FIDO Alliance opens its security standards to the public

April 2014 Access Control & Identity Management

The FIDO (Fast IDentity Online) Alliance, a security-minded industry consortium that includes tech giants such as Google, Netflix, and PayPal has released a public draft of new security standards (available at http://fidoalliance.org/specifications) that could someday make user passwords a thing of the past. Co-founded a year ago by former PayPal executive Michael Barrett, the FIDO Alliance is drawing the support of major tech companies on the lookout for a login alternative that offers greater security, while easing the burden consumers face in creating and managing dozens of passwords for the sites they visit.

With recent data breaches at Yahoo and Adobe, the continuing Snowden revelations, and of course, the massive data theft at Target, consumers are being confronted as never before with the limitations of security in an online world. And companies are facing significant financial risk. A report by Forrester Research puts the cost of password breaches at $200 billion in annual losses. This adds up to what industry watchers feel may be a tipping point in the demand for more secure options.

“This is a very active space for vendors,” says Forrester analyst Eve Maler. “There are quite a lot of security startups attracting money from VC firms.” Barrett puts the situation in blunt terms. “We see daily occurrences of just how bad the password model is,” he says, arguing, “the way out of the mess is not going to arrive through a proprietary solution devised by any single company – it’s too big a problem. It is a system problem that requires cooperation and standard building blocks.”

The FIDO Alliance is leading an industry-wide push for a more secure alternative to user passwords.

To that end, the specifications that FIDO has released offer a two-pronged approach to providing secure logins as well as an improved consumer experience. The proposed U2F standard, which I wrote about in an earlier story, would allow you to login using a simple PIN – just like at an ATM – to identify yourself. At that point, a hardware device you carry with you, be it a USB dongle or NFC-enabled phone or tablet, would be used to verify your identity by way of encrypted communication with your Web browser.

The second protocol, dubbed UAF, allows for the use of biometric data – a thumbprint, vocal phrase or iris scan – to verify your identity. Using a phone or tablet, for example, you could log in to a site simply by swiping your finger, speaking into the microphone or looking into the camera.

Both protocols incorporate public key cryptography, a well-established method for creating a trusted connection. To work, you would first need to register your local device with any sites you will be logging onto. You would also have the ability to terminate this registration at any time, should your device become lost or stolen. In a nod to consumer privacy, the UAF standard restricts storage of any biometric data to the local device. And neither standard provides information that a site you registered with could use to track your visits to, or registration with, any other sites.

To ensure conformance with security standards and device compatibility, FIDO has begun a compliance testing program. At this year’s CES tradeshow, both biometric and hardware-based FIDO Ready products were on display. And while FIDO builds momentum by bringing on big name members like Microsoft, analyst Tim Bajarin of Creative Strategies says it’s also significant that, “FIDO is providing some very important tools for smaller companies that lack the resources to develop proprietary security solutions.”

This is an ambitious endeavour, to put it mildly. To be successful, the FIDO specifications would have to achieve widespread adoption by developers, with top companies seeing value in supporting a standards-based initiative instead of pursuing proprietary solutions. And even more importantly, the approach would have to be embraced by consumers. No easy feat. Maler notes that, “Privacy experts want consumers to value security more than they actually do. People complain about passwords, but the alternative has to be easier to use, not just more secure.” In addition, she points out that there are things passwords are actually well-suited for: giving your kid your Netflix password so she can watch a movie without you, for example.

Barrett acknowledges the challenges. And while conceding that a password-free Internet is far from imminent, he emphasises that the FIDO protocol can accommodate a wide range of implementations. “There is no one-size-fits-all approach for security,” he says, noting that different companies will obviously need to strike different balances between security and user convenience. He stresses that this is the very beginning of a long process and that some Alliance members – notably Google and Netflix – are supporting the protocol first in an internal IT environment, an approach that other companies may take to examine the benefits of the technology before deciding to roll it out to consumers. But, he maintains, the ultimate goal is to make the FIDO spec as ubiquitous for site logins as the SSL (https) protocol is today for encrypted Web browsing.

Making the draft specifications public is a big part of that effort. “Transparency breeds confidence,” Barrett says. “We are committed to an open technology, so we have to publish and let the world comment. We’re looking for feedback on what we’re doing right and what could be improved.” Barrett says FIDO expects to have specifications of the UAF and U2F standards finalised before the end of 2014.

You can read an overview of the specifications (http://fidoalliance.org/specifications), download the complete drafts (http://fidoalliance.org/specifications/download), and view a list of alliance members (http://fidoalliance.org/membership/members/) on the FIDO website.





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

A platform for access and identity at Securex 2025
Securex South Africa Access Control & Identity Management Facilities & Building Management
South African companies involved in supplying access control technology, security services, and data management are well-positioned to tap into the expanding access control market at Securex 2025.

Read more...
Background checks: risk levels and compliance
iFacts Access Control & Identity Management Security Services & Risk Management
Conducting background checks is a vital step in the hiring process for employers or when engaging service providers; however, it is crucial to understand the legal framework and regulations governing these checks.

Read more...
Insurance provider uses Net2 For access management
Paxton Access Control & Identity Management Integrated Solutions Healthcare (Industry)
BestMed selected Paxton Net2 for its access control requirements because of its simplicity of installation and ease of navigation for end users, as well as the 5-year warranty.

Read more...
Identity is a cyber issue
Access Control & Identity Management Information Security
Identity and access management telemetry has emerged as the most common source of early threat detection, responsible for seven of the top 10 indicators of compromise leading to security investigations.

Read more...
Embracing contactless access solutions
HID Global Access Control & Identity Management
There has long been a discussion of the perils and virtues of authentication factors. Is it more secure to use something we have (a key card), something we know (a password), or something we are (biometrics)?

Read more...
Smart access for a safer community
neaMetrics Suprema Access Control & Identity Management Residential Estate (Industry) Products & Solutions Commercial (Industry)
Suprema has released its BioEntry W3 facial authentication access control device with multiple authentication options, including RFID cards as well as mobile credentials, designed for durability and resilience.

Read more...
The power of knowing your client
Ideco Biometrics Access Control & Identity Management Integrated Solutions
One of the most effective ways to combat the threat of fraud, identity theft, and financial crime threats is through a robust Know Your Client (KYC) process, which safeguards both businesses and clients.

Read more...
Smarter ways to secure your space
Elvey Security Technologies Access Control & Identity Management Products & Solutions
Ensuring the safety of people and assets has become more crucial than ever, and access control systems provide essential tools to regulate and monitor who can enter specific areas or access sensitive resources.

Read more...
Facial recognition in national security
Access Control & Identity Management Government and Parastatal (Industry)
As global security challenges evolve, facial recognition technology provides a vital edge by turning our unique identities into powerful assets for national defence and changing a sea of anonymity into a line of defence.

Read more...
Federated identity orchestration
Technews Publishing SMART Security Solutions Editor's Choice Access Control & Identity Management Security Services & Risk Management AI & Data Analytics
Understanding exactly who resides at the end of a digital device is key, and simple identity number verification by the Department of Home Affairs is no longer a viable solution on its own.

Read more...