so uh talk is everything you never knew
you wanted to know about passkeys and
back in February when I made this title
up it was very clever because past keys
were still writing kind of uh under the
under the covers it wasn't every week or
every day that we were hearing uh Google
announced something Apple down something
Microsoft down something one password
and on something OCTA and ping and
everyone kind of dog piling onto this so
um that is the title and people probably
know things about peskies now but this
is a one-on-one session so hopefully we
will be able to talk about the
technology talk about the tools that
underlie the technology and talk about
how you can take these back to your
organizations or back to the products
that you support and
use them to make intelligent choices as
you improve and further secure the
authentication process first disclaimer
everyone loves disclaimers that's enough
to be said about that
um next who am I hi I'm Josh I'm a
Solutions architect at ubico we make the
ubk uh Hardware authenticator
um
in the solutions architecture space I
have a great job where I get to focus on
standards and I get to focus on
regulations and understand what that
means in the authentication and the
authorization space and then translate
it for other people so I'm writing white
papers all the time I'm commenting to
customers I get to uh give presentations
for the office of the CTO talking about
oh this this means this in Europe and
this means this over in Japan and this
means this here and there and I get to
read a lot of stuff and I get to
understand a lot of stuff and
reading and understanding is a great
place to be
um as far as professional organizations
I'm a contributor to the Enterprise
deployment working group with the fidal
alliance we're actually writing best
guidance and best practice on how to
take phytotechnology and roll it out in
Enterprises I'm also a member of the
Cyber resilience Sig for ISSA again
we're looking at Best Practices to
ensure that cyber systems maintain
functionality and can be recoverable
easily I'm also a recovering editor for
the ID Pro Book of Knowledge which means
that I have edited quite a few articles
but I fell off that wagon a couple years
ago and I'm trying to get back on again
um in my general life I'm a big nerd uh
I've got way too many board games and as
someone who likes to read and understand
standards and regulations I do a lot
more reading of rule books than I
actually do playing board games which
leads to like a two to three shelves
worth of board games we've touched maybe
a third of them I'm a bow tie Enthusiast
I always encourage bow ties I'm a low
brow beer snob which means I like to go
drink
and uh I every every couple months I ask
myself the question is there such a
thing as too many Legos and then I test
that question and the answer is still no
um last but not least I consider myself
an IGA evangelist I like talking to
people about
building better systems better
authorization systems understanding how
identity impacts users just the last
talk we went to was about how they love
passwords and it wasn't about loving
passwords it was about understanding
your users and building good systems so
that users will adopt whatever type of
authentication and authorization you're
foisting upon them and that's really
important
and that kind of segues really well into
what our passkeys so this lovely
definition was taken from the Fido
Alliance again vital Alliance is a
large group of different organizations I
believe there's about 84 different
members all different uh Realms and
regions we've got Health Care we've got
Finance we've got Visa discover
mastercarder members you've got Google
Microsoft Apple yubico they all
contribute to the Fido standards for
Fido authentication and they came up
with this giant mouthful of Words which
really can be simplified to This
passkeys Little P peskies are phyto
credentials designed to replace
passwords to make users lives easier
and whenever you see passkey you'll see
this little guy
he doesn't have a name but I like to
think of them as past kpat
so if you are using pass keys and you're
building ux you want to use that type of
iconography
so
I've said Federal Alliance and
phytoauthentication a couple times so
then natural question is for those of
you who don't know what is
phytoauthentication so this is phyto in
a nutshell we can make it really easy by
comparing it to passwords or comparing
it to Legacy authentication where
passwords were human generated symmetric
Secrets both sides the user and the RP
needed to know the same piece of data
with Fido it's a machine generated very
randomized public private key pair the
user gets to hold and
um utilize their secrets material their
Secret side of that uh pki public key
cryptography certificate
um
Arrangement I'm blinking on the word I
apologize the the user gets to hold
their secrets material it is never
exposed to anyone uh when they go and
register an account or when they go to
do an authentication the RP the relying
party the SSO provider they use the
public key to challenge the user to
prove they have the private information
and that is how this works it means that
RPS no longer need to worry about
storing Secrets material it means you
