Authenticate 2022
| title | author | length |
|---|---|---|
| Trust Anchor in Your Wallet | Art Stewart | 17m |
Claims that a biometric smartcard implemented as a FIDO2/CTAP roaming authenticator and secured by an EAL5+ tamper-proof secure element serves as a reusable… | ||
| Protect your company with FIDO2 authentication | Leszek Zalewski, Tomasz Kowalski | 19m |
Claims that a network broker architecture lets enterprises add FIDO2/WebAuthn to legacy apps without code changes, cutting development and maintenance costs… | ||
| A gentle intro to certification of a cross-platform FIDO2 authenticator | John Callahan | 35m |
Explains a hands‑on L1 software authenticator certification: builds iOS and Android CTAP 2.1 authenticators, pairs devices over Bluetooth, runs the conformance… | ||
| MFA for All | Mike Slaugh | 26m |
Argues for rolling out MFA by turning strong methods default on, offering an authenticator of choice catalog and enrolling users by cohort segmentation… | ||
| Risk-based authentication and zero trust architecture ZTA | Frank Michaud | 25m |
Proposes replacing one‑time checks with a continuous identity posture that scores user and device context (location, device health, behavior) in real time and… | ||
| The high cost of cheap biometrics | Daniel Ferak | 22m |
A vendor evaluation focused on measurable outcomes: uses NIST FRVT benchmarks for face matching, ISO PAD (conformance labs like IBIDA) for liveness, and… | ||
| Binding tokens | Ryan Alexander, Bill Fish | 28m |
Mobile is the best bridge between physical and digital identity, using the SIM’s cryptographic key plus SMS or a passive secure handshake to prove possession… | ||
| Case study - Enterprise PIV - authentication sans active directory | Sarbari Gupta | 37m |
Micro agency (<100 users) gets mandatory PIV logon on standalone Windows 10 laptops without Active Directory by combining Eid Authenticate (My Smart Logon… | ||
| The challenges of account recovery | Kyle Rutherford, Calvin Rutherford | 14m |
FIDO succeeds at strong device-bound authentication but fails at lost-device recovery, creating a practical attack surface: passkey mass compromise if recovery… | ||
| The business case for FIDO token | Steve Kruse, Joseph Karpenko | 31m |
Argues that replacing typical MFA with FIDO tokens raises control effectiveness from 80% to 90%, uses the FAIR model and public calculators to translate that… | ||
| Strengthening your weakest link | Jordan Burris | 14m |
Identity verification is now the weakest link: reported identity theft spikes in 2021 and 45 million credit invisible people in the U.S. make PII and KBA… | ||
| Leading at the edge: FIDO and the normalization of cryptography | Steve Wilson | 21m |
Argues that FIDO has turned consumer devices into a standardized cryptographic stack spanning cloud to edge, using secure enclave hardware (Infineon… | ||
| Using FIDO authentication to defend against account takeover | Raj Galagali, Balu Santhosh | 41m |
A simple Node.js/HTML app moves from username/password to WebAuthn/FIDO2 using an OIDC-based passwordless SDK, client ID/secret and a back-end passwordless… | ||
| FIDO Journey in APAC | Deb Joyti Ghosh, Joon Hyuk Lee, Keiko Itakura, Kieun Shin | 32m |
APAC adoption moves from pilots to concrete rollouts: Japan runs UAF since May 2015, LINE adds FIDO to mobile payments, publishes an account-recovery paper… | ||
| Continuous Biometrics | Tamas Zelczer | 25m |
A continuous biometric system based on handwriting and cursor movement is deployed by Cusrsor Insight and is serving about two million users, but accuracy is… | ||
| Making authentication your competitive advantage under GDPR and PSD2 | Paolo Gasti | 21m |
Claims a working system that uses secure multi-party computation plus device cryptography to run biometric matching on encrypted templates so the cloud never… | ||
| Establishing trust with verifiable creds and zero trust | Chase Cunningham, Heather Dahl, Mike Vesey | 23m |
Verifiable credentials follow the W3C tamper‑evident spec, use a distributed ledger for signature checks (allowing offline verification), and are already in… | ||
| Taking FIDO to the masses | Frances Zelazny | 19m |
Argues that FIDO works at front‑end but fails at scale because account recovery and back‑door authenticators remain the main attack vector; cites password… | ||
| Efforts to spread passwordless in Yahoo! JAPAN | Yuya Ito | 24m |
Yahoo! JAPAN replaces passwords with SMS one‑time codes and WebAuthn, first shipping WebAuthn on Android Chrome in 2018 and SMS auth in 2017, adds SMS… | ||
| FIDO 101 | Paul Heim, Christina Hulka, David Turner | 02h 22m |
FIDO replaces server‑stored passwords with public key cryptography, moving crypto into browsers (WebAuthn) and CTAP for USB/BLE/NFC keys; this blocks phishing… | ||
