By: FIDO Alliance Staff

Few if any industries are as critical as healthcare where literal life and death decisions hang in the balance.

At the Authenticate Virtual Summit: Modernizing Healthcare with Strong Authentication broadcast on June 16, experts outlined how FIDO can fit into healthcare to improve user experience and help secure provider authentication approaches.

Megan Shamas, senior director of marketing at FIDO Alliance, started the event by noting that healthcare is one of the most targeted industries with phishing and ransomware being highly prevalent and highly successful. She noted that passwords are not fit for purpose in healthcare and can be phished by attackers.

Looking at the FIDO imperative for healthcare, Shamas said that FIDO-based technology can help with secure login for patients, as well as supporting authentication in complex medical environments. For example, if a medical professional is wearing gloves, FIDO-based technology can also support local PIN, face recognition or FIDO security keys. She added that FIDO authentication also helps healthcare organizations to comply with regulatory and privacy requirements.

“Our goal at the FIDO Alliance from day-one was to transform the market away from a dependence on centrally stored shared secrets and knowledge based authentication to a model that is possession based and uses public key cryptography,” Shamas said. “It allows consumers, patients and employees to authenticate through devices that they literally have at their fingertips, every single day and it’s just simpler and it’s stronger.”

FIDO Reduces Friction, Complies with eIDAS

Rolf Lindemann, VP of Product at Nok Nok Labs, noted that IT should help to simplify healthcare operations and not contribute additional friction for practitioners and patients.

“Patients want assurance that their sensitive health data cannot be stolen,” Lindemann said.

Lindemann said that health insurance cards are widely used in Europe but are not practical to use as an authentication mechanism on mobile devices. Additionally,  he noted that in Europe, the eIDAS (electronic IDentification, Authentication and trust Services) identification standard needs to be complied with by providers.

“Passwords are insecure, and legacy two- factor methods like OTPs (one time passwords) are inconvenient, and they still don’t protect against phishing,” Lindermann said.

That’s where he sees FIDO as fitting in, providing a strong authentication approach that can help healthcare providers to secure user access as well as being compliant with regulations like eIDAS.

Abbie Barbir, FIDO board member and co-founder of ADIA, detailed security challenges of passwords in his session at Authenticate.  

“Passwords are shared secrets and shared secrets can be stolen, copied, used and shared, and as such passwords are a security risk,” Barbir said. “They should not be relied upon if you really need to secure your accounts and your users, ideally, the best way going forward is to actually not use passwords.”

In Barbir’s view, good risk-based authentication introduces friction for hackers and is transparent to the end user.

Timy Kim, senior solutions engineer at Daon, commented that due to the increase of online services rendering different modalities of care, hackers and fraudsters will look for a weak point to penetrate. The weak point more often than not is a password that can easily be phished.

“Patient authentication can be your face, finger, or even your voice,” Kim said. “This will save you from needing to remember lengthy or complex passwords, which sometimes become a frustration point when trying to access your patient portal.”

Healthcare Organizations detail FIDO Uses

Merck KGaA, Darmstadt is a Germany-based science and technology conglomerate with operations across multiple sectors including healthcare.

Andreas Pellengahr, Head of IAM at Merck Merck KGaA, Darmstadt, Germany, said that his organization has approximately 80,000 users that need secure access. To help enable that, Merck relies on FIDO authentication.

Pellengahr said that they could not use a SaaS service to enable FIDO as the company needs to control its own authentication and credentials. Dennis Kniep, domain architect of IAM at Merck KGaA, Darmstadt, Germany,  explained that the core of the authentication infrastructure is a locally-hosted open source FIDO server.

Kniep noted that the authentication service is certified by the FIDO Alliance, which ensures interoperability with other FIDO products. 

“We are running multiple servers in a cluster, which are hosted across different data centers,” Kniep explained. “The responsibility of the FIDO server is to securely store the registered FIDO credentials in our self hosted environment, so that we really have full control over these credentials.”

The United Kingdom’s National Health Service (NHS) is also using FIDO authentication to help secure its users. 

Priyanka Mittal, senior technical architect at NHS Digital, explained that the NHS Login service is an authentication and identity verification service, which enables people to access healthcare apps and websites securely. She noted that over the last 18 months, NHS has seen a dramatic increase in its user base for NHS Login, which now supports 25 million users. The NHS App is a mobile application that brings a variety of healthcare services to users and also provides COVID-19 passport functionality.

Sean Devlin, tech lead for NHS App, explained that his organization’s journey to FIDO began two years ago. NHS required that users have two factor authentication for every login, but that approach introduced some friction and there was a desire to make the process more seamless. That’s why the NHS started to look at passwordless approaches, and settled on FIDO.

NHS Digital decided to build its own FIDO server and client, based on existing open source projects from eBay, which is also a large FIDO user. Devlin explained that his group converted the eBay open source FIDO server to the Python programming language and implemented a serverless approach to run on the AWS Lambda service.

The overall approach for the NHS App of enabling FIDO has helped to save the NHS a good deal of money as well.

“11 million users that have registered with NHS logon have also registered a FIDO device and  that sort of equates to about 500,000 FIDO logins per day,” Devlin said.

Devlin noted that the NHS was paying 1.6 pence per text message to send out two factor authentication code on 500,000 logins per day. 

“That equates to about 8,000 Pound Sterling, that we are saving on SMS by using FIDO,” Devlin said.

Modernizing Healthcare Identity and Authentication Regulations

The regulatory environment around healthcare has been evolving in recent years. 

Among the most impactful, yet least well known regulations is the 21st Century Cures Act which mandated the implementation of application programming interfaces (APIs) in healthcare. In a panel session, Jeremy Grant, managing director of technology business strategy at Venable; Christine Owen, director at Guidehouse, and Ryan Howells, principal at Leavitt Partners, discussed the impact of healthcare regulations and where FIDO fits in.

Howells explained that his organization helped to create the CARIN Alliance which aims to improve the state of identity and authentication in healthcare. Using APIs to help connect information, as mandated by the 21st Century Cures Act, also requires authentication.

“Approximately 84% of all the major health plans in the country have actually implemented an API based architecture now,” Howells said. “They’re all asking very similar questions that we’re asking other industries, which is how do you identify and authenticate an individual securely across systems.”

That’s an area where FIDO fits in.

Owen said that adding FIDO is an obvious choice for healthcare providers and plans that want to make sure that there is a strong credential behind users.

“The reason why FIDO is really important is because it helps healthcare organizations to meet HIPAA and other regulatory requirements,” she said. “FIDO in my mind equates to frictionless authentication, so the user has less to do to be able to show a very strong credential and because of that, it’s actually perfect for healthcare.”

To engage with the FIDO Alliance on FIDO authentication for healthcare, visit www.fidoalliance.org or get in touch at [email protected]. 

The next Authenticate event will be the flagship conference, Authenticate 2022, being held in Seattle, WA and virtually on October 17-19. For more details or to register, visit www.authenticatecon.com. 

By: FIDO Staff

Where does FIDO fit in commerce?

That question was the primary theme tackled during the Authenticate Virtual Summit broadcast March 30 and 31, 2022, and including sessions led by experts and practitioners from North America and Europe.

In the opening session of the event, Andrew Shikiar, executive director and CMO of the FIDO Alliance, stated candidly that financial services and payments have always been a target for hackers. With the pandemic the past few years, there has been a further acceleration of attacks.

“The core issue, of course, is that we depend on passwords,” Shikiar said. “The real problem is that they’re easy to phish, harvest and replay and that’s really where the internet breaks down, that’s what causes data breaches and that’s what the FIDO Alliance is trying to solve.”

