Beyond Passwords: FIDO (Fast IDentity Online) and the Larger Market for Strong Authentication
15
Pay Pal TM Michael Barrett, CISM, CISSP Chief Information Security Officer Voice Biometrics Conference May 8, 2013
-
Upload
derektop -
Category
Technology
-
view
1.083 -
download
1
description
From Voice Biometrics Conference San Francisco (May 8-9, 2013), Michael Barrett, Chief Information Security Officer, PayPal -- With the explosive growth of electronic commerce and mobile banking, the need for strong authentication is growing. PayPal is helping spearhead the FIDO Alliance, which introduces a viable alternative to passwords with a standards-based approach to authentication that raises security and ensures privacy, while simplifying authentication. FIDO unleashes vast potential for both existing and many new markets. The question is: "How big is the market opportunity for voice and all biometrics in a FIDO enabled world?"
Transcript of Beyond Passwords: FIDO (Fast IDentity Online) and the Larger Market for Strong Authentication
PayPal TM
Michael Barrett, CISM, CISSP Chief Information Security Officer
Voice Biometrics Conference May 8, 2013
Opportunity for Better Authentication is Upon Us Passwords Just Do Not Work…
For Users For Organizations
Painful to Use
• 25 Accounts • 8 Logins / Day • 6.5 Passwords
Difficult to Secure
• $5.5M / Data Breach • $15M / PWD Reset • $60+ / Token
For the Ecosystem
Impossible to Scale
• Fragmented • Inflexible • Slow to Adopt
Common experiences related to authentication failure (respondents who say it happened to them one or more times over the past 2 years)
Users are frustrated - password complexity requirements working against them instead of supporting them
Experiences with Identity and Authentication
JUST EASY
SECURE & EASY
JUST BAD
Hig
h Se
curit
y Lo
w
UNPLEASANT
Low High Usability
Security is not a Continuum…
DO YOU REALLY WANT YOUR REFRIGERATOR TO KNOW YOUR PAYPAL
PASSWORD?
Do You Really Want Your Refrigerator to Know Your PayPal Password?
Newer Technologies Exist
0
20
40
60
80
100
120
2006 2007 2008 2009 2010 2011 2012
Authentication Vendors
Increasing Options
Authentication Standards Combined with Advances in Biometrics Provide a New Path Forward
How FIDO Works
FIDO Authenticators
Website Browser
FIDO Plugin
Device Specific Module
64
1
23 5
Validation Cache
secret secrets
refr
esh
Vendor Tokens FIDO
Repository
• User picks their own token type
• User decides when/if to bind their token to their account
• Existing tokens (like finger) can be used by downloading the FIDO plugin
• User can download the plugin from various sites
• User could have a PIN-protected USB drive to use while travelling
The FIDO “User” Experience
Please say your passphrase to log into your account
Speak
Voice Experience
Finger Experience
USB Experience
Ø The Internet needs better authentication, now Ø Stronger authentication is not “better
authentication” Ø An industry standards based approach is the
only viable way forward Ø “Whether you believe you can do a thing, or
not, you are right” (Henry Ford)
Michael Barrett, CISM, CISSP Chief Information Security Officer
PayPal TM
Thank You for Your Time!