| AWS Identity Workshop | Kevin Shanley | 01h 00m |
Workshop demos how AWS fixes identity at cloud scale by replacing per-account IAM users with a single federated hub. It compares three models, shows Identity… | ||
| FIDO Welcome Address | Andrew Shikiar | 34m |
Opening remarks summarize FIDO’s year: launch of passkeys (private keys synced via OS clouds), platform betas from Apple and Google, and PayPal plus NTT Docomo… | ||
| Featured Keynote | Jen Easterly | 01h 00m |
FIDO reports nearly 1,000 certified products and launches passkeys sync private key across OS cloud so users avoid re‑enrollment; PayPal shows a limited US… | ||
| Keynote | Jonathan Bellack | 13m |
Google announces a Fido beta that aims to make phishing dramatically harder by moving authentication to users’ devices; Pixel 6 already runs on-device phishing… | ||
| Modern Authentication, Real life stories | Christopher Harrell | 17m |
History of FIDO and concrete deployments: Yubico helps build U2F/FIDO2/WebAuthn tooling, donates 20,000 keys to Ukrainian government agencies, funds tens of… | ||
| Lessons on the Road to Complete Customer MFA | Ian Glazer | 28m |
Companywide mandate aims for 100% customer MFA but timeline shifts from a one‑year goal to phased rollouts, starting automated enables for tiny tenants in… | ||
| Consumer Passwordless at Scale | Scott Bingham, Emily Houlihan | 25m |
Microsoft removes consumer passwords entirely and reports organic adoption that hits its modelled year‑end goal within two days of the public announcement… | ||
| Strategies for Better MFA | Dereck Henson | 25m |
USAA uses a three-part MFA strategy: default on strong by enrolling new accounts immediately into MFA so new enrollments show high adoption; authenticator of… | ||
| Rolling Out Passwordless | Rakesh Loonkar, Matthew Dunn | 31m |
Citibank describes a global rollout that moves 200 million customers across roughly 180 countries off passwords by using FIDO/WebAuthn for device-bound keys… | ||
| Implementing Zero Trust | Evan Johnson | 32m |
Company moves from single-VPN choke point to a Zero Trust stack, handling ~36 million HTTP requests/sec and ~124 billion blocked attacks/day, by productizing… | ||
| OMB Fireside Chat | Chris DeRusha, Eric Mill, Jeremy A. Grant | 27m |
OMB memo M-22-09 mandates a federal zero trust road map with identity as the first pillar and pushes agencies toward phishing-resistant MFA and FIDO-based… | ||
| Strong Auth Supply Chain | Chad Lloyd, David Treece | 24m |
Since 2016 a production SCADA/MFA pipeline uses ubotp keyboard emulation YubiKeys for confirmation-of-control (press key to open/close breakers) and a YubiHSM… | ||
| Update on NIST's digital identity guidelines | Ryan Galluzzo | 22m |
Revision 4 draft is imminent and refocuses the base volume on risk-based tailoring and continuous integration with fraud and transaction telemetry, elevates… | ||
| Phising resistant MFA | Dennis Hills | 22m |
U.S. Executive Order 14028 and OMB memos require agencies to implement phishing-resistant MFA—only PIV smartcards and FIDO2/WebAuthn meet the standard; SMS and… | ||
| Buzzword or Solid Strategy | Jeremy A. Grant, Brian Martin, Jeremiah Mason, Christine Owen | 26m |
Zero trust centers on verified identity plus device posture rather than buzzwords: implementations use FIDO2 front door for low-friction access, step-up… | ||
| Tips for Painless Passwordless | Matthew Miller | 27m |
Practical, code-level guidance: specify authenticatorAttachment (values platform or cross-platform) when calling navigator.credentials.create to steer… | ||
| Streaming Authentication | Nick Steele | 24m |
Argues that FIDO2 is the practical path to faster, lower-friction authentication today, not an immediate jump to passwordless; cites adoption signals (about… | ||
| FIDO Authentication Platform Crypto | Stephen Oh | 19m |
A FIDO-based platform encrypts wallet seeds, NFT files and arbitrary folders without passwords by binding AES-wrapped keys to hardware security keys and… | ||
| Web 3 Reshape Authentication | Robert MacDonald | 27m |
Claims that web3 replaces centralized identity with a user-controlled crypto wallet holding private keys and verifiable credentials, ties biometric liveness… | ||
| Bridging Web 3.0 Digital Wallets | Michael Queralt | 19m |
Argues for a FIDO/passkey-backed digital wallet that bridges Web2 apps and Web3 wallets by binding KYC-verifiable credentials to authentication, tested as a… | ||
| Keynote Reshaping Digital Payment Authentication | Doug Fisher | 25m |
Payments see over 6 billion 3DS transactions in just over a year and 95% issuer adoption, yet online approval lags — 98% in‑person vs 80% online authorization… | ||