This is true for legacy MFA – such as SMS and OTP – as well. They are equally as vulnerable to common attacks like phishing. “MFA bypass attacks using legacy MFA will be a recurring theme for 2022,” Shikiar said.

Looking specifically at financial services, Shikiar said that FIDO standards can help protect online accounts with strong authentication. He added that FIDO also helps companies comply with regulations and  make open banking a reality.

“We think that FIDO provides a very elegant, simple solution that will allow for customers to have secure commerce flows, while also helping merchants and banks comply with emerging and current regulations,” Shikiar said.

The Challenges Facing FIDO in Retail and Hospitality

In a session, Suzie Squier, President at RH-ISAC (Retail and Hospitality Information Sharing and Analysis Center), explained that her organization is all about sharing threat intelligence across its membership which includes retailers and hotels across the United States, United Kingdom and Canada.

Squier noted that the growth of ecommerce has not gone unnoticed by threat actors as the retail and hospitality industries have been hit hard with credential stuffing attacks. Those attacks are typically due to poor password hygiene, the pervasiveness of passwords available for sale on the dark web, and how easily weak passwords can be brute forced, or even guessed.

“The problem with passwords doesn’t just end with credential stuffing, account takeovers and fraud, as problematic as they are, the reliance on passwords can also lead to frustration and lost sales due to lost and forgotten passwords,” she added.

The problem with passwords is well understood across the RH-ISAC membership with more than 67% of respondents to a survey stating that they see real value in moving away from passwords. However, the majority of those moving toward passwordless do not yet have FIDO as part of their plans due to concerns around inconsistent user experience across platforms, challenges for users with lost authenticators and lack of global acceptance.

“There are major challenges and user frustration with the current passwordless authentication model,” Squier said. “When we’re talking about the consumer space, there is little tolerance for friction.”

There is some help on the way from FIDO to help reduce friction, Squier said. She noted that FIDO recently announced multi-device credentials, known as “passkeys.” She explained that the basic idea with multi-device credentials is to allow the phone itself to act as a roaming authenticator across multiple devices, which could help solve for consistency and account recovery with authentication.

Looking forward, in Squier’s view what’s needed to drive passwordless forward is more  adoption.

“We need to see broader adoption across more industries, so that this becomes more ubiquitous and familiar to the consumer world,” she said.

FIDO Supporting Digital Transformation

While FIDO is all about secure authentication, using FIDO-based technologies can enable much more according to Rolf Lindemann, VP of Products at Nok Nok.

Lindemann said that by using FIDO standards organizations can enable digital transformation. That transformation supports customer experience optimization, operational flexibility and innovation

“When using digital services, the first step in that customer experience is authentication, that is the front door,” Lindemann said. “That first authentication step is important because most digital services rely on your ability to know who’s at the other end of your services, while at the same time providing the best customer experience.”

Strong authentication is a great start but Jason Beloncik, Director of Solutions Americas at Daon suggested that organizations will sometimes need more to support the best possible user experience. Beloncik said that his company takes a hybrid approach it calls FIDO Plus. The “plus” is integrating other capabilities in the identity ecosystem to support organizations.

Gal Steinberg, VP of Product at Keyless, commented in a session that a challenge he often sees is that the world is trying to solve the fraud problem by adding friction. The challenge is that adding friction in the form of multi-factor authentication, for example, creates user churn in the consumer space. There is a balance that needs to be achieved with authentication, between introducing friction to mitigate fraud and usability.

Considerations for Standards-based Authentication in the Blockchain

Blockchain and so-called Web 3.0 distributed applications are an emerging area of technology and commerce, but it could well be that strong authentication has not played as strong a role as it should.

“A lot of the crypto exchanges typically do provide authentication methods that are far stronger than basic methods, but most people typically don’t use them because it’s not familiar to them,” Bojan Simic, CEO and CTO at HYPR said. “I think that some of the stuff will need to change.”

Nick Steele, Lead Researcher at Super Lunar, emphasized that it really is crucial for crypto exchanges to support multi-factor authentication. He noted that one of the most common forms of attacks is leveraging weak passwords to get into exchanges and steal large amounts of money.

“Exchanges are really trying to do the best they can to get users on to FIDO2 because that’s going to give us the highest grade of authentication security in the space,” Steele said.

Pushing FIDO Forward in Europe

FIDO is seeing particular success in Europe, from a number of perspectives. Petra Silsbee, Fraud Prevention/Dispute Management at PLUSCARD, explained how her organization has been able to use FIDO to support PSD2 (Payment Services Directive 2) requirements in Germany. PLUSCARD is a credit card issuing processor and its customers are individual savings banks.

PLUSCARD needed to support users that have smartphones as well as those that don’t regularly use one. To that end, Uwe Hartel, Country Manager Central Europe for technology provider Entersekt, explained that his company worked with PLUSCARD to support a FIDO hardware authenticator-based solution for PSD2 support that also enables 3DSecure based payment.

“We identified the need for a hardware token to satisfy a segment of users which do not either have a smartphone or which are kind of reluctant to use their app for, for money transactions for payment transactions,” Hartel said. “That was the start of the idea to actually define a FIDO hardware token as a solution to provide strong customer authentication.”

In a keynote session, Alan Goode, CEO and Chief Analyst of Goode Intelligence, outlined the current state of regulations for strong customer authentication (SCA) requirements across Europe and the United Kingdom.

Goode noted that there have been documented issues with the deployment of SCA technologies. Those issues include an increase in transaction failure rates, payment attrition, rejected transactions and abandonment in the payment process because of increased friction for consumers. He added that there has been criticism of SCA from European Trade bodies for too much focus on compliance versus implementation, and the need for convenient and easy-to-use transaction authorization.

“I believe that there is an opportunity to leverage a standards based authentication solution that works for both web and mobile commerce channels,” Goode said. “By adopting FIDO certified authentication solutions that are also SCA compliant, the problems of security and usability could be mitigated.”

FIDO is also set to play a critical role in the eIDAS 2.0 rollout in Europe.

Rayissa Armata, head of regulatory affairs at IDnow, explained that eIDAS 2.0 is a new initiative that introduces a digital identity stored on a digital wallet. This technology is aimed at  all European citizens and residents. eiDAS stands for electronic IDentification, Authentication and trust Services.

“This is an exciting initiative and it’s an ambitious one,”Armata said. “There are a lot of different players in this ecosystem, from relying parties to integrators to considering the tech standards that are going to be part of this wallet, and also for the Trust Services.”

“FIDO is delighted and pleased to be part of this initiative,” she added.

Best Practices for FIDO in Commerce

There are any number of good reasons for an organization to adopt FIDO standards.

For Tola Dalton, Director of Identity Software Development at eBay, the 2014 data breach at his company was a primary motivator. Dalton said that the data breach painfully highlighted the risks of password data. While using strong authentication and using FIDO to help enable a passwordless authentication workflow is important, that’s not the only benefit it brings.

“Using passwordless, and particularly multi-factor authentication, are shown to have much lower account takeover rates and that’s a big consideration for eBay as it would be for any e-commerce company,” Dalton said. “But the great thing about passwordless is that it’s also an incredibly seamless login method.”

Dalton said that in order to motivate customers to use passwordless and strong authentication, the experience has to be easy and intuitive. That’s a sentiment that Manish Gupta, Director of Global Cybersecurity Services, Starbucks strongly agrees with.

