- Hi, I'm Pamela Dingle, Director of Identity Standards

at Microsoft and I'm here today to talk to Andrew Shikiar.

He is the Executive Director and CMO at the FIDO Alliance.

Andrew, it's really great to have you here.

- Thank you, it's very nice to be here.

- So tell me what FIDO stands for.

- So FIDO stands for Fast IDentity Online

and FIDO Alliance is a standards organization

that's creating open standards for better,

simpler, stronger user authentication.

In general, what you find is a number of competitors,

in any space or collaborators

see the need to work together

on a piece of technology

that's really core to all their businesses,

where it makes more sense to collaborate

than try to differentiate.

And so when FIDO was formed,

there was a data breach challenge which persists today.

And what FIDO's founders realized

is that the core problem associated with data breaches

comes down to user authentication.

So you know, a dependence on passwords,

a dependence on shared secrets that sit on a server.

And so what FIDO is fundamentally trying to do,

is change the way people authenticate

from one that is server-side shared secrets,

to a model where consumers

and users can authenticate locally

to devices that they use every day.

- You talk about asymmetric public-key cryptography.

How does FIDO match that super fancy cryptography

with something people can use?

- There are two main ways of authenticating users, right?

So one, the traditional way of passwords

or shared secrets, has both usability and security problems.

So it's funny when I travel

and I talk to people about passwords

and I say we're trying to get rid of passwords

as part of what we're doing,

no one's ever said that's a bad idea, right?

I think all of us as consumers and as users,

can understand the challenge of passwords.

The key thing to understand

is that this data sits on the server, right?

Anything on a server can be spoofed, it can be hacked,

it's susceptible to phishing.

The other problem associated with this kind of password

is that once they're stolen, they can be reused.

There's a massive market out there

for used credentials on the dark web

and that leads to something we call credential stuffing.

The statistics around stuffing are staggering.

For ecommerce sites, up to 90% of attempted logins

are stuffed logins.

Stuffing are at least over 95% of account takeovers.

- What exactly is credential stuffing?

- So that's when someone goes on the dark web

and buys a username-password combination, right?

So we hear about these massive data breaches,

like the Yahoo data breach for example,

and I was one of those 3 billion identities that was stolen.

And you know, the damage to me from Yahoo,

doesn't really matter, right?

At worst they could do

is like mismanage my fantasy football team.

But the real damage is,

if I use that same username, password on my bank

or on other sites.

And the scary thing is there's around

a one to two percent success rate, right?

So you're talking about billions

of stuffing attempts per day with,

say even 1% success rate.

That's a massive number of successful logins

that that shouldn't be happening.

Which is why it's costing US businesses alone

over $5 billion a year.

- If you use the same password for your bank

as you use for anything else,

you should go change it right now.

- So there's basic password practices,

which Microsoft does a good job of articulating

and educating people on.

Any MFA, right?

Any sort of MFA, even SMS OTP,

which we'll talk about in a second,

eliminates 99% of account takeover.

- An MFA is multifactor authentication,

and the whole idea is it's not just one thing.

If you use a password, you're using a thing you know,

that's only one, what we call a factor.

With multi-factor authentication,

you can use something you know or something you have,

you know, your phone for example.

And then the other one is something you are,

which is biometrics, meaning you're gonna use your face

or your thumbprint, stuff like that, right?

- So FIDO is solving the problem by creating standards,

as we're creating the standards

for FIDO authentication, right?

So again, it leverages that that big word,

asymmetric public-key cryptography.

But what that really means is that

instead of putting a password on a server,

we use a key pair, and it's called a private key,

which sits with you on your device and a public key,

sits on a server.

Unlike a password, the public key has no material value.

All right, so some hacker comes in

and steals a whole raft of public keys.

There's nothing that could be done with those.

And now when I go to log in,

once I'm set up in the FIDO account, I have to unlock,

basically activate the private key on my device

and I can do that by a biometric

or any sort of way of verifying myself to my device,

which I can uniquely do,

and then that key pair can be matched.

There's a lot of data exchange in that interchange

that's unique to the website, unique to the private key,

that makes it such that only you,

with that device can log into that site.