| Make MFA More Resilient | Roger Grimes | 26m |
Claims that most MFA is phishable and that average solutions have about 10–11 attack vectors are supported with hands-on review of roughly 160 MFA types and… | ||
| Advanced Authentication Framework | Jim Routh | 19m |
Argues conventional MFA with passwords plus OTP is inadequate and recommends moving enterprises through concrete options: password camouflage (SSO/password… | ||
| Hey FIDO Meet Passkey | Tim Cappalli | 26m |
Passkeys are presented as a phishing-resistant password replacement built on FIDO2 and WebAuthn that syncs across devices via platform cloud accounts and a… | ||
| Relying Party Security | John Bradley | 24m |
Passkeys replace passwords and relying parties must rework back ends to store multiple device keys per user, check the backup eligible flag and the backuped… | ||
| Passkeys on Android | Christiaan Brand | 26m |
Android adds passkey support via Google Play Services beta, rolling to users in November/December. Passkeys sync within an ecosystem (Android→Android, soon… | ||
| Mobile App Auth Friction | André Ferraz | 23m |
Research downloads the top 50 US financial apps and measures login flows for known versus new devices, recording factors offered, persistence, screens and… | ||
| Bias in Biometrics | Stephanie Schukers | 27m |
NIST FRVT testing shows measurable demographic variability in face recognition, so the concrete proposal is two pass criteria: an overall error threshold… | ||
| Biometrics - Mature Technology | Greg Cannon, Stephanie Schukers | 26m |
FIDO’s biometric certification specifies end-to-end biometric component scenario tests run by independent labs that recruit subjects, create spoofs and measure… | ||
| Bringing FIDO2 to National Identity | Heikki Palm Henriksen, Helge Tesdal | 28m |
Norway’s BankID modernizes its national eID by implementing FIDO2/WebAuthn with an OpenID Connect integration, using a companion BankID app for onboarding and… | ||
| Notification of First FIDO eID | Jaromir Talir | 25m |
Czech national authentication service myID (CZ.NIC) deploys FIDO as a government-recognized eID and completes eIDAS notification in July 2022 after launching… | ||
| Maturity Model for Authentication | Koen Sandbrink | 15m |
NCSC-NL publishes a practical maturity model that maps accounts to Level 0–3 and shows concrete moves: passwords are Level 0, typical MFA only reaches Level 1… | ||
| Why CIAM Deviates | Vittorio Bertocci | 25m |
CIAM has higher signal entropy, an adjustable attack surface and attacks that are loud and long: observed fraudulent registrations rise from 15% to 24%… | ||
| From Moats to Slopes | Atul Tulshibagwale | 21m |
Argues that coarse-grain RBAC fails for modern risks (about 60% of attacks involve identity compromise) and replaces it with just-in-time access management… | ||
| FIDO CTAP 2.1 | Yves Massard | 17m |
FIDO CTAP 2.1 adds concrete enterprise features: passkey multi-device lets one authenticator bootstrap access across phones, laptops and desktops so lost keys… | ||
| Passwords Still? New Data on Consumer Authentication Habits | Megan Shamas | 25m |
Survey of 10,000 consumers in 10 countries shows entering passwords drops by under 10% year over year but mostly because people use stay logged in options… | ||
| State and Future Remote Authentication | Marianne Crowe | 24m |
Remote authentication fraud is rising after COVID as more novices use digital payments and criminals exploit reused passwords and inconsistent defenses… | ||
| Authentication Digital Financial Services | Pedro Martinez | 28m |
Summary of how digital banking authentication actually changes: industry moves from physical OTP tokens and OATH OTP tokens through smsOTP and soft tokens… | ||
| OpenID Foundation Strategy | Gail Hodges, Anoop Saxena | 37m |
OpenID Foundation reports standards deployed to over 3 billion users and FAPI (Financial-grade API) counts about 1,600+ implementations; FAPI 1.0 is final… | ||
| Shifting Authentication at Scale | Darrell Hawkins | 18m |
Otis replaces passwords for 41,000 employees across 200 countries by integrating a Hypr magic link passwordless MFA with identity governance (IGA) APIs, moving… | ||
| Cambridge Housing Authority goes passwordless | Jay Leslie | 21m |
Cambridge Housing Authority pilots passwordless in 2021 and rolls it out in 2022 using Windows Hello for Business (FIDO), covering ~250 users; a certificate… | ||
| Securing Authentication with and within FIDO | Manish Khedawat | 14m |
Target runs passwordless across 2000+ apps and shows how FIDO breaks only when deployments misconfigure or key material or mappings are altered… | ||
| FIDO in a Reusable digital identity network | Sarah Clark | 24m |