Gupta noted that there are many different ways to enable multi-factor authentication. What’s needed is standardization and that’s what FIDO provides.

“I think that the work that FIDO Alliance is doing to establish a global standard is commendable,” Gupta said. “The standard is solid, there’s buy in, but now it’s about how do we take it a step further, such that it becomes muscle memory for people, just like user ID and Password login has been for years.”

The webcast is now available on demand. To watch the recording, visit the event page.

For more discussions on moving past passwords to modern strong authentication, attend upcoming FIDO Alliance events, including the Authenticate 2022 Conference.

What’s going on in APAC with FIDO? A whole lot.

Over the course of three days from Dec. 8 – 10, FIDO Alliance hosted the Authenticate Virtual Summit: APAC Innovation providing content, insight and user stories from across the Asia Pacific region. Each day provided different blocks of content, including region specific sections for China, India, Korea, Japan, Taiwan and ASEAN / ANZ.

The first day of the APAC Innovation virtual event got started with a keynote from Andrew Shikiar, Executive Director of the FIDO Alliance, who outlined the challenges and opportunities that FIDO provides.

“Asia Pacific has long been a hub of innovation for the FIDO Alliance,” Shikiar said. “Some of our longest members, some of our earliest deployments, and some of our most exciting futures, come deployments throughout Asia Pacific.”

Shikiar noted that the key drivers for FIDO adoption in Asia Pacific are largely the same as they are for FIDO adoption around the world. The first key driver is government recognition of FIDO and the need for strong authentication. The second driver is market demand, which is particularly strong in APAC. Finally a common driver around the world is the ongoing threats against user identity and authentication.

“We’re seeing enterprises and companies throughout Asia Pacific and globally deploy FIDO, to help combat these threats,” Shikiar said. “To summarize, FIDO is very much the future of user and device authentication.”

Region: India

India is an active area for FIDO Alliance members and adoption. During the APAC Innovation event speakers outlined multiple use cases where FIDO is making a difference in India.

“We have been making meaningful strides in India, whether it be adoption or be in policy change,” commented Deb Joyti Ghosh, FIDO Alliance India Working Group Chair / Director, Data Product Development at Visa. 

In a session, Shankar Ramaswamy, FIDO Alliance India Working Group Co-Vice Chair, explained how Aadhaar and FIDO Authentication can co-exist, which is a big topic in India. Aadhar provides a 12-digit unique identity number that is issued by the Unique Identification Authority of India (UIDAI) to citizens and residents. One of the challenges with Aadhaar is the need for authentication, which is where FIDO could well play a strong role. One of the ways Aadhaar authentication is enabled today is with SMS based 2FA, which can be spoofed and isn’t always delivered reliably.

“FIDO offers a very fast and convenient form of authentication and it reduces the reliance on the passwords,” Ramaswamy said.

In a user case study session, Srikanth Appana, Executive Vice President Technology at Bharat Financial Inclusion Limited, noted that his organization had a business requirement for an application that requires strong authentication and tried out FIDO.

“I can definitely say the FIDO experience was fantastic, we have lab tested it and we are looking forward to a large rollout across our enterprise,” Appana said.

Amit Mathur, FIDO Alliance India Working Group Co-Vice Chair and COO at Ensurity, also outlined his experiences helping his organization’s clients move to FIDO. For Mathur, the FIDO experience has been very positive.

“One of the learnings is that everyone out there is wanting to remove passwords, so they are all sick and tired of passwords and they are looking for an opportunity and a good solution which is scalable to remove the passwords,” Mathur said. “That is where the FIDO authentication plays a very very important role.”

Region: China

FIDO is also very active in China. During the regional spotlight on China Henry (Haixin) Chai, FCWG Co-Chair/CEO of Uni-ID Technology at Lenovo, provided an overview of FIDO deployment and opportunities in China. 

Adding to the China block of content, Nick Hu, FIDO Product Manager at FEITIAN Technologies, outlined the opportunities in the region. Rounding out the China block, Yi Chen, Country Manager for China at FIME, detailed how FIDO helps to enable biometric authentication in payment systems.

Day 2: Overview

Stephen Wilson, Managing Director for Lockstep Technologies, delivered the opening keynote for the second day of APAC Innovation providing some insights into the state of digital identity in APAC.

While there are some holdouts around APAC, he emphasized that 100% of Southeast South Asian nations have digital IDs and national IDs. Wilson said that the key trend in identity that he has been speaking about for several years is the global trend from “who?” to “what?” 

Defining who you are as identity is relative and vague in Wilson’s view. By looking for the “what,” it’s possible to be more precise.

For example, What are you? Are you a citizen of Korea? Are you a licensed driver? Are you over 21 years of age?

“The precise facts and figures that we need to know about people is the strongest trend and FIDO has been a huge part of this trend,” Wilson said. “FIDO at many levels has legitimized the transition from who to what as FIDO has prioritized one to one authentication over general purpose identification.”

Region: Korea 

FIDO is also seeing strong adoption in Korea.

In the Korea block, Stephen Oh, CEO of TrustKey Solutions, explained that the Korean National Institute of Security (NIS) released national security requirements in September 2021 which strongly recommends the use of FIDO for multi-factor authentication.

“The Korean Government has now recognized the importance of FIDO authentication,” Oh said.

Beyond just recognition, Oh outlined how his organization has been able to help Korean government agencies as well as private corporations with a FIDO based solution for strong authentication.

Region: ASEAN / ANZ

During the ASEAN / ANZ block of content, Chong Seak Sea, Chief Technology Officer at Signing Cloud Shd Bhd, outlined the Malaysian government’s efforts to create a simpler and stronger online authentication ecosystem. At the end of his presentation he was joined by Muhammad Fendi Osman from the Ministry of Finance Malaysia who emphasized his Ministry’s confidence in FIDO as an approach to enable strong authentication.

Khanit Phatong from the Electronic Transactions Development Agency (ETDA) provided insight in his session into the Digital ID Outlook in Thailand. Phatong noted that the FIDO UAF standard is now being used as part of a national digital ID framework, with plans to move to FIDO2 in the future.

Rounding out the case studies for ASEAN / ANZ was a session on FIDO in Australia, that was delivered by Chris Hockings CTO Security, IBM A/NZ and Shane Weeden Senior Technical Staff Member, IBM. Hockings noted that FIDO adoption has been recommended by multiple agencies in Australia including the Australian Signals Directorate (ASD/ACSC) for strong authentication.

Day 3 / Region Japan

The final day of the APAC Innovation virtual summit included regional sessions for Japan and Taiwan.

Among the users presenting in the Japan block of content was Yuya Ito, Vice President, ID Solution Division at Yahoo! JAPAN. During his session, Ito detailed the implementation and Expansion of Passwordless options powered by FIDO that are running in Yahoo! JAPAN.

Another interesting use case was presented by Osamu Sugimoto, Professor, Faculty of Management at Josai University. Sugimoto used his session to detail an implementation of a FIDO2 server and passwordless network using campus ID type security keys.

Region: Taiwan

In Taiwan, FIDO is set to play a starring role in a major development effort to enable a national identity system for financial services.

Brenda Hu, Director General of the Financial Supervisory Commission in Taiwan, explained that her organization is the sole regulator for financial markets and services in Taiwan and it’s taking a big step forward with FIDO.

Hu observed that usually people have many bank accounts, ATM cards, electronic payment accounts and other financial service accounts.

“In other words, people have to spend time and effort to remember and keep their account names and passwords secure,” Hu said. “As friends of the FIDO Alliance, you know the negative side of passwords and usernames, this is a time consuming process not only for customers, but also for financial institutions.”

