adriengibrat/Password.md

title: Password 💀 author: name: I'm Adrien, frontend developer email: a.gibrat@oodrive.com theme: ./theme controls: false output: index.html

--

Password 💀

--

Password sucks

Since 2018, Microsoft advocate
[The beginning of "The end of passwords"](https://www.microsoft.com/en-us/security/technology/identity-access-management/passwordless)

not secure haveibeenpwned 408 leaked dataset = 8 506 873 299 accounts
not user friendly password = complexity your mom doesn't use a password manager

-- screen full

--

Password policies 💩

various best practices [ANSSI](https://www.ssi.gouv.fr/guide/mot-de-passe/ "Agence Nationale de la Sécurité des Systèmes d'Information") ⚡ [NIST](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5 "National Institute of Standards and Technology")

never reuse password
use passphrase
check against lists (contextual, dictionary, common, leaked…)
SMS is not secure OTP (PSD2: banking deprecated SMS)
force special characters leet EvilCorp$1
force periodic password changes #… EvilCorp$2

-- screen large

Forget password 😡

-- screen large

Expired password 🤬

-- screen

FIDO alliance 👀

Fast ID online [Solving the World's Password Problem](https://fidoalliance.org/what-is-fido/)

--

Specifications 🤖

• FIDO U2F Universal Second Factor authentication
  using asymmetric cryptography with USB security key (+ NFC / BLE)
• FIDO UAF Universal Authentication Framework
  Passwordless Authentication with biometrics & external security device
• FIDO2 W3C WebAuthn (March 2019) API for accessing Public Key
  Secure passwordless & multi-factor authentication for the web

-- screen

Client to Authenticator Protocol 🤓

= cryptographic & biometric proof, NOT SMS^™

[CTAP 2](https://en.wikipedia.org/wiki/Client_to_Authenticator_Protocol) = WebAuthn authenticator specification
(CTAP 1 = U2F only)

-- screen

FIDO 2 support 💪

[Windows 10](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/), [Android 7+](https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/)(1B+ devices)
& all evergreen browsers, including [Safari](https://webkit.org/blog/8517/release-notes-for-safari-technology-preview-71/)

-- screen

Demo 👩‍💻

https://webauthn.io

-- screen

Simple workflow 🤗

**Registration** [](https://webauthn.guide/)

**Login** [](https://fidoalliance.org/key-differentiators/)

--

Password is dead, long live the password 👑

300 billion passwords by 2020
$6 trillion annual damage by 2021

Do FIDO2 passwordless & WebAuthn today!
Strong authentication is already a requirement for banking
and will eventually be one for other regulated industries.