Mastercard builds a new, standalone reusable digital identity network that is live in Australia and Brazil and active in seven markets, onboarding users with… | ||
| Credit Unions turn to Biometric Authentication | Mzukisi Rusi | 22m |
Entersekt reports multiple credit unions live with FIDO-based authentication, starting by swapping SMS OTPs that contributed to $68M US losses in 2021 for… | ||
| EMV® 3DS: Enhancing secure, convenient authentication ... | Arman Aygen | 25m |
EMV 3DS delivers concrete changes: a split SDK for low‑power devices, browser integration that leverages FIDO/W3C authenticators, and Secure Payment… | ||
| Rollout Frictionless Biometrics | Allyson Wagner, Teresa wu | 26m |
Covers concrete rollout decisions: chooses biometrics by NIST 20-year evaluations and FIDO certification, measures tradeoffs between false accept and false… | ||
| Journey to Implement FIDO | Andreas Pellenghar, Dennis Kniep | 24m |
A global science company with ~60–80k users builds a self-hosted FIDO server and a credential self-service portal that uses phone SIM-based identity… | ||
| Implement FIDO2 for Cloud and SaaS | Jiphun Satapathy | 26m |
Snowflake implements FIDO2 for cloud and SaaS MFA, integrating Okta SSO with Beyond Identity for passwordless sign‑on, using Touch ID, Windows Hello and U2F… | ||
| Insights from Target | Tom Sheffield | 24m |
Target builds a FIDO-backed fingerprint ID ecosystem using a dedicated FIDO server, single identity store, SSO and a modern login service, runs seven pilots… | ||
| Protecting Phone Verification | Kelley Robinson | 29m |
A specific attack called SMS pumping floods phone-verification forms to generate billing events by targeting sequential number blocks tied to complicit… | ||
| Injection Attacks in Biometric | Ajay Amlani | 20m |
Claims a >300% growth in injection attacks, with bad actors using emulators, morphing and deepfake replay to hack cameras and scale attacks globally. Provides… | ||
| Women in Identity | Heather Flannigan, Jamie Danker | 23m |
Standards work adds a new attribute eduPersonDisplayPronoun to let systems store user-selected pronouns; federal agencies plan a GSA study recruiting 2–4… | ||
| The Forgotten | John Poirier, David Turner | 26m |
Contact centers become the common fallback for broken web authentication and often remain unsecured; CV S Health standardizes calls with a Universal Call… | ||
| Merging Passwordless and Physical Access Control | Rita Mounir | 26m |
Research prototypes and a shipped product merge FIDO-style passkeys with doors, cars and laptops using a Bluetooth LE token and phone presence… | ||
| Proliferation of Authentication Methods | Siobhan Dolen | 21m |
Proposes using a networked trust of established institutions (banks, retailers, agencies) to share successful authentication outcomes so later services… | ||
| Integrating Identity and Fraud | Ashish Jain | 26m |
Organizational experience shows one in five login attempts is an account takeover attempt, industry traffic contains 35–40% spam, and fake registrations jump… | ||
| Holistic Authentication | Bassam Al-Khalidi | 26m |
Argues for a single platform that provisions a PKI as a service in 42 minutes inside a per-tenant virtual private cloud, aims for FedRAMP, and avoids moving… | ||
| Where FIDO Meets SSI | Dmitry Barinov | 24m |
Maps FIDO/passkey authentication to DID and verifiable credential flows, showing concrete deployments: IATA travel pass runs in production and DHS SVAP POC… | ||
| Accountable Identity Online | Abbie Barbir, Ramesh Kesanupalli | 26m |
Spec published (v1.2) and a commercial implementation already exists; pilots ran in November and with Hitachi in April, and work on Spec 2.0 and an ADI… | ||
| Great Privacy Challenge for Reusable Identity | Tina P. Srivastava | 25m |
Claims a concrete cryptographic breakthrough: cracked a 20-year cryptography problem that uses fuzzy extraction to derive keys on demand from fuzzy biometrics… | ||
| Earning Trust in Identity at Scale | Sarah Cecchetti, Arynn Crow | 21m |
Argues for a flexible centralized identity platform on the platform team that supports Amazon Cognito and AWS identity Center while letting lines of business… | ||
| Keynote, Identity & Authentication in ePromiseland | Rolf Lindemann | 22m |
Describes a practical path from passwords to FIDO-based passkeys with concrete numbers: a user signs into ~100 accounts about 30 times a day, so ubiquity and… | ||
| Diversity in Cybersecurity - Why does it matter? | Christina Hulka, Karen Larson, Rita Mounir, Teresa wu | 57m |
Panel gives concrete numbers and actions: industry reports show 24% women in cybersecurity, only three all‑female CEO/CFO duos among the 500 largest US firms… | ||
| nothing matches | ||