To help improve the experience for both consumers and financial institutions, Hu’s agency in Taiwan is leading an effort that aims to help provide an interoperable and unified approach for user identity and authentication for financial services.

“The standard mechanism for mobile ID verification includes many aspects, but incorporating FIDO authentication is our first and a critical part in the mechanism,” Hu said.

The Authenticate APAC Innovation virtual summit was the last Authenticate event for 2021 and capped off a year of insightful content on strong authentication and identity. 

In March, the Authenticate Virtual Summit: Modern Authentication for Financial Services event brought experts and users from the financial community together to talk about FIDO. In June, the Authenticate Virtual Summit Focus on Europe was hosted by the FIDO Alliance,providing visibility into how strong authentication and identity is being deployed in Europe.

Then in September, the FIDO Alliance hosted an Authenticate Virtual Summit on the Imperative for Strong Authentication for Government Services where details on government deployments were detailed. More recently, in October, Authenticate 2021 provided a live and online event with three days of sessions (catch the Day 1, Day 2 and Day 3 recaps here).

There’s much more to come from the FIDO Alliance in 2022!

Day three of the Authenticate 2021 conference provided a great conclusion to the live event with insights on how FIDO is being used and direction on what’s coming next, as the journey to the passwordless future continues.

In a morning session, Christiaan Brand, Senior Product Manager at Google, outlined how the FIDO specifications have evolved in recent years from U2F to FIDO2 WebAuthn. Brand said that while U2F was originally considered mostly as a second factor authentication approach, with FIDO2 the scope has expanded to being a technology that can replace passwords.

A FIDO2 approach known as Discoverable Credential Support was highlighted by Brand as a way to help enable the passwordless future. With Discoverable Credentials, the FIDO security key or authenticator will remember all of the user’s credentials and it will present them, almost like a password manager whenever the user needs to sign in.

Another effort that is in development is the cloud-assisted BLE (Bluetooth Low Energy) pairing initiative also known as caBLE, which is intended to make it easier for authenticators to be used with different sources.

“The idea is that every platform implements this caBLE protocol natively And then when an authentication event triggers, you can use this protocol to get data sent from the device,” Brand said. 

The Challenge of Account Recovery

A key challenge for user accounts is the issue of secure recovery. No matter how secure the authentication is to access an account, if there is a weak recovery system in place, an attacker will be able to bypass security.

“Account recovery is really just another form of authentication,” Dean Saxe, Sr. Security Engineer at Amazon Web Services stated.

In a session, Saxe detailed what he referred to as the Iron Triangle of Account Recovery, which includes the concerns of access continuity, security and privacy. Saxe noted that the account recovery mechanism itself should be reasonably secure, preferably as secure as the primary authentication. 

“What we don’t want to create is a gate that you can walk around, or walk through because we haven’t secured the gate with a fence all the way around the thing that we’re trying to protect,” Saxe. “So the recommendation is to register multiple authenticators, so you have a backup.”

User Stories Cambridge Housing Authority and National Guard

Among the users that spoke on Day 3 of Authenticate 2021 was Jay Leslie, CIO of the Cambridge Housing Authority. 

Leslie recounted that his organization was the victim of spear phishing attack and he was looking for a way to help provide a more secure approach to user account authentication.

Leslie said he looked at a number of different approaches including virtual smart cards and ended up discovering FIDO via peers that were using the technology. 

What Leslie quickly realized was that FIDO would be easily supported within his environment with a lot of the organization’s existing processes and infrastructure.

“The other thing I love about FIDO is that there are many different authentication methods that you can do,” Leslie said. “There are keys like YubiKey and Solokey and there is also Windows Hello where you can just type in a PIN, and for us, I think that provides us an easy glide path.”

Enabling an easy flight path for remote workers is also top of mind for Major Liaquat Ali,  the RPA Cyber Space Operations Officer at the 107th Operations Support Squadron (ACC) Niagara Falls ARS, New York, Air National Guard.  

Major Ali said that this organization was able to recognize significant cost savings by implementing a FIDO based authentication approach that makes use of YubiKey and the ID.me identity proofing service.

Of interest, Major Ali noted that 70% of his users reported that they were also using their FIDO security keys to help provide secure access for personal accounts.

The Intersection of Zero Trust and Authentication

Megan Shamas, Director of Marketing at the FIDO Alliance, moderated an afternoon panel on Zero Trust, which is often closely associated with Identity and Access Management (IAM) activities.

A core question that the panel discussed is what the top obstacle is to implementing strong authentication. Christine Owen, Director at Guidehouse, said that in her view people are often the issue.

“Part of it is because when you are changing processes, you need to have good communication with your stakeholders and with your customers to understand why it is you’re changing what you’re changing, and how their life is going to be different and better,” Owen said.

Jamie Danker, Senior Director of Cybersecurity Services at Venable, commented that ironically trust is the biggest obstacle. Users are often worried about the privacy implications of authentication and security mechanisms.

“You need to consider how information is used for just that authentication purpose and not used for other purposes,” Danker said. “Think about things like how you can minimize the data, and how you are going to inform your users about the use of the data.”

Improving Trust in Authentication

The idea of improving trust in users was the topic of an afternoon session from Kayla Shapiro, Production Engineer at Facebook. Shapiro helps to lead a team that works on improving the internal security and access to employee facing systems.

“We use technologies and build software that enables us to make use of digital identities that let us start to trust that person or machine is who they say they are,” Shapiro said.

Shapiro detailed the intricate approach that Facebook uses to ensure that credentials are stored safely. One of the technologies is something that Facebook developed internally known as Secure Key Storage (SKS), which makes use of Secure Enclave on Apple and TPM on Windows systems to store private key information. Facebook also makes use of FIDO based strong encryption for user authentication to help limit risk.

“Trusting a user means trusting your source of truth,” Shapiro said. “It’s not enough to have the strongest authenticated authentication methods in the world, if you can’t say with confidence that the data that backs those methods isn’t stored securely.”

Towards Usernameless Authentication with FIDO

Dmitri Tyles, Sr. Director of Engineering at Deltek, used his time on stage to explain how his company, which builds ERP software, is using FIDO in the technology it sells.

One of the interesting uses that Tyles described is an approach known as usernameless authentication. With that approach not only is the authentication passwordless, it also doesn’t include a username either.

“It means that a user doesn’t have to provide a user ID on the login screen as identity is stored on the device itself, as we’re using the capabilities that FIDO provides,” Tyles explained.

Deltek is also using FIDO as a means to digitally sign a transaction. Tyles noted that while authentication is the primary focus for FIDO2, it also provided a powerful approach to digital sign things.

The Future of FIDO

During the final panel for the live Authenticate 2021 conference, speakers praised the event and the progress that FIDO has made to date.

Google’s Brand noted that he’s cautiously optimistic that basic challenges of authentication are now technically solved by the FIDO2 specifications.

“Now it’s up to us to do a bunch of implementation and that’s happening sometimes a little bit slower than we like but in general, things are moving forward,” Brand said.

Microsoft’s Dingle agreed and noted that with FIDO2 in place the industry is now in an amazingly luxurious position to try to tackle second order problems. “It’s great that we’re now able to look at nuances and subtleties in the specifications that we never could before,” she said.

Rounding out the conference, FIDO Alliance Executive Director Andrew Shikiar noted that seeing users talking about implementation over the course of the Authenticate 2021 event was a rewarding experience.