- I mean, this is sort of the "Holy Grail"

of authentication.

It should be easy for the user and it should be really,

really difficult for the hacker.

And that of course does not happen with passwords.

Passwords tend to be really hard for users

and really easy for hackers.

- So if you look at this from a business standpoint,

you know passwords are a liability, right?

So you're basically managing,

if you're managing consumer identities,

managing tens or hundreds of millions

of very valuable pieces of information which are at risk,

they're sitting on a server.

So that's a major liability.

There's also a usability issue for businesses.

If people can't remember a password,

passwords lead to like half of shopping cart abandonments.

So that's money on the table that you're not getting,

'cause people can't log in.

For consumers, the risk is identity theft,

account takeover, bad charges, all the negative things

that happen when your identity is stolen.

And then you know, you look at new form factors, right?

So I just redid my house,

and I have all these smart TVs,

I'm trying to log in to smart TVs

and remembering my passwords,

'cause it's all password based.

I can remember my passwords

'cause I have my own approach to it.

But then entering it with remote controls is like

the Seventh Realm of Hell.

- It's terrible (chuckles).

- It's horrible.

It's a bad experience, right?

So again, trying to simplify the user experience

while providing a more secure user experience

is really what FIDO's very much focused on.

- I mean we've talked about public-key cryptography

and all this great sort of thing,

but what is it that users actually get to see

and do that is so much better than passwords?

- Consumers have gotten accustomed to using a biometric

on a device every day, right?

For at first it was unnatural

to unlock your phone with a thumbprint

rather than tapping in a passcode.

Or also sometimes in enterprise, you'll get a security key.

They come in a number of form factors

from a USB key to NFC cards, whatever it may be,

that allows you to use that as a second factor

or as a primary source of logging in as well.

- I mean, that sounds great, but I'd love to see one,

do we have any here?

- As a matter of fact, we do.

- Wow!

- I travel with a pocket full of security keys

out of best practice.

These are some examples of these.

So this is a USB transport.

- Let me see, I will play hand model.

- This one actually uses a FIDO certified mark,

which I like them doing.

So we certify these devices,

to show that they truly do inter-operate with each other.

So this is a FIDO2 security key.

It has both the USB where you just have to touch it,

and it also has a biometric scanner too.

- So it literally doesn't work

unless you scan your fingerprint?

- Correct, correct.

So it's an even higher level of authentication

than just proving presence.

- That's great.

- This one is a Bluetooth model.

It supports Bluetooth and I think NFC.

You just click it.

- So basically you don't have to plug this in obviously.

So you would pair it with your laptop

and then it would just magically ask you to touch it.

- They ask you to insert or activate your FIDO security key.

In this case, you just press that button.

That'll communicate via Bluetooth to your laptop

or your tablet or your smartphone.

Speaking of smart phones, this one has a USB-C,

which is good for modern laptops,

but also for a lot of Android devices these days,

or any device that has USB-C power.

Whereas initially, I think it's fair to say,

that the security keys are primarily used

on the desktop in the enterprise.

What we're seeing now is these innovations

to bring security keys to mobile phone users

and device users as well.

- I don't know if you can see this,

but there's these little touchpoints on either side.

The whole idea is you always have

to have a human gesture in FIDO.

So it can't just be all computers.

There has to be a human element.

So you plug it in, and then when you're prompted,

you just touch the side and then you're logged in.

- And last but not least, this is, I love this one.

This could also serve as a employee badge.

You have a badge, it gets you in the door,

but he can now have that same badge

that gets you in the door,

it can also be your FIDO security key.

So, communicating by NFC or Bluetooth to your laptop

as a security key.

There's even like a little USB thing

that's fixed in there as well.

It's an incredibly--

- Is this awesome or is this it's awesome?

- It's awesome, so you think about perimeter security,

logical security, access security,

all those things are built into one key.

This is a tiny sampling.

We have over 600 FIDO certified products on the market.

And depending on your use-case

or your company's use-case,

you can bring a blend of these into the enterprise.

- What we love about it at Microsoft is that,

we can get out of the business

of making authenticators, right?

We can build to a standard

and then the standard allows