don't no longer need to worry about
having big hash tables of passwords
because all you're worried about is
public keys and public keys are public
so they're out in the open by Design
um with passwords uh passwords can be
reused there's no checking to see where
a password is reused there is no
checking to make sure that you know
passwords haven't been used
cross-platform with Fido keys can be
generated so that they are bound to a
single relying party which means that if
you so choose when you are building a
system you can tell you as the RP can
talk to the authenticator and say
generate a new key pair only use this
key pair when you're talking to me
um passwords are easily fished again in
the last talk they made the uh the great
um
they reinforced the great study that was
done where people in a parking lot were
approached hey will you give me your
password I'll give you a candy bar and
it works
um Fido is fishing resistant even if
like someone comes and gets my Fido
credential they need additional pieces
of information in order to access it and
because it's about it can be bound to a
single RP it's not like you can take it
and use it necessarily other places
um last passwords there's lots of
attacks against passwords we've got
credential stuffing you've got social
engineering you've got
leaked large tables of cash tables of
passwords
um when you're talking about Fido
credentials they're impractical to
remotely compromise yes you can install
malware in a user's machine and yes you
can compromise the login process that
way but if you've got local malware
you've got a bigger problem already
uh Ryan party
so whenever you stand up a system that
needs to get logged into that's
considered the relying party
um so who has a pass key already raise
your hand if you've got an Apple device
raise your hand if you've got an Android
device raise your hand if you've got a
security key congrats you've all got
past Keys already
um with its rollout of iOS
16.2 Apple gave you all passkeys and
with a very recent update to Android
again Google gave us all pass Keys it's
the primary mechanism that Apple and
Google are using to authenticate that a
device is
um secure and it is the primary
mechanism primary authentication
mechanism that they're using to like do
validations against their backend
systems their iCloud system or their you
know Google account so if you've got
those Technologies in your pocket you're
using pass keys today and you don't even
know it and that really is the ux
process the user experience process we
should all be aiming for you can roll
these systems out using the standards
using the best practices the working
groups have put together and you can
make it invisible to people and when
things work like magic when you rely on
uh like fingerprint or face ID that
people are used to don't necessarily
tell them how it's working underneath
but rely on those Technologies you can
really Drive adoption and improve your
security footprint at the same time
security posture at the same time
so
um earlier on I said Little P passkey
and it's kind of important to understand
that there is a difference between big p
Pass Key and Little P Pass Key and it's
really Calvin ball right now there are
no rules
um the the technology as far as the Fido
standard goes is passkey with a little p
um that is the standard that is the that
is the name of the underlying technology
when you are reading announcements when
you were reading papers if it says
Little P Pass Key you can understand
that they're talking about the standard
if you see a a situation where it's a
big p Pass key as long as it's not at
the beginning of a sentence that is
implied that it is a vendor's
implementation of the standard
um so Apple passkey or Google Pass key
or one password Pass key or Microsoft
Pass key because Microsoft announced
that they're rolling these out in the
next couple months as well
um
the
passkey
standard is interoperable so if a device
supports Apple passkey you should be
able to use it where Google passkey is
supported however they are different
ecosystems and when we start talking
about some of the advanced features like
synchronization that's where things kind
of get murky and that's where we still
have some lines drawn between different
implementations
um so
brief talk about how passkeys work this
is public private key cryptography again
user has user generates a public private
key pair so they get a public
certificate and they get a private
certificate they then go through a
registration process where they go do an
identity proofing and they say I'm me
here's my public key
and depending on how the RP depending on
how the rowing party is configured the
relying party can say great and just
like associate that public key to that
user or the rawing party can say hi you
I'm me and uh let's go through this
extra special dance where you create a
different set just for me and that's uh
like a domain bound passkey where you
have a single
um you have a single Pass key that is
used only to authenticate against that
provider you can use those in terms in
in situations where you want to do
passwordless authentication or whether
you want to do a usernameless
authentication where you have a public
private key pair that is the private key