“It’s really rewarding and amazing to see so many people sharing their successes, since just  a couple of years ago we couldn’t find anyone because they really were just at the pilot phase,” Shikiar said. “The data is coming in and it’s all pretty positive. FIDO works and FIDO works well.”

That’s a wrap for the Authenticate 2021 event, we look forward to seeing everyone in person at the 2022 event scheduled for Oct 17-20 in Seattle.

The second day of Authenticate 2021 was a full day of keynotes, sessions and panels about the continuing progress and opportunities for FIDO authentication, digital identity and a passwordless future.

The day started with a rousing keynote from Microsoft outlining how the tech giant is looking to end passwords.

“About a month ago, we actually announced in our consumer practice that you can now delete passwords all together from your account, and only use strong authentication,” Pamela Dingle, Director of Identity Standards at Microsoft said. “In doing that you’re deleting the risks and frustrations that come with passwords.”

The risks that come from passwords is a topic that Microsoft has researched at great length in its latest Microsoft Digital Defense Report. Dana Huang, Director of Engineering for Enterprise and Security at Microsoft Azure, noted that according to the report, phishing attacks are responsible for 70% of the breaches that Microsoft is seeing. On the more positive front, Microsoft has also observed a huge increase in adoption of strong authentication over the past year of 220%.

While some organizations and users might think they aren’t at risk from a phishing password related attack, Dingle emphasized that every account matters.

“Now you may have to take a triage type of approach to strong authentication, you may have to start with your administrators,” Dingle said. “But the truth is that any account that can be compromised can become a wedge by which an attacker can move laterally across your enterprise.”

Visa’s Passwordless Strategy

Moving to a world without passwords is also a key strategy for David Henstock, Head of Product, Identity and Authentication at Visa.

“When it comes to authentication, what we want to do is pretty simple, we want you to forget about passwords,” Henstock said. “We want to get passwords out of our ecosystem.”

Henstock added that countless studies have proven that knowledge based authentications don’t work and it’s nearly impossible for the consumers to juggle password managers.

“We just need a better way, and FIDO, we believe is that way,” Henstock stated emphatically.

Hacking MFA

Not all Multi-factor authentication (MFA) technologies are the same and in fact most non-FIDO methods are potentially hackable, according to Roger Grimes, defense evangelist at KnowBe4.

Grimes noted that attackers are not necessarily directly attacking MFA solutions, but rather are often phishing the human that is using MFA, in an attempt to bypass the normal execution of MFA.

“With an MFA attack the really common approach is to convince the victim to visit a fake website through an email or social media,” Grimes said. “So the victim thinks that they’re going to a site that they intend to go to that they’re going to log on to using multi factor authentication, and what the attacker does is trick them into going to some man in the middle proxy website.”

Somewhat ironically, Grimes emphasized that the whole reason many organizations are going to MFA is to try and limit the risk of social engineering phishing attacks. In his view it is incumbent on organizations to choose the right strong authentication approach to limit phishing risk.

Certification is a Hot Topic at Authenticate 2021

Certification was the topic of a number of sessions on day two of Authenticate 2021. Dr. Rae Rivera, Certification Director for the FIDO Alliance, outlined the value of certification in an afternoon session.

Rivera also discussed a number of new certification efforts including the FIDO Certified Professional and the Document Authenticity Certification. She explained that the FIDO Certified Professional is about helping organizations that want to deploy FIDO so they can hire professionals that are knowledgeable.

The Document Authenticity Certification is a bit of a different type of effort for FIDO, which is generally more concerned about authentication, though in recent years identity and authentication have become increasingly intertwined. What has also become apparent is the need for standards based certification efforts for documents that are used to help authenticate and verify user identity.

During a panel session about the document authentication certification effort, Stephanie Schuckers, Professor at Clarkson University, explained the constituent components of the initiative. There’s the document authentication component and then there’s the face verification piece .

“Essentially what the goal is is when you take a photograph of a document, you’re trying to determine, is this a legitimate document and you’re trying to gather information from the document,” Schuckers explained.

With the face verification piece, which can involve a selfie image, the document authentication certification effort will attempt to verify how well the selfie image matches the face, gathered from the document. Additionally, she noted the certification will require a liveness piece to make sure the selfie image is of a real live person, and not just a reproduction or fake.

The topic of having a digitally verified form of identity was also part of a panel discussion on mobile driver’s licenses (mDLs). David Kelts, Director of Product Development for Mobile ID at GET Group, commented that today there are already tens of thousands of mDL holders in pilot or pre-production and hundreds of thousands in pilots expected in 2022.

While mDLs are for motor vehicle operation, Kristina Yasuda, Standards Architect at Microsoft, observed that  just like the physical form of driver’s licenses, they will also be useful for other types of identity use-cases, including age verification.

User Experience is Key to FIDO Success

No matter how good FIDO based technology is, it’s no good if users don’t adopt it. That’s an area that goes beyond just technology, to understanding and optimizing the user experience, which was the topic of several sessions.

Kevin Goldman, Chief Experience Officer at Trusona, observed during a session that for designers and application teams, it’s often viewed as being easier to just have a username and a password, as that’s what they have always done and the tooling and workflows are long established.

“So, there’s friction, not only in the end user experience that we need to solve for, there’s also friction in the experience of the makers,” Goldman said.

The FIDO Alliance recognized that user experience (UX) matters and established a task force in 2020 to create guidance on how it can be optimized to be easier for both end users and the makers. The guidance is now publicly available at: fidoalliance.org/ux-guidelines

“As an anecdote of all the work I’ve done at FIDO this project was probably the coolest thing,” Andrew Shikiar, Executive Director and CMO of FIDO said. “We have a lot of security and authentication identity experts but actually working with capital D designers and UX people is really important.”

Bringing FDO to the Internet of Things

FIDO Authentication helps to enable users to authenticate services and a new effort is now going to help enable authentication for onboarding of Internet of Things devices and sensors.

David Turner, Director of Standards Development at the FIDO Alliance, explained that the FIDO Alliance launched the IoT Technical Working Group (IoT) TWG in June 2019 to help solve the challenge of device onboarding. Intel contributed their Secure Device Onboard specification which served as a starting point for what is now known as the FIDO Device Onboard Specification (FDO) specification.

“We’re basically looking at drop shipping a product, having someone receive it and physically put it wherever it’s going to go, turn it on and have it connect automatically with no other human interaction required,” Turner said.

User Stories: Target and Wayfair

Among the users that spoke on day two were Target and Wayfair.

Tom Sheffield, Senior Director of Cybersecurity at Target, explained that his company has been on a FIDO adoption journey for several years as the retailer looks to enhance security.

“We recognize the inherent weaknesses in passwords, the need for strong authentication capabilities and we want to improve user experience,” Sheffield said. “We want to increase productivity, while also enabling our team members to do their job securely, and in a compliant way as secure by default is our design pattern.”

One of the areas where Target is deploying FIDO is for its own operations. With a deployment of biometric, fingerprint authentication devices, Target has been enabling FIDO based strong authentication across its internal applications. Sheffield said that over 99% of his users have been able to register for, and leverage fingerprint ID, without needing to engage any help desk support.

A key thing for Target’s deployment was making it understandable and attractive to users. To that end, Sheffield emphasized that words matter.

“We didn’t say password less, because we’re not getting rid of passwords, at least yet,” Sheffield said. “Nor did we say Fido, because it is a dog’s name, and it’s an unknown term outside of the identity community.”

