Cyberstudy
PDF p.91 In progress

Passwordless Authentication

Open PDF at p.91 17 flashcards

Summary

PDF p.91

Passwordless authentication eliminates the use of passwords, relying instead on other factors like security keys or biometric methods. The FIDO2 with WebAuthn specifications provide a framework for this approach, enhancing security and reducing management burdens.

In plain words

Supplementary — not from your PDF

Passwordless login removes the password entirely. With FIDO2/WebAuthn (passkeys), your device creates a key pair per site. You unlock it with a fingerprint, face or PIN, and the site checks a signature. No password crosses the network to be phished.

Detailed explanation

PDF p.91
  • Token-Based MFA
    • Current Use: Typically includes a password as a backup or part of a two-step verification process.
    • Passwordless Approach: Eliminates knowledge-based factors entirely.
  • FIDO2 with WebAuthn
    • Framework: Provides a structure for passwordless authentication.
    • Process
      • Authenticator Choice: Users select a roaming authenticator (e.g., security key) or a platform authenticator (e.g., Windows Hello, Face ID/Touch ID).
      • Local Gesture: Users configure a secure method (e.g., fingerprint, face recognition, PIN) to confirm presence and authenticate the device.
      • Registration: Users register with a web application (relying party), generating a public/private key pair.
      • Authentication Challenge: Users perform the local gesture to unlock the private key, which signs a confirmation sent to the relying party.
      • Verification: The relying party uses the public key to verify the signature and authenticate the session.
  • Security and Management
    • Comparison to FIDO U2F: Similar security to smart card authentication without requiring digital certificates and PKI.
    • API Improvement: FIDO2 WebAuthn adds an API for passwordless web application authentication.
  • Attestation
    • Purpose: Ensures the authenticator is trusted and resistant to spoofing or cloning.
    • Mechanism: Authenticator devices have an attestation and model ID to prove they are a root of trust.
    • Privacy: Attestation keys identify the brand and model, not individuals.

Important terms

taken from the text above
Current Use
Typically includes a password as a backup or part of a two-step verification process.
Passwordless Approach
Eliminates knowledge-based factors entirely.
Framework
Provides a structure for passwordless authentication.
Authenticator Choice
Users select a roaming authenticator (e.g., security key) or a platform authenticator (e.g., Windows Hello, Face ID/Touch ID).
Local Gesture
Users configure a secure method (e.g., fingerprint, face recognition, PIN) to confirm presence and authenticate the device.
Registration
Users register with a web application (relying party), generating a public/private key pair.
Authentication Challenge
Users perform the local gesture to unlock the private key, which signs a confirmation sent to the relying party.
Comparison to FIDO U2F
Similar security to smart card authentication without requiring digital certificates and PKI.
API Improvement
FIDO2 WebAuthn adds an API for passwordless web application authentication.
Privacy
Attestation keys identify the brand and model, not individuals.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Windows Hello or Face ID signing you into a website.
  • A roaming security key used on several computers.
  • Attestation proving the authenticator model is genuine.

Scenario

A company moves staff to passkeys. Phishing emails still arrive, but a fake site can't get a usable credential, because the key only signs for the real site's domain.

Common mistakes

Supplementary — not from your PDF
  • Thinking the fingerprint is sent to the website. It stays on the device and only unlocks the private key.
  • Assuming passwordless needs a PKI. FIDO2 doesn't need certificates.

Practical skills

Supplementary — not from your PDF
  • Walk through FIDO2 registration and login.

What I should remember

Key Points PDF p.91
  • Token-Based MFA
    • Backup Passwords: Often still used.
    • Passwordless: No knowledge-based factors.
  • FIDO2 with WebAuthn
    • Authenticator Choice: Security key or platform authenticator.
    • Local Gesture: Fingerprint, face recognition, PIN.
    • Registration: Public/private key pair.
    • Authentication: Local gesture unlocks private key, signs confirmation.
    • Verification: Public key verifies signature.
  • Security and Management
    • FIDO U2F Comparison: No digital certificates or PKI needed.
    • API Improvement: Passwordless web authentication.
  • Attestation
    • Trust: Ensures authenticator reliability.
    • Mechanism: Attestation and model ID.
    • Privacy: Identifies brand/model, not individuals.