is controlled by the user the RP has
been assured that that private key that
public key and that private key are only
used for their system so that they can
connect that to an actual user and you
know authenticate on your phone and
Bob's your uncle
no need to put in a password no need to
put in a username no need to put in
anything because it's all cryptography
on the back end
um
this is kind of what the authentication
request looks like if you are using just
a generic public-private key pair one
that's not associated to his particular
rpay user makes a login request it goes
to the IDP RDP in the back end the IDP
sends a challenge to the client which is
either an app or a browser that client
then takes the challenge as well as the
origin where the challenge came from
sends it down to the authenticator the
user does a proof of presence and then
it Loops back up again it gets signed by
the authenticator the credential and the
signed response gets handed to the
client the client goes to the IDP and
then the IDP logs the user in
it's very important that this is a
bi-directional flow
historically MFA has been unidirectional
meaning you get a SMS code you can put
that SMS code anywhere that SMS code
says nothing about who generated it or
nothing about where I'm entering it
that's why we get replay attacks that's
why we get attacker in the middle
attacks because there's no verification
of the origin and there's no checking to
make sure that I'm actually putting this
into the right place Sam can be said
about
um like push notifications same can be
set about number matching there are no
inbuilt mechanisms that do that origin
checking because it's not a
bi-directional process there's no check
counter check sign counter sign it's
it's just one way
so
why do we say pass keys are easy this is
some of the advanced features or these
are some of the newer developments in
the 502 standard that are really meant
to drive usage and encourage usage by
users the first is sharing and syncing
historically you
wanted an authenticator you would get
like a hardware device like this and
you'd give it to a user and you would
say plug this into your computer and tap
on it or tap it on your phone and that's
great until they lose it and then you
have to worry about a re-registration
process you have to worry about you know
temporary validation you have to worry
about step down authentication or step
up authentication in order to go through
all that with passkeys they can be
synchronized across ecosystems so if you
generate a pass key on your iPhone it
gets synchronized to your iCloud account
the secrets material the secret key
actually gets synchronized to your
iCloud account and then you can use that
on any device that is tied to that
iCloud account
so you can generate a pass key on your
iPhone and then go to your Mac in Safari
and log into the same site using that
pass key
um
some providers allow for
synchronizations across ecosystems again
that's the iPhone where everything tied
to your iCloud keychain can be
synchronized some providers allow for
synchronization across devices these are
historically your password managers one
password is actually getting into this
game again because Apple big passkey is
limited to iOS devices what do you do if
you have a fleet of users half who are
on Apple devices have who are on Windows
devices you know with IOS and Android
mixed in for fun
one password has a scheme where they
actually store the secrets credential
out in their Cloud you use their Plugin
or their one password tool and you can
pull that Secrets material down and use
it on whatever device you want
um so again the usability
really is what the usability and the
replaceability is really what drove this
functionality and this feature set to be
put in place the second point or the
second part of why pass keys are
considered easier than some
other authentication mechanisms is uh
leveraging inbuilt patterns that we're
used to everyone's used to pulling out a
phone and scanning their fingerprint or
doing face ID to unlock their phone why
can't we take that that we have trained
our users to do we've trained our
customers and our consumers to do and
use that as part of the authentication
process or part of the login process
instead of having them punch out a uh
you know tap out a 16 character password
or whatever
so
um the authenticators the actual
Hardware leverage inbuilt platform tools
for those checks
lastly there's a lot of work in the ux
space especially around
I will get this wrong and I apologize
conditional ux autofill
um which means that when a browser
encounters a login instead of the
password manager saying I have a stored
password the password manager can say I
have a stored Pass key for this site and
just show that little passkey pad icon
and click on that and log in that way
um and the the point of that ux really
again is to hide all of that complexity
and hide all of the confusion from the
users
um so
we have uh two different models for
passkey storage uh the first is syncable
and copyable it's ping-ponging all
around here again uh pass keys can be
flagged to be synchronized across
devices other high Assurance use cases
you can have device band passkeys where
you've got a single device where that
key is stored and it can be used in
