Google Case Sudy: Becoming Unphishable: Towards Simpler, Stronger Authenticaton
Download as PPTX, PDF•1 like•625 views
The document discusses the limitations of traditional password systems and introduces Google's security key based on the FIDO U2F standard as a solution to improve authentication security and usability. Security keys are highlighted for their unphishable design, ease of use, and broader deployment across various services. The document also outlines the ongoing efforts to enhance this technology and provides guidance on how to start using security keys.
![Passwords are broken
Phishing has become increasingly sophisticated
● More than ⅔ of incidents [in 2015] … involved phishing. With
a 23% effectiveness rate*
● OTPs help against shared password, but it’s not safe to rely
on them for phishing
* http://www.verizonenterprise.com/DBIR/2015/
REUSED PHISHED KEYLOGGED](https://image.slidesharecdn.com/googlecasestudybecomingunphishabletowardssimplerstrongerauthentication-161004174914/85/Google-Case-Sudy-Becoming-Unphishable-Towards-Simpler-Stronger-Authenticaton-4-320.jpg)
Google Case Sudy: Becoming Unphishable: Towards Simpler, Stronger Authenticaton
- 1. #FIDOseminar BECOMING UNPHISHABLE TOWARDS SIMPLER, STRONGER AUTHENTICATION Alexei Czeskis Google
- 2. Introduction and Agenda Part of the team responsible for authentication at Google Agenda • Passwords are broken • Introducing Security Key • Google’s Experience • Some numbers • We’re not quite done • How can you get started?
- 4. Passwords are broken Phishing has become increasingly sophisticated ● More than ⅔ of incidents [in 2015] … involved phishing. With a 23% effectiveness rate* ● OTPs help against shared password, but it’s not safe to rely on them for phishing * http://www.verizonenterprise.com/DBIR/2015/ REUSED PHISHED KEYLOGGED
- 6. Today’s solution: One Time Passwords SMS USABILITY Coverage Issues - Delay - User Cost DEVICE USABILITYOne Per Site - Expensive - Fragile USER EXPERIENCEUsers find it hard PHISHABLE German Police re: iTan: ".. we still lose money"
- 8. Introducing Security Key Designed to solve authentication challenges • For enterprises • For consumers Based on FIDO U2F standard • Safe: Unphishable / UnMITMable • Easy: Insert and press button • Compact: One device, many services
- 9. Simple operation 1 2 3 Userid & Password Insert, Press button Successful Sign in
- 10. Based on Asymmetric Cryptography Core idea - Standard public key cryptography • User's device mints new key pair, gives public key to server • Server asks user's device to sign data to verify the user. • One device, many services, "bring your own device" enabled
- 12. Deployment at Google • Enterprise use case • Mandated for Google employees • Corporate SSO (Web) • SSH • Forms basis of all authentication • Consumer use case • Available as opt-in for Google consumers • Adopted by other relying parties too: Dropbox, Github
- 14. Time to authenticate Security Keys are faster to use than OTPs "If you've been reading your e-mail" takeaway:
- 15. Second Factor Support Incidents
- 16. Second Factor Support Incidents Security Keys cause fewer support incidents than OTPs "If you've been reading your e-mail" takeaway:
- 17. We're not quite done...
- 18. Ongoing work • Wireless protocols • NFC, BLE • More browsers • Firefox, Edge, more? • More platforms • Android, Windows, OS X/iOS? • V2 of the protocol • Device-centric authentication
- 19. How can you get started?
- 20. U2F use cases • Internal enterprise authentication (B2B) Authenticate to your own web applications, mobile applications, etc • Authenticate to your service providers (“token necklace”) U2F works well in a non-federated environment Complete isolation between various RPs • External customer authentication Authenticate your high-value customers using U2F
- 21. Resources • To use with Google Enable 2-Step Verification on your account Go to: https://security.google.com Click: 2-Step Verification Click on the Security Keys tab • Also use with GitHub, Dropbox • And / or play with some code https://github.com/google/u2f-ref-code https://developers.yubico.com/U2F/Libraries/List_of_libraries.h tml
- 22. Q & A