For Mike Virginio, Senior Manager, Corporate Security Engineering at Wayfair, words also matter. Like Target, Wayfair is using FIDO to help secure its operations, including corporate headquarters,  call centers as well as warehouses. Wayfair stated on its FIDO journey in 2019, not to be passwordless, but rather to just use less passwords in its operations, to help reduce the risk and operational hassles.

One thing that Virginio experienced that he wasn’t quite expecting was that there were people within Wayfair that actually liked using passwords.

“It was shocking because my whole life I’ve heard that passwords stink, and they’re hard to use and remember and so on,” Virginio said. “But it is something that’s very familiar, people understand how it works and there are recognized support mechanisms for them that have been used for a long time.”

To help get past that resistance he suggested that implementers be transparent about the technology that is being rolled out and create articles, user guides and diagrams that explain what FIDO strong authentication is all about.

“Coming to the table prepared and having those diagrams and so on, ahead of time is really helpful,” Virginio said.

Day Three is Loaded with Content

Day Three of Authenticate 2021 gets underway on Oct. 20 with sessions from Google and Amazon Web Services kicking off the day. User stories are also plentiful with sessions from the Cambridge Housing Authority and the New York Air National Guard among others.

There is also a not to be missed panel on the intersection of Zero Trust and authentication. And of course there’s the party! 

The first in-person Authenticate event got underway on Oct. 18, with both live and remote attendees watching the proceedings from the Motif Hotel in Seattle, WA.

The first day had a mix of industry leader keynotes and adoption stories about the role of strong authentication and the FIDO Alliance in helping to secure and enable the modern digital economy.

Andrew Shikiar, FIDO’s Executive Director and CMO, kicked off the Authenticate event announcing a series of new initiatives including the Online Authentication Barometer and the FIDO Certified Professional Program.

“The goal with the Online Authentication Barometer is to track what are the latest consumer habits, trends and adoption points of modern authentication technologies across the globe,” Shikiar said.

Shikiar noted that the research was what he referred to as a ‘mixed bag’ with many users still clinging to passwords. That being said, he noted that the research shows some positive trends in that people are aware that they need to do more, yet they’re not quite taking the right approach.

As part of the effort to help advance FIDO deployments, Shikiar explained that the new FIDO Certified Professional Program is all about helping to train professionals who wish to improve and showcase their FIDO deployment skills. 

“We think this will help address the implementation skill gap, and also get these professionals a chance to showcase skills which will help them be more marketable for future jobs and employment,” he said.

There are Two Types of MFA: FIDO and Legacy

In an engaging keynote, Bob Lord, former Chief Security Officer for the Democratic National Committee (DNC), outlined his views on strong authentication and detailed how the DNC was able to rapidly scale up and deploy it during the last election cycle.

Lord emphasized early in his keynote that there are two types of MFA today: FIDO security and Legacy 2FA that needs to be replaced. Simply put, non-FIDO forms of MFA can be phished and that’s a risk that really worries Lord.

“I call it legacy because I want to put into your mind the idea that this is something that you need to eradicate,” Lord said of non-FIDO MFA. “If you’re an IT person working on the inside of an enterprise you need to eradicate this, if you are a service provider offering services to either enterprises or consumers, you need to think about eradicating it as well, whether it’s SMS or an authenticator app, as the situation is likely to become super urgent seemingly out of nowhere, seemingly overnight.”

To help protect the DNC, Lord – who joined the DNC in 2018 – began a push to adopt FIDO. During the election cycle, he noted that more than 3,200 people joined the campaign effort and they all needed security keys. As part of the onboarding process for the campaign every person had to get a security briefing where they were educated on the importance and usage of security keys. Going a step further, if a new person missed the security briefing they were kicked out of the rest of the onboarding process by human resources until the security piece was completed.

“It’s fine of the security team to say security is important to people, they expect that,” Lord said. “What’s critical is for different parts of the organization, the management chain to say, it’s actually a core value.”

Dave Kleidermacher, Google’s VP of Engineering for Android Security outlined what he sees as big challenges of digital safety during his keynote. Those challenges include the need to have simple, strong access control over digital and physical spaces and identity. That’s where he sees digital wallets that benefit from FIDO specifications as being a big help.

Kleidermacher explained that Android devices now offer a digital wallet with a built-in security key. 

“We’ve worked with the FIDO Alliance to build standard protocols and API’s for developers to incorporate what’s really a miracle of unphishable authentication to any service,” Kleidermacher said. 

The legacy of past authentication methods was also the topic of Derek Hanson’s keynote. Hanson is VP of Business Development at Yubico, and in his talk he detailed the painful history of past authentication devices, where users had to carry a separate unique key for each service.

“With FIDO2, what we saw was solutions to all of the lessons and the pains of the past, actually being

incorporated into solutions that we could go build,” Hanson said.

FIDO for 5G

Among the big telco adopters of FIDO is Verizon which is using strong authentication for a number of different services.

Josna Kachroo, Sr. Manager for Device Technology at Verizon, commented in a session that password phishing continues to be a major problem. She noted that Verizon has adopted FIDO standards to enable a best in class authentication solution and one that is able to scale across many different use cases. Bjorn Hjelm, Distinguished Member of Technical Staff at Verizon, outlined a number of use cases including the ZenKey app that is a joint development across AT&T, T-Mobile and Verizon to enable access to services.

The need for strong authentication and FIDO is also important for 5G wireless. Hjelm explained that 5G enables operators to do network slicing. With network slicing, an operator can virtually reserve network resources for a specific purpose. One such specific purpose can be for first responders, where there is a need also for strong user authentication in order to grant access to the service.

“We are positioning FIDO as part of the user authentication for first responders,” Hjelm said.

The Challenge for Developers

The challenges and opportunities that developers face with FIDO was the topic of an engaging panel session at Authenticate. Moderator Vittorio Bertocci, Principal Architect at Auth0, asked panelists where the biggest blockers were with FIDO deployment for developers.

Nick Steele, Principal Security Research Engineer at Gemini Trust, sees terminology as being a big blocker.

“There’s a lot of terminology that can trip people up, and it can sort of confuse developers that are coming in with basic or even zero knowledge about what FIDO is about,” Steele said.

Steele suggested that there is a need for more developer education and materials to help show how FIDO technology is built. Simon Law, co-founder and CEO of LoginID, commented that while there are many robust libraries to help developers implement FIDO, it’s not always a plug-and-play deployment for most use cases at this point.

“Really you need the attestation and it’s still confusing now,” Law said.

Managing Risk with an Enterprise Plan for FIDO Deployment

The path to implementing FIDO and strong authentication is all about managing risk, according to a pair of speakers from Capital One.

Vaibhav Gupta, Cyber CTO and Product Manager for IAM and Capital One, noted that many organizations grow via mergers and acquisitions, ac

cumulating technical debt and a confusing array of authentication schemes. While there is complexity, with the right plan in place, it’s possible to eliminate some of that technical debt in the journey toward FIDO.

Kiran Mantripragada, Senior Manager, Identity and Access Management at Capital One, explained that the first step in the journey to passwordless is for the organization to get control over its applications by creating an accurate inventory of what’s in use and how each application does authentication.

She suggests that once the inventory is understood, it makes sense to group related applications together with Federation and a Single Sign On (SSO) approach. The next step is to start introducing MFA and passwordless approaches. Mantripragada cautioned that there can be resistance from application teams to rolling out MFA and passwordless so she suggests taking a risk based approach to deployment.

“Identify opportunities where by applying MFA and modern authentication will reduce the risk profile and get you the biggest bank for the buck,” she said.