multiple locations and that's your
um you know your inbuilt TPM on your
laptop or that's a removable security
key or something like that
when you are
designing your use cases when you are
planning things out it is important to
understand that these are really the two
architectures you can go with
um and for the best adoption choose both
I mean some people like the heightened
security that this is other people like
the you know ease of use and kind of
recoverability from the syncable and
copyable and you can support both at the
same time you know one of the one of the
aspects of passkeys is that you can
associate multiple
public keys to a single account so you
can you can kind of like pick and choose
from the best if you so choose
so
in that first side where we had stuff
going all over the place
there is a question of how to present
this in a way that makes sense to users
and how to present this in a way that
makes sense to decision makers and
Google has come up with the term sync
fabric
um
it's a way to discuss all of the
individual places a pass key exists
it can Encompass both cross-device and
cross-platform models so that's the
iCloud or the
um like one password password manager
model it also describes how sync
credentials can move from one
authenticator to another
the thing to remember about the synced
passcodes sync pass keys
is that the different nodes don't
necessarily need to be aware of each
other
so this means that I can create a pass
key I can uh I can create a pass key on
my
iOS device
I can then take that pass key and share
it to you over there you can then log
into that site with that passkey
register another Pass key from your
Android device and I would not
necessarily know that your Android
device also had a pass key that was
Associated to that account or to that
credential so when you're designing your
processes
make sure you take this into account
make sure you keep in mind that the
syncability is great for recoverability
syncability is great for usability but
it does have some
faults that you want to call out and you
want to uh
be aware of sink fabric is kind of what
the Fido Alliance is discussing
internally right now
it is Google's proposed terminology it
may or not may or may not be accepted in
the official standard this way but some
concept of this
all-encompassing picture of everywhere I
pass he lives will wind up there
somewhere
nope
um yeah
uh the question was is it mandatory to
use ip6 and the answer is no it is uh
it doesn't care
I mean there are
reference implementations that you that
are
that use a QR code that's been printed
on a piece of paper that you can then
use to authenticate I was just saying
that because you have all the
information about
yeah
um so this is this is a a good overview
of kind of what gets synchronized
um in the authentication process you've
got
two main bodies you've got your client
and you've got your authenticator
um and the secrets material lives on
that authenticator with passkey what we
are enabling is the migration of the
secrets material from like one device up
to the cloud down to another things that
don't get copied are pins are biometric
data and attestation certificates
attestation certificates are
certificates that talk about the
authenticator itself not necessarily the
Secrets material that is being used for
authentication so if you need to say I
want to know where this like what
authenticator was used you would be
looking at your attestation certificate
if you just wanted to make sure that it
was Josh who was doing the
authentication you can just rely on the
passkey but that attestation certificate
and again any kind of pin or biometric
data is all stored locally and that is
not synchronized
um so how else do pass Keys work getting
into this a little bit more technically
there are two main protocols that make
up a photo to standard
um web buff n and ctap2 web FN is what
you will be dealing with
99.9 of the time if you even need to
deal with it at all if you're not just
buying a product off the shelf webathon
is an established authentication
standard it's accepted by the w3c
again public key is associated with the
user on an RP it's supported by most
major browsers
and it interacts with the ctap protocol
to talk to the authenticator a ctap or
the cleverly named client to
authenticator protocol protocol
is what facilitates the actual
interactions at the OS level so the ctap
protocol is what's doing the heavy
lifting talking to your TPM talking to
your secure Enclave talking to an
external security key
um
it's extensible to include that
attestation certificate we just talked
about so if you need additional
information about where that certificate
came from where that certificate
currently lives all of that can be
gathered with the ctap2 protocol and the
best part is most of the time you don't
need to touch it it is built into the
operating system so unless you really
want to have a bad time you can just
leverage and build libraries to do all
of these tasks
um so again putting it together uh
relying party that's the software
service that wants you to authenticate
rawing party uses web authent to talk to
the client that's your app or your
browser or just an operating system
um the client then uses ctap to talk to
