Merging Passwordless and Physical Access Control
summary
Research prototypes and a shipped product merge FIDO-style passkeys with doors, cars and laptops using a Bluetooth LE token and phone presence; proof-of-concepts include a hot‑wired 2005 Dodge Ram, a CAN‑bus F‑150 hack, a proximity‑unlocked home and a kernel‑integrated sudo bypass. Many features work but real deployments reveal failures: phone battery kills access, Bluetooth and FCM delays break flows, a Pixel 6 chip incompatibility and a Linux kernel CVE cause lockouts, and mechanical issues (no door closer) let wind defeat locking — need proximity-based login and hardware distance bounding.
AI-written summary · about
chapters (21)
- 0:00Welcome and introduction
- 1:06Authentication background and mission
- 3:12Early research and FIDO beginnings
- 4:35Hacking a Dodge Ram truck
- 7:09Hacking an F-150 truck
- 8:13Smart home and door integration
- 9:35Grad school door prototype
- 10:37Door lock challenges and lessons
- 11:21Proximity-based computer login
- 12:23User preferences for wireless tokens
- 13:46Risks of authentication systems
- 14:48Proximity-based web login demo
- 15:09Real-world product challenges
- 15:52User frustration with lockouts
- 16:55External factors affecting reliability
- 18:23Replacing legacy solutions
- 19:27Customizable security levels
- 20:31Security vulnerabilities and fixes
- 21:33Hardware compatibility issues
- 22:16Public shaming and incident response
- 23:20Industry lessons and future steps
related talks
22mEnabling passkeys with "Hybrid" on non-passkey-supported devices
56mPasskeys 101: Technical Principles of FIDO
26mFIDO biometrics and passkeys for in-vehicle apps
47mPasswordless Web
52mPasskeys: The Good, the Bad and the Ugly
41mOpening Doors with JSON Web Tokens
51mA Passwordless Future! Passkeys for Java Developers
07mImagine: A world without passwords, it is easy if you try