More coming on Day 2 of Authenticate

What a great start with Day 1 and there is much more to come. On Day 2 of Authenticate, are keynotes from Microsoft and Visa. We also have multiple panels tackling hot topics including document authentication and mobile driver’s licenses (mDLs), also known as digital driver’s licenses.

There’s also no shortage of insight into FIDO with sessions on the value of certification and understanding the importance of user experience.

Authentication plays an increasingly important role in how governments are providing services around the world.

At the Authenticate Virtual Summit on Sept. 23, 2021, users, experts and vendors from around the world detailed how strong authentication helps to enable government services and new efforts to secure online identities. Users including the U.K. National Health Service (NHS), as well as the U.S. Government’s login.gov and Internal Revenue Service (IRS) provided insights into the present and future of online authentication and digital identities.

In the opening session of the event, Andrew Shikiar, executive director and CMO of the FIDO Alliance, outlined
the strategic imperative for FIDO in government services around the world.

“COVID-19 created an imperative to really accelerate digital transformation activities,” Shikiar said. “When the pandemic hit all of a sudden, everyone was at home and all activity brought requirements for modern authentication schemes that go far beyond passwords, even beyond traditional multi-factor authentication.”

Shikiar noted that the FIDO Alliance standards align very well with global regulations and policies and there is a growing trend of government guidance for authentication that cites the use of FIDO.

“It’s important to enable trust in the government ecosystem,” Shikiar said. “This comes through the engagement FIDO does with different regulators and government bodies and ultimately will be manifested through the secure implementation of digital identity services to citizens worldwide.” 

Technology Helping to Push FIDO Strong Authentication Forward

A key path for enabling FIDO specification is via vendors that support government efforts. 

Patrick Sullivan, CTO of security strategy at Akamai, commented that password credential stuffing attacks are very common. He noted that Akamai’s platform sees as many as a billion password attacks per day. That’s where multi-factor authentication and more specifically strong authentication based on FIDO Alliance standards play a strong role. Sullivan noted that there is a clear need to provide multi-factor authentication in a low friction environment where it’s delivered in the form factor of an app on a smartphone.

“We’re not asking users to carry around a hardware token to accomplish FIDO2 as we move in that direction,
and by introducing less friction, there’s less risk of our users doing something anomalous,” Sullivan said.

Jeff Frederick, manager of solutions engineering at Yubico, noted during his session that in government, many agencies in the U.S use Common Access Card (CAC)/Personal Identity Verification (PIV) credentials that go beyond basic passwords. Frederick noted that FIDO2 standards, which are supported on his company’s YubiKey device, provide a strong impersonation resistant authentication protocol that uses public private key cryptography.

“It’s very similar to PIV/CAC and FIDO2 is an open standard that’s managed by the FIDO Alliance, so that any vendor can support this and use it today,” Frederick said. “It’s built into all major operating systems and all major browsers so there’s no middleware that you need to install to make this work and it’s just an easy to implement solution that will modernize the federal authentication infrastructure across the board.”

Making Identity and Authentication Less Taxing at the IRS

The IRS proofs and authorizes tens of millions of taxpayers every year, across both digital and non digital channels, according to Courtney Rasey, assistant to the director, Identity Assurance, Privacy Governmental Liaison, & Disclosure (PGLD) at the IRS.

“None of those tens of millions of taxpayers who are calling the IRS are doing so just because they want to, it’s not really a fun weeknight activity,” she said. “They need to resolve an issue to meet their tax obligation and we know that, so we’re always striving to provide better service to taxpayers, to help them get the service that they need in the most convenient and efficient way possible.”

One way the IRS is looking to be more convenient to taxpayers is with its Secure Access Digital Identity (SADI) platform that was launched in June of 2021. Rasey explained that SADI leverages a Credential Service {rovider (CSP) that identity proofs the taxpayer and then provides the IRS with a digital identity credential.

“Users are eventually going to be able to access all IRS online applications utilizing that single digital identity credential,” Rasey said. “The IRS is moving more and more applications behind SADI throughout fiscal year 2022 and as we do move more applications taxpayers are going to be able to do so many things with just one credential.”

Moving Toward Zero Trust with Strong Authentication

In May, President Biden signed Executive Order 1402, which directs U.S. government agencies to improve cybersecurity. One of the primary provisions of the executive order is to move the federal government toward a zero trust architecture.

“When we talk about zero trust, we’re talking about an architecture where people and their devices aren’t trusted just by virtue of being inside an organization’s enterprise network,” explained Eric Mill, senior advisor, Office of Management and Budget (OMB).

Mill noted that in a zero trust model, people and devices are validated at each step and  authentication is context-aware. The OMB is strongly encouraging the adoption of phishing resistant multi-factor authentication, with FIDO WebAuthn as a good alternative option in environments where CAC/PIV isn’t feasible.

“We’re pushing very hard on multi-factor authentication and we really view reliable authentication as a critical foundation of zero trust architecture,” Mill said.

In a Policy Deep Dive session, Jeremy Grant, managing director, technology business strategy at Venable, noted that there are a number of reasons why authentication is important to governments. 

Grant said that FIDO specifications can help governments to protect access to their own assets and can help to enable more high-value citizen facing services to the public. 

“I think what we’re seeing in 2021, is a really different environment across the globe, where FIDO authentication is emerging, not just as another permitted option, but in many cases as a preferred choice of governments across the world,” Grant said.

How the National Health Service (NHS) uses FIDO

Among the areas in the world where FIDO is finding a home is in the U.K. 

The National Health Service (NHS) is the publicly funded medical and healthcare system in the U.K. and it has embraced FIDO standards to help improve human health.  With the NHS Login service, citizens get a centralized identity for health services
while the NHS app provides a simplified application for accessing and managing an individual’s access to
health services.

Priyanka Mittal, technical architect for the NHS Login and NHS app, said that over the past 18 months there has been a 10-fold increase in the user base for NHS login as demand has grown during the pandemic.

Sean Devlin, tech lead for the NHS App, explained that initially the services started out using an SMS based two-factor authentication approach, but wanted to find a more seamless approach. NHS decided to use FIDO UAF and built out its own implementation, using eBay’s open source FIDO implementation as a starting point.

Devlin said that before using FIDO, users had to navigate as many as five different screens to get through a multi-factor authentication flow. With FIDO, it’s a single screen.

The NHS has also saved a lot of money by moving to FIDO. With over 500,000 FIDO logins per day, Devlin estimates that the NHS is saving on the order of £8,000 per day on SMS messaging costs.

Bringing FIDO Strong Authentication to Login.gov

FIDO specifications also play a pivotal role at login.gov, which is a single sign-on platform for U.S. government services.

Jonathan Hooper, login.gov Engineering Lead at the General Services Administration (GSA), explained that the authentication portal fronts over 200 sites across the U.S. government,  spread across 27 different agencies. Hooper explained that starting in 2018, login.gov began expanding the use of multi-factor authentication, including the WebAuthn specification.

“We don’t want to be ‘big brother,’ we want to make sure that we can protect users’ privacy and the things built into the protocol that helped to do that were very attractive to us,” Hooper said. “WebAuthn is also very cheap, it is much cheaper to do a WebAuthn authentication event than it is to do SMS by several orders of magnitude.”

Improving Digital Identity with FIDO

A FIDO-based approach for digital identity could soon be finding its way to Canada as well according to Joni Brennan, president, Digital ID & Authentication Council of Canada (DIACC). An effort currently underway is the Pan Canadian Trust Framework (PCTF) which is an information assurance framework.

“We think that there’s a great opportunity here to leverage an information assurance framework, coupled with FIDO Alliance driven specifications, to create and to verify that end to end experience that’s needed for digital ID adoption,” she said.