the authenticator and uh Bob's your
uncle
so again we have bi-directional
communication things are broken up quite
easily and quite separately
by Design
phishing resistance so fishing
resistance is a thing that everyone is
looking for these days basically it
describes ways to overcome the
challenges we spoke about before with
Legacy MFA if you have read any kind of
Regulation if you've looked at any kind
of you know
governing body that says you need to
roll out some new authenticator or some
updated authenticator the the
terminology they want is fishing
resistance nist has gone ahead and
defined two types of authenticators that
meet those fishing resistant standards
one is PIV the other is 502 or passkeys
um again Legacy MFA is unidirectional
there's no check there's no there's no
TalkBack to make sure that you're
actually logging into the right site so
with a legacy MFA system you can be
hitting a proxied site or you can be
hitting a dummy site or a copied site
and the attacker can then take that
one-time passcode and just inject it
into the real site and that's how
attacks happen like that's that's how
credentials are compromised and there
are um off-the-shelf software as a
service fishing tool kits that do just
that you say I want to attack their
Google site and they pop up a fake
Google site where they pop up a proxy
Google site and send it to the user
someone clicks on the link puts in their
username puts in their password or
clicks their clicks the authenticator
and the you know the cookie is then
captured and handed off to the bad guys
and the accounts are compromised again
because there's there's no validity
check of the of What's called the origin
URI the the origin that the request came
from
um
web FN or back in that early slide we
said that the origin data is actually
included in the
information that's handed off to the
authenticator to do that check to make
sure this is the same origin that I
originally registered with and then it's
included back
um
if you try and ooh that's supposed to be
imposter
my my proofreader said that they cap
they caught a spelling mistake and it
just popped out now what it was
um
if with a passkey you try and
authenticate against a site
um that is proxied or is an imposter
site The Returned uh signature will not
be valid because that origin that the
browser actually got the information
from or that the client actually got the
information from is used as part of that
signature so even if an attacker can get
that far the return value that they get
is only useful on their bad site not an
actual site
um
with
passkey
it was determined that we needed to find
a way to kind of breach or
move credentials from laptops and
desktops or kiosks to mobile phones and
Back Again
the terminology for this technology was
originally cable is something over
Bluetooth low energy
um smartly they have rebranded it to
hybrid transport what hybrid transport
does is it allows you to register new
keys when you are not on the original
device and we can actually I'll actually
demonstrate this a little bit later it
uses QR codes and Bluetooth to
facilitate that transfer so you also
have the added benefit of having to be
geographically co-located in order to do
this you can't have someone like pop up
a thing on a screen and you um you know
you scan it and then have a remote
computer capture that it uses ble to
check to make sure that you're you're in
the same area
and
your location services don't need to be
enabled your Bluetooth stack needs to be
enabled
announcements are dropping all the time
at a worldwide developer conference last
week Apple announced that you can use
Safari to share pass Keys across groups
which I'm sure Netflix is super happy
about
uh I actually spoke to Netflix the week
prior to that and they said that they're
not doing pass keys but that's a that's
another thing
um one password uh just last week
announced beta
um you can install their beta plugin and
you can access passkeys across devices
across platforms it's it's really really
Nifty really sweet if you've used one
password or any kind of password manager
before the ux works really surprisingly
well
um
there are actually more announcements
but I had to cut it uh last Thursday
again Microsoft just announced uh Friday
I think that they are moving into the
space in the same way uh Firefox just
announced support in their upcoming
browser for not only uh the acceptance
of passkeys in their Firefox password
manager plugin but also ways to better
manage pass keys on
the local computer which is very useful
if you're in the Linux world because
there's not really a good way to manage
those pass Keys elsewise
um
watch the space there are
lots and lots of announcements dropping
and again when I came up with this the
idea to give this speech back in
February it was this isn't very well
known this is kind of on the
undercurrents we were at a lot of
conferences last year at the beginning
of this year and people were still kind
of scratching their head what is this
and it seems that since then there have
been a lot of announcements and again if
you've got a phone in your pocket you're
using this technology today which is
great
um so where can we use passkeys and this
is out of date again I apologize there
