Speaker: Mateusz Zajac

For more see the table of contents

---

General

• Don’t need complex passwords
• Phishing proof
• Public key crypto _ biometrics
• One tap sign in
• Secure
• Fewer breaches
• Simpler flows
• Lower support costs – fewer password resets/tickets
• Lower fraud – starting to move to customer facing apps like travel. Not just finance
• 1 billion people use daily

Problems with passwords

• Easy to guess/steal
• Phishing
• Credential stuffing – if one account falls, others follow
• Server breaches. Most common attack
• Users have to keep track

Passwords vs Passkeys

• Passkeys auto generates. Passwords type twice.
• Passkeys can use face id
• Passkeys don’t require reset. Password reset flow has many steps. Including memorable but different than last batch of passwords. 57% users forgot password after reseting. 30-40% help desk calls password reset related
• 81% breaches involve compromised credentials
• 51% of people reuse password
• 2.5 million passwords stolen each week
• Passkeys synced via iCloud
• 92% users give up and don’t try to reset
• 400 million google accounts use

2FA

• SMS phishable
• Push fatigue where keep getting notification until give in and click

Passkey

• Pair of keys
• Private key on your device
• Private key kept safe
• Phone creates a sharing key
• Website sends challenge need secret key to solve
• Use face id and solves
• Sign ins are four times faster than passwords

Amazon login example

• One time setup – your device creates a private/public key pair. Amazon stores public key
• When try to login, Amazon sends a cryptographic challenge. This avoids replay attacks.
• Your phone uses Face ID to confirm it is you. Then phone has private key sign the challenge and sends to Amazon. Amazon authenticates

Phishing prevention

• Scammer tries with fake sight
• Your phone refuses to sign because domain is wrong

iOS Code

• WebAuthn
• FIDO2 – gets url, challenge size, etc

Cross Device Sign in

• Websitte generates QR code
• Scan with phone. Uses bluetooth to verify physical proximity
• Single use
• Expires quickly
• Private key never leaves device
• Useful if want to log in from someone else’s computer

Challenge

• If lose phone
• Cross platform sync
• Inconsistent browser support
• Human factors – trust, education

Good references

• w3c.org/TR/webauthn
• fidoalliance.org
• developer.apple.com/passkeys
• etc

Informal Q&A

• Two people had facial recognition not work
• External device

My take

Great comparison and great statistics.