBGDYU
A string

@sambego
Pro
Can be hard to guess (by others) if
complex

@sambego
Con
Can be hard to remember if complex
(a passwordmanager can help)

@sambego
Pro
Fairly easy to remember

@sambego
Pro
Usually used only with access to a
physical thing (card, phone, keypad, …)

@sambego
Con
Not so hard to guess 
(Often combined with a maximum allowed
number of guesses)

@sambego
A pattern
1 2 3 6 5 4 7 8 9

@sambego
Con
Touchscreens often reveal the pattern as
“dirty” spots.

@sambego
Con
People often use their initial letter,
lucky number, …

@sambego
Anything that’s a
shared secret

@sambego
So what’s the
problem with
passwords?

@sambego
Passwords can be
annoying!

@sambego
Use a password
manager to help
you remember!

@sambego
User data can get
stolen

@sambego
Google+
-
52.5 million

@sambego
Cambridge Analytica
(Facebook)
-
87 million

@sambego
MyFitnessPal 
-  
150 million

@sambego
Marriott Hotels
-
500 million

@sambego
Auth0 Breached password detection

@sambego
Google Chrome Password Checkup

@sambego
Tips
Use a complex password
Don’t use personal data
Don’t reuse passwords
Change passwords frequently

@sambego
One time password
Valid for one time use
Often expire after a certain time
Sent directly to the user

@sambego
One time password
Sent in an SMS

@sambego
Pro
iOS let’s your easily fill the OTP from
the messages app

@sambego
Con
Not all telecom operators take security
serious, SMS messages can be intercepted.

@sambego
Con
You need your cellphone on hand

@sambego
One time password
Sent in an email

@sambego
One time password
Magic link

@sambego
Pro
You don’t need a second device

@sambego
Con
Emails can be intercepted

@sambego
One time password
Authenticator app

@sambego
Other authenticator apps
DUO
Lastpass Authenticator
Authy
Microsoft Authenticator

@sambego
Con
Needs a shared secret between the app and
authentication service

@sambego
Pro
One less password to remember

@sambego
Pro
Only give a password to a service
you trust

@sambego
Con
You rely on another service for
authentication

@sambego
Other solutions
It’s me
Yoti
Voiceit

@sambego
One time password
Often used as
second factor

@sambego
Hardware
authenticator

@sambego
External
Hardware authenticator

@sambego
USB

@sambego
Bluetooth 
(BLE)

@sambego
NFC

@sambego
Internal

@sambego
TouchID

@sambego
What if we could
use these on the
web?

@sambego
Web
Authentication
API

@sambego
Web Authentication
Challenge

@sambego
Web Authentication
Challenge
User
interaction

@sambego
Web Authentication
Signed challenge
Public key

@sambego
Web Authentication
navigator.credentials.create

@sambego
Web Authentication
navigator.credentials.get

@sambego
Web Authentication
Your authenticator device can register a
private and public key pair for each
website.

@sambego
Web Authentication
The private key is stored only on the
authenticator device.

@sambego
Web Authentication
The private key can sign future
challenges.

@sambego
Web Authentication
The public key is stored on the
authentication device and on the relying
party’s server.

@sambego
Web Authentication
The public key is used to verify future
challenges.

@sambego
Web Authentication
The signed challenge is send back to the
relying party for security.

@sambego
Some issues
User credential management

@sambego
Some issues
Cross devices credentials

@sambego
Web Authentication
Chrome 67
Firefox 60
Edge 17723
Safari Tech Preview (behind a flag)

@sambego
Disclaimer
The spec is not yet fully integrated in
all browsers.

@sambego
Summary
Remembering passwords is annoying.
Use a password manager.

@sambego
Summary
One time passwords are easier, but
currently mostly used as second factor.

@sambego
Summary
The future of authentication might be
hardware authenticator devices.

@sambego
Summary
You can use TouchID on the web!

@sambego
Read more
https: //webauthn.me
https: //auth0.com/blog
https: // www.w3.org/TR/webauthn

@sambego
http: //bit.ly/
sthlm-1990

Passwords are so 1990

More Related Content

Similar to Passwords are so 1990 (20)

Recently uploaded (20)

Passwords are so 1990