should be some check boxes here and some
check boxes here
um
everywhere everywhere is the answer in
one some way shape or form every major
operating system and browser platform
supports this today so
these companies have done a ton of the
work kind of bringing this up to speed
so if you're responsible for users or
you're responsible for customers you're
responsible for a platform there's no
reason why you can't take this and
Implement these today
um so again pass Keys Multi-Device photo
credentials single device credentials
only on this side here but these are
kind of being phased out
um in favor of you know just normal pass
Keys security Keys across the board
fairly good adoption except in the
Android space where there are some OS
limitations
um yes this question
uh no those are those are asterix's
meant to represent uh it kind of works
or it it it works or it's been announced
um
uh passwordless which is kind of the the
the the the end goal of all this uh
works really well in iOS works really
well on Mac some support in Android and
it works well enough in the browser on
Windows but not in like native apps or
not on the OS yet again this is out of
date because Microsoft just made more
announcements and the last one uh Pass
Key autofill conditional UI these are a
lot of the ux standards us ux
improvements that we are looking at and
then we want to see driven and adopted
this is where
users get that you know pop-up passkey
experience where you go to you go to a
page where you open an app and it just
like pops up a box and you hit it and it
works
you'd be surprised like
it's I especially Apple's implementation
works surprisingly well
um they have done a lot of tuning and
they have done a lot of research and I
think that they have learned from a lot
of missteps that Pastor managers and
password kind of centralization tools
have made in the past to put together a
really good
invisible process and platform so if
you've got an iOS device you can go to
the demo site I'm going to show in a
couple minutes and try it out and see
how it works benefits reorganization and
or platform passwords are bad okay I
don't think we need to say any more
about this I feel
really bad because the last talk we were
in or the last talk I was in was like I
love passwords and it's true I love
authentication I love this concept of
identity but it is bigger than just like
the password itself and I am tired of
writing password policies I am tired of
enforcing password policies I would
rather just take them and throw them out
the window and that's one of the things
that passkey is really aiming to do
um
passwords inherently aren't bad
passwords are you know it's it's a
shared secret it's a way to prove
yourself but it's abused and it's weak
and we're all human and we all have
faults and we all have bad days so why
not use phones or use computers to do
the things that we invented computers to
do which is make our lives easier and
you know past keys are really a way to
accomplish that
um they allow for passwordless workflows
you know uh 50 to 80 of all cyber
incidents are caused by compromise
credentials again you can walk up to
people in a shop in a parking lot and
say hey give me your password I'll give
you a candy bar and they will
um
less pass Keys less passwords it means
less risk all around and even if you
need some passwords for admin accounts
or for break glass accounts if you're
reducing the number of pass passwords
that you rely on overall you're
shrinking your attack surface
um again passkeys backup and Recovery
synchronization allows for easy recovery
you can take your phone you can uh throw
it in the ocean go to the Apple Store
buy a new iPhone restore from iCloud and
you know you've got your secrets
material again
um and they're easy to use and again
this is a lot of that ux work that's
being done in the browser and being done
on the platforms to make sure that they
are usable and acceptable
um
some of the challenges in pitfalls to
keep an eye out when you start
planning this
um sync Keys again have no visibility
necessarily to each other so you can
create a key on one platform migrate it
over to another platform there's no
inherent communication between the two
phyto adoption most RPS support Fido
today but your mileage may vary you
might still be running you know you know
a as400 or a mainframe system and and
have to like work around those those uh
those hurdles so understand what your
platform looks like understand what your
environment looks like and take steps as
necessary
um
well syncability greatly increases the
ability and survivability of those
Secrets materials uh you still need to
plan for re-enrollment
um
we and not we all but anyone who has in
the past had anything to do with the
help desk knows that Monday morning is
the worst day for help desk because
everyone is calling I changed my
password on Friday and I don't remember
what it is you get to get rid of all
those phone calls but you still need to
manage the uh
I I don't know I locked myself out of my
iCloud account you know and Apple has
decided that after 10 failed attempts
they have just nuked it from from orbit
um I need to enroll a new passkey so
those are the types of
um support
processes and support workflows you need
to make sure documented if you go this