The need for secured digital identities was also highlighted by Amit Mital, special assistant to the President and senior director, National Security Council at the White House.

“Today, when we authenticate ourselves and identify ourselves, we might use one of dozens of popular systems,” Mital said. “

So the ecosystem itself is very decentralized, and it’s very unharmonized. It is also fundamentally unsecure.”

Mital said that there is a clear need for strong remote identity solutions that can provide easy, secure, affordable and reliable ways to identify consumers across digital systems. 

“It’s clear that there are a diverse and large number of scenarios that need digital identity and there is no single entity that can solve all these scenarios,” Mital said. “We need an ecosystem that brings together the best ideas and innovation from the private sector, both large companies and startups, as well as the government at both the federal and the state, the local, tribal and territorial lands.”

Wrapping up the day’s event, Andrew Shikiar, executive director of the FIDO Alliance, observed that there are a lot of conversations ongoing about  different types of government services and their dependency on secure digital identity.

“Ultimately, identity and authentication are core to deploy new services at scale, in a way that meets the requirements for government agencies, and for citizens alike,” Shikiar said.

The webcast is now available on demand. To watch the recording, visit the event page.

For more discussions on moving past passwords to modern strong authentication, attend Authenticate 2021 on October 18-20, 2021 in Seattle or virtually. The full agenda and details to register are available at authenticatecon.com. 

September 23 event features executives from Akamai, GSA, IRS, NHS, OneSpan, Yubico and more

MOUNTAIN VIEW, CA, AUGUST 31, 2021 — The FIDO Alliance has announced the agenda and speaker lineup for its next Virtual Authenticate Summit, “The Imperative for Strong Authentication for Government Services,” taking place September 23, 2021 from 11:00 am – 2:30 pm EDT. Authenticate Virtual Summits are a quarterly series of virtual seminars that delve into the FIDO approach to modern user authentication across various markets and geographies.

Register for free and view the agenda on the Authenticate Virtual Summit event page.

“Government agencies around the world are rolling out more robust digital services for employees and citizens — and the COVID-19 pandemic has only accelerated this imperative,” said Andrew Shikiar, executive director and CMO of the FIDO Alliance. “Global standards and best practices are key to success in this digital transformation of e-government services — particularly in the areas of strong user authentication and identity verification. We’ve been happy to see the growing trend of governments referencing and leveraging FIDO’s outputs and look forward to sharing their insights with the broader Authenticate community.”

This government-focused Authenticate Virtual Summit brings together leaders from the public and private sector to examine strong authentication for government services, including considerations for implementing modern authentication systems for e-citizen services and remote government workforces, government agency case studies, the intersection with global policy and more.

This Authenticate Virtual Summit agenda includes:

• Keynotes from Akamai, FIDO Alliance, IRS, and Yubico
• A look at how the IRS is leveraging new digital identity proofing procedures for non-digital authentication
• Case studies from GSA and NHS on how they are leveraging FIDO to streamline and secure logins
• Discussions on the state of strong authentication in government and how policies and directives are changing how governments authenticate
• Considerations and best practices for optimizing the strong authentication for government experience

Akamai and Yubico are Signature sponsors for this Authenticate Virtual Summit. To participate as a sponsor, visit https://authenticatecon.com/sponsors/.

For more information about the Authenticate Virtual Summit Series: https://authenticatecon.com/introducing-the-authenticate-virtual-summit-series/.

About the FIDO Alliance

The FIDO (Fast IDentity Online) Alliance, www.fidoalliance.org, was formed in July 2012 to address the lack of interoperability among strong authentication technologies, and remedy the problems users face with creating and remembering multiple usernames and passwords. The FIDO Alliance is changing the nature of authentication with standards for simpler, stronger authentication that define an open, scalable, interoperable set of mechanisms that reduce reliance on passwords. FIDO Authentication is stronger, private, and easier to use when authenticating to online services.

Authenticate Contact

[email protected]

PR Contact

[email protected]

Agenda features practical sessions to move past passwords and towards modern authentication

SEATTLE, August 17, 2021 — Authenticate, the FIDO Alliance’s industry conference dedicated to the who, what, why and how of modern user authentication, today announced its full 2021 agenda. This three-day event, which takes place October 18-20 in Seattle and also with remote attendance options, will help educate attendees on business drivers, technical considerations, and overall best practices for deploying modern authentication systems. 

The Authenticate 2021 agenda features:

• Deployment case studies from enterprises and service providers including Capital One, eBay, Facebook, Google, Morgan Stanley, Target, Verizon, Wayfair and more 
• Technical deep dives on FIDO’s authentication specifications: IoT, biometrics and identity verification
• Vertical perspectives from leaders and practitioners in financial services, eGovernment, retail and communications
• In-depth discussions on the evolving policy landscape and deployment considerations therein 

“Relying on passwords is passé. Modern authentication systems and standards have emerged to provide more efficient ways for organizations to provide strong security and better interactions with their brands,” said Andrew Shikiar, executive director and CMO of the FIDO Alliance. “The FIDO Alliance encourages organizations of all sizes to prioritize stronger security, and it is our mission to share the tools and resources to help them get there. ​​This year’s agenda delivers on that mission, providing attendees with a strong foundation for deploying simpler, stronger authentication.” 

This year’s headlining keynote speakers are: Bob Lord, former CSO of the Democratic National Committee; Joy Chik, corporate vice president of identity at Microsoft; Stina Ehrensvard, CEO and founder of Yubico; David Henstock, head of identity and authentication products, Visa; and Dave Kleidermacher, vice president for engineering, Android security and privacy, Google. A full list of speakers is available on the Authenticate conference website. 

The conference agenda features 45+ in-person sessions and 20+ sessions on-demand, all of which will be available to all attendees. Authenticate also features an expo hall with product and service offerings with 20+ sponsors, as well as various networking and social events built into the three-day schedule – all while adhering to all CDC and local health/distancing requirements. 

Register Today!
Take advantage of early-bird pricing by registering by September 3. To register, visit https://authenticatecon.com/event/authenticate-2021-conference/. Authenticate will be held in conjunction with the FIDO Alliance member plenary, scheduled for October 20-22. FIDO Alliance members have exclusive access to discounted rates to attend both events.

Get involved at Authenticate

There are still select sponsorship opportunities available for Authenticate 2021; companies interested can learn more at https://authenticatecon.com/sponsors/.

Follow Authenticate on Twitter @AuthenticateCon to participate in the conversation and get important updates leading up to and during the event.

TWEET THIS: The @AuthenticateCon agenda is here! Visit the event website to take a look at this year’s speakers and session topics for the latest in user #authentication. www.authenticatecon.com

About Authenticate

Authenticate is the first conference dedicated to the who, what, why and how of user authentication – with a focus on the FIDO standards-based approach. Authenticate is the place for CISOs, security strategists, enterprise architects, product and business leaders to get all the education, tools and best practices to embrace modern authentication across enterprise, web and government applications.

Authenticate is hosted by the FIDO Alliance, the cross-industry consortium providing standards, certifications and market adoption programs to accelerate utilization of simpler, stronger authentication. In 2021, Authenticate will be held October 18-20 at the Motif hotel in Seattle, Washington with the option to participate remotely via live stream and on-demand sessions. Visit www.authenticatecon.com for more information and follow @AuthenticateCon on Twitter.

Authenticate Contact

[email protected]  

PR Contact

Morgan Mason
Aircover PR
408-612-9889
[email protected]