Moving Beyond Passwords

Everyone hates dealing with passwords, and yet they’ve been the de facto standard of computer authentication for decades. But there’s light at the end of this long tunnel. There is a passwordless future where we can log in to our accounts using just our smartphones. In this future, it won’t matter if websites are breached because there will be no password databases to steal. Even phishing will be a thing of the past. And thankfully, that future isn’t far away. Today I’ll discuss where we are, how we got here, and where we’re going with Yubico’s Derek Hanson. Derek Hanson has been involved in the identity and security industry for over ten years.  He has been building networks and deploying computer systems since the mid-90s and now is an advocate for how you can best protect them. And he is now the VP of Solutions Architecture and Alliances at Yubico. Further Info Yubico/YubiKey: https://www.yubico.com/  NIST password guidelines: https://www.infosecurity-magazine.com/blogs/nist-password-guidelines/  OPM fingerprint database hack: https://www.wired.com/2015/09/opm-now-admits-5-6m-feds-fingerprints-stolen-hackers/  WebAuthn: https://webauthn.guide/  FIDO: https://fidoalliance.org/  Subscribe to the newsletter: https://firewallsdontstopdragons.com/newsletter/new-newsletter/ Become a Patron! https://www.patreon.com/FirewallsDontStopDragons  Would you like me to speak to your group about security and/privacy? http://bit.ly/Firewalls-Speaker Generate secure passphrases! https://d20key.com/#/ Table of Contents (new!) Use these timestamps to jump to a particular section of the show. 0:01:01: Welcome new patrons! 0:01:41: New table of contents 0:03:40: Update Windows ASAP 0:04:03: Pre-interview notes 0:04:34: Interview start 0:06:21: Why do we still use passwords? 0:11:26: Why don’t more people use password managers? 0:15:25: NIST updates password recommendations 0:17:50: Should we use biometrics for authentication? 0:23:40: How do passwordless systems compare to what we have now? 0:29:00: How does authentication work in a passwordless system? 0:32:50: Have we settled on a single passwordless standard? 0:37:24: How well is this new standard supported? 0:40:41: How do I use this passwordless technology? 0:43:00: How soon will we see passwordless logins? 0:46:22: Which 2FA system is best and will we still need this going forward? 0:51:33: What current technologies are best for securing our accounts? 0:55:18: How do hardware keys work? 1:00:42: OPM fingerprint hack 1:01:48: Bonus content preview 1:02:02: Upcoming shows