route and last but not least know your
customer what are people willing to do
maybe they don't want to use their phone
for authentication maybe you need to
make sure you have other mechanisms for
them to actually hold those Secrets
material maybe you have a call center
with a no phone policy on the floor you
can still achieve this using other
mechanisms TPMS on computers security
keys but know what your customer base
looks like know what your user base
looks like and plan accordingly
um so again I'm from yubico we make the
yibiki Little Hardware bits of plastic
we like selling them
um how do pass keys and security Keys
play together and the answer is uh
they're the same thing
um you know security keys are just
another authenticator where a passkey
can live more adoption of passkeys means
that there are more places you can use a
security key if you have a security key
and you've tried to use it places today
there's not a ton of places like out in
the public kayak supports it GitHub
supports it Microsoft supports it not as
much
um
with the adoption and with the growth of
pass keys we're seeing more and more and
more
publicly facing organizations support it
I know that Sony is rolling stuff out
for like PlayStation Network so you'll
be able to use like pass keys or
security keys to sign it to PlayStation
which is really cool one password has a
whole big list of places where they've
seen recent past kit option and that
list is growing day by day
um
and again
you know it's it's a use case situation
your syncable pass Keys they're they're
great for consumers and flow Assurance
use cases if you've got a situation
where you have a high Assurance use case
you need to achieve like Al level three
you can still leverage all of the same
technology all of the same standards and
everything is phyto passkey you just it
just lives on a Hardware Key instead of
your phone or your laptop or somewhere
in the cloud
um
a wild demo appears I'm gonna attempt
this see uh see how well it works so
if you want to kind of try out the
passkey experience
passkey.org do we set this up it works
really well
um so we are going to
sign up with a pass key
I'm going to do
I guess that's my name now
let's go ahead and sign up the username
is available that's fantastic so this is
the UI that the edge browser is popping
up it's saying I want to create a pass
key where do you want this passkey to
live uh you've got multiple options I
can do it my windows hello I can do it
on a device that's already linked to my
phone to my machine or I can do it on
or I can use that hybrid transport that
we talked about before and so let's go
ahead and do that so
um
if anyone has their phone and wants to
uh register a pass key for my account
you're you're welcome to scan right now
otherwise
I can uh I can try and do this let's see
excellent so
here is my phone I'm going to open up
the
scan app and we're gonna go and try and
scan that QR code and let's see what's
going to go on with the
projector being right there there we go
um so I don't know if you can see that
there's a little tag that pops up it's
Fido it's going to come up connect with
QR code allow
it's connecting my device
uh it gives me uh some information it
says create a pass key this passcode
will be bound to passkey.org it's going
to be saved to my Google account I'm
going to hit continue
um it's asking for a fingerprint right
now so I block the screen out and um
there we go
so
I have created a pass key uh in the
browser for pesky.org that pesky is
currently living on my phone so let's go
ahead and go to passkey.org
um we're going to sign in with a pass
key
again the ux determined hey you've got a
pass key for this set already I'm just
going to select that one I continue
again do a security proof it's still
multi-factor it's still something I have
which is the you know the
private key that lives on my phone and
something I am my biometric and I'm I'm
signed in on my phone you can then go
ahead and you know register additional
devices you create additional pass keys
but that is the experience it is
painless it is incredibly user friendly
and user focused like the fingerprint ID
the the little ux pop-up that came up
it's all things that people should be
used to seeing if they're using the
Google password manager or they're using
the Apple password manager they build on
all of that uh design terminology and
they build on all of that kind of design
language just to extend that
um
when so when I when I created the
passkey it does a check it does called
proof of presence
um which is past where it does
multi-factor authentication so again I
am who I say I am you know I have to use
my Pat and use my fingerprint to unlock
the secure element on my phone and then
when it goes to check
um it uses the fingerprint to do the
unlock of the secure element as well as
verification that you know I am me and
or at least I have my thumb
um
okay so uh just as an overview
vocabulary lesson uh past K Fighter 2
credential a single device passkey it's
a credential that's bound to a single
authenticator like a security key also
sometimes called a roaming authenticator
because you can pick it up and it can
walk away uh Multi-Device Pass key it's
credential that can be synced to more
than one device hybrid mode is the
