printer friendly version

FIDO Alliance opens its security standards to the public

The FIDO (Fast IDentity Online) Alliance, a security-minded industry consortium that includes tech giants such as Google, Netflix, and PayPal has released a public draft of new security standards (available at http://fidoalliance.org/specifications) that could someday make user passwords a thing of the past. Co-founded a year ago by former PayPal executive Michael Barrett, the FIDO Alliance is drawing the support of major tech companies on the lookout for a login alternative that offers greater security, while easing the burden consumers face in creating and managing dozens of passwords for the sites they visit.

With recent data breaches at Yahoo and Adobe, the continuing Snowden revelations, and of course, the massive data theft at Target, consumers are being confronted as never before with the limitations of security in an online world. And companies are facing significant financial risk. A report by Forrester Research puts the cost of password breaches at $200 billion in annual losses. This adds up to what industry watchers feel may be a tipping point in the demand for more secure options.

“This is a very active space for vendors,” says Forrester analyst Eve Maler. “There are quite a lot of security startups attracting money from VC firms.” Barrett puts the situation in blunt terms. “We see daily occurrences of just how bad the password model is,” he says, arguing, “the way out of the mess is not going to arrive through a proprietary solution devised by any single company – it’s too big a problem. It is a system problem that requires cooperation and standard building blocks.”

The FIDO Alliance is leading an industry-wide push for a more secure alternative to user passwords.

To that end, the specifications that FIDO has released offer a two-pronged approach to providing secure logins as well as an improved consumer experience. The proposed U2F standard, which I wrote about in an earlier story, would allow you to login using a simple PIN – just like at an ATM – to identify yourself. At that point, a hardware device you carry with you, be it a USB dongle or NFC-enabled phone or tablet, would be used to verify your identity by way of encrypted communication with your Web browser.

The second protocol, dubbed UAF, allows for the use of biometric data – a thumbprint, vocal phrase or iris scan – to verify your identity. Using a phone or tablet, for example, you could log in to a site simply by swiping your finger, speaking into the microphone or looking into the camera.

Both protocols incorporate public key cryptography, a well-established method for creating a trusted connection. To work, you would first need to register your local device with any sites you will be logging onto. You would also have the ability to terminate this registration at any time, should your device become lost or stolen. In a nod to consumer privacy, the UAF standard restricts storage of any biometric data to the local device. And neither standard provides information that a site you registered with could use to track your visits to, or registration with, any other sites.

To ensure conformance with security standards and device compatibility, FIDO has begun a compliance testing program. At this year’s CES tradeshow, both biometric and hardware-based FIDO Ready products were on display. And while FIDO builds momentum by bringing on big name members like Microsoft, analyst Tim Bajarin of Creative Strategies says it’s also significant that, “FIDO is providing some very important tools for smaller companies that lack the resources to develop proprietary security solutions.”

This is an ambitious endeavour, to put it mildly. To be successful, the FIDO specifications would have to achieve widespread adoption by developers, with top companies seeing value in supporting a standards-based initiative instead of pursuing proprietary solutions. And even more importantly, the approach would have to be embraced by consumers. No easy feat. Maler notes that, “Privacy experts want consumers to value security more than they actually do. People complain about passwords, but the alternative has to be easier to use, not just more secure.” In addition, she points out that there are things passwords are actually well-suited for: giving your kid your Netflix password so she can watch a movie without you, for example.

Barrett acknowledges the challenges. And while conceding that a password-free Internet is far from imminent, he emphasises that the FIDO protocol can accommodate a wide range of implementations. “There is no one-size-fits-all approach for security,” he says, noting that different companies will obviously need to strike different balances between security and user convenience. He stresses that this is the very beginning of a long process and that some Alliance members – notably Google and Netflix – are supporting the protocol first in an internal IT environment, an approach that other companies may take to examine the benefits of the technology before deciding to roll it out to consumers. But, he maintains, the ultimate goal is to make the FIDO spec as ubiquitous for site logins as the SSL (https) protocol is today for encrypted Web browsing.

Making the draft specifications public is a big part of that effort. “Transparency breeds confidence,” Barrett says. “We are committed to an open technology, so we have to publish and let the world comment. We’re looking for feedback on what we’re doing right and what could be improved.” Barrett says FIDO expects to have specifications of the UAF and U2F standards finalised before the end of 2014.

You can read an overview of the specifications (http://fidoalliance.org/specifications), download the complete drafts (http://fidoalliance.org/specifications/download), and view a list of alliance members (http://fidoalliance.org/membership/members/) on the FIDO website.

Share this article:

Further reading: