FIDO plans to eradicate bad passwords, bolster online identification
Connecting state and local government leaders
The Fast Identity Online Alliance will release a protocol to make secure log-in more user friendly, making it easy to replace passwords with stronger authentication.
An alliance of technology companies expects to release specifications soon for an open standards protocol intended to leverage existing authentication schemes in a seamless, user-friendly identity ecosystem.
The Fast Identity Online (FIDO) Alliance has spent the past two years creating the Online Service Transaction Protocol, which it hopes will make it easy to replace weak passwords with stronger authentication factors. A new company, Nok Nok Labs, has been created to manufacture servers to handle the back end of the process. The front end now consists of a browser plug-in that FIDO hopes will be built into or pushed out to client devices.
The scheme addresses challenges identified in the president’s National Strategy for Trusted Identities in Cyberspace, which aims to spur private-sector creation of an identity ecosystem to provide choices for user-friendly secure authentication for online activities.
The most widely-used factor for authentication today, the user name and password, is difficult to scale for both users and relying parties, resulting in weak and reused passwords that are vulnerable to theft and exploit. Stronger factors such as hardware tokens, biometrics and digital certificates often are not interoperable and can be expensive to manage when used for single applications.
The goal of the new alliance is to enable interoperability of existing authentication schemes with an underlying protocol.
“You’ve got to bake it into the Internet, not sell or rearchitect the network,” said Nok Nok CEO Phil Dunkelberger. “Standard protocols are going to be the only way to do this.”
Although the protocol and servers to manage them are close to release, widespread adoption is some time off, Dunkelberger said. “I think it will take the better part of 12 to 18 months,” before the plug-in is widely available on user devices, he said. It might be several years before the protocols are widely used for authentication by relying parties.
Promoters of the scheme are not discouraged by the lag time. It took federal agencies, a prime market for the scheme, years before they began using the Trusted Platform Module, a secure processor for storing cryptographic keys in hardware, said Clain Anderson, director of software for Lenovo, a FIDO member company.
“But they are moving aggressively now,” with TPM, he said. “We’re hoping they will be faster with this.”
Founding members of the alliance are Agnitio, Infineon Technologies, Lenovo, Nok Nok Labs, PayPal and Validity. The plan is to make the client software free. Organizations using the protocols on the back end will pay for hardware, software or services. The initial back end equipment is being built by Nok Nok, but the technology is not proprietary and competition is expected.
The client side will be a lightweight browser plugin that will be dormant until the user logs on to a site using FIDO protocols. The server will ping the device to determine if the protocol is available and what secondary forms of authentication are available on the device. After the log-in, the user will be prompted to enroll to use FIDO. The user can choose any of a device’s available authentication methods, including fingerprint readers, face or voice recognition, tokens supplying one-time passwords, and digital certificates, including those on government-issued Common Access Cards and Personal Identity Verification cards.
The identifying factors remain on the device and are authenticated there by the client software, and only the authentication result and an encrypted PIN is sent to the server. The process can be handled on the organization’s own server or by a service provider doing federated authentication.
Organizations using the scheme will be able to tie access privileges to the type of authentication being used. Users opting to stay with passwords might not get the same access as those using certificates or biometrics. Agencies supplying user devices could require the use of stronger authentication through FIDO.
“Cryptographically, it is much more secure,” than sending passwords or other tokens in the clear, Dunkelberger said.
The scheme will be sold to end users on the basis of convenience rather than security, Dunkelberger said. Some resistance is to be expected from users who ignore the offer to enroll.
“This isn’t going to happen overnight,” he said. “But it’s going to be offered after every transaction.”
NEXT STORY: The 4 levels of authentication in a mobile world