ability to move from platform to
platform meaning you can go from phone
to desktop to desktop to phone to kiosk
to billboard on the side of the road if
it's a smart billboard
um authenticator is just a device that
holds credentials again roaming a
platform right there uh last device
public Keys kind of snuck this one in
there this is another proposed extension
to the web of n specification and it is
what lets you
um get that additional attestation
certificate information off the
Authenticator
um how do you use pass Keys again check
with your RP you can also build your own
like RP if you wanted to that accepts
photo 2 credentials
developers.ubico.com are Developer lead
Luke ran a course recorded the whole
thing it's really good there's a Docker
image there you just spin up the docker
image and then you can tie it to
whatever application you like
um further further reading official
quote unquote links
passkey.dev is the official Fido site
passkey.org is the one that we just used
that was put together by ubico
vitalalliance.org passkeys if you want
to read the standards
developer.apple.com and
developer.google.com
and then community links I like this
last one a lot
he is just
grabbing everything good like every good
resource about web offend and just
surfacing it so
um
I'm not going to pronounce that name I'm
gonna Maul it uh the Link's right there
and the deck will be available uh later
on
um and that's all I've got so
um are there uh questions please reach
out to me Mastodon LinkedIn email that's
my cat put a cat in your PowerPoint I
saw a question here question here and a
question here
a question here
like how easy is transportability across
devices across stuff like that if I
really need you can I do I need to
create Chiefs ever pass keys for my
Windows device for my iOS device or is
that something since they aren't
necessarily aware of each other I can
just send off to
the other device
so the
in the long long ago that was the plan
uh the question was about portability
um in the long long ago that was the
plan where you could just pick up that
Secrets material and move it anywhere
you wanted
um we have and we means the federal
Alliance has kind of done some further
thinking and that's where your uh hybrid
mode comes into play where the standard
says that RPS should allow you to
associate multiple public keys to
individual accounts and then you use
hybrid mode to create pass keys on each
device or on each platform
uh next question was here and then I've
got back there
what exactly is going on sure so the
question was about the number of
credentials that can be stored on a ubk
particularly I can talk about this
um it has to do with the amount of
storage that's actually in the secure
element when the secure element was
designed and when the firmware was
written we needed to come up with a
number that was reasonable space exists
on that secure element but it is not
infinite
um n25 was the number that kind of came
up but
you only are limited to 25
um credentials if they are detectable
credentials meaning if they are
associated only to a single RP if you
create a pass key on a Yuba key a 52
credential on the ubk as your
non
linked you can use that multiple places
same
key materials yes they'll have the same
public key material because again it's a
public key and it's meant to be public
an RP that is using that one of the 25
slots they will have their own unique uh
public material that's different from
yes then that public material will you
they can take that public material and
toss it to the wind because again it's a
public key and it's meant to be public
however on the private side of the house
uh the certificate includes checks to
make sure that it's coming from the
correct RP
uh one more question over there and I
think we're at time I think I'm gonna
get the two minutes okay quick
um and we are in my organization I am
pushing an effort to really
really
and what we have found is that the
technical challenge of owning and
deploying this thing and we use OCTA so
it's somewhat easy in a scalable manner
is so much better than it is a good
challenge and it's something
yeah thank you uh like I said I'm first
and foremost I'm an evangelist I like
IGA
um and solving those problems is like
what I like hearing we had one more
question over here
I am going to say maybe and again if
you've got malware in your local machine
you've got bigger problems
I don't know
um I don't know if we have done uh any
specific research in that space or if
there's been any specific papers
published in that space again the way
that the two protocols web authen and
ctap work together
insulate a lot of that
but if there is local malware on a
machine regardless of what flavor it is
there are
there's only so much that can be done
it's it's it's a maybe right
um
that malware would still need to
intercept and manipulate the ctap
execution
which is difficult
um
but I am not going to say it's
impossible
but I don't believe we have seen it in
the wild and I have the message so uh
thank you so much for being here there
was birthday cake upstairs I really
really uh happy you came to see me
um
two or three more stickers over there
please go and take them so I don't have
to bring them home and enjoy the rest of
your con