Instructor: In this lesson, 2 2
we're going to discuss passwordless authentication 3 3
and an attack known as biometric impersonation. 4 4
Now, passwordless authentication is 5 5
an authentication mechanism 6 6
in which a user can log into a computer system 7 7
without entering and having to remember a password 8 8
or other knowledge base secret. 9 9
There are many different types 10 10
of passwordless authentications in use today, 11 11
most relying on a public key cryptography infrastructure 12 12
with a private key being stored on a user's device. 13 13
In general, passwordless authentication factors fall 14 14
into two types of factors, ownership factors 15 15
and inheritance factors. 16 16
Now, ownership factors include something that the user has 17 17
in their possession. 18 18
This can be their smartphone, a one-time pin token, 19 19
a smart car, or another type of hardware token. 20 20
Inheritance factors include something the user is, 21 21
and it's usually going to be a biometric identifier, such as 22 22
their fingerprints, a retinal scan, a facial recognition, 23 23
voice recognition or other things like that. 24 24
Well, these are the most common replacements for a password. 25 25
Any type of authentication system that no longer relies 26 26
on a password could be considered a passwordless 27 27
authentication system. 28 28
For example, some organizations have begun 29 29
to implement a passwordless authentication system 30 30
that relies on the user entering in 31 31
their email address to log in. 32 32
When they do this, 33 33
the system sends them a one-time use login link 34 34
to their email that's valid for only five minutes. 35 35
If the user doesn't click that link 36 36
within the next five minutes, 37 37
the link becomes invalid and it's no longer usable. 38 38
If they do click the link, it logs them in. 39 39
Again, here the user is not required 40 40
to enter a password to login, only their email address, 41 41
which, in this case, is acting as an ownership factor, 42 42
and this makes it a passwordless authentication system. 43 43
Now, passwordless authentication systems have 44 44
many different benefits, such as greater security, 45 45
a better user experience, reduced IT costs, 46 46
better visibility into who's using 47 47
a specific credential and scalability. 48 48
In general, 49 49
passwordless authentication systems are more secure 50 50
than password-based authentication systems 51 51
because you're removing the knowledge factor 52 52
that could easily be stolen or guessed by an attacker. 53 53
Passwords have been determined to be the top attack vector 54 54
for hackers, and they're responsible for a tremendous amount 55 55
of security breaches over the past few years. 56 56
Passwordless authentication systems also provide 57 57
a better user experience because the end user doesn't have 58 58
to remember a complicated password 59 59
or renew or change those passwords at frequent intervals. 60 60
These systems can also lead to the reduction 61 61
in IT costs because there's no longer a need 62 62
for password storage or management 63 63
because all of that is going to be taken away, 64 64
along with the backend auditing involved 65 65
with validating the security 66 66
of your password management program. 67 67
Also, passwordless authentication is going to allow 68 68
for better visibility in terms of your credential use 69 69
because the user's credentials are more tightly paired 70 70
with a specific device 71 71
or inherent attribute that is more likely to remain 72 72
with the user at all times, like their fingerprints. 73 73
because they're always with the user. 74 74
Finally, passwordless authentication also leads 75 75
to better scalability 76 76
because the users can manage multiple logins 77 77
without having member additional passwords 78 78
because a single token can be used across multiple systems, 79 79
platforms or applications. 80 80
Now, unfortunately, there are a few downsides 81 81
to relying on passwordless authentication, though, 82 82
such as higher implementation costs, 83 83
the additional training and expertise needed and the fact 84 84
that this can provide a single point of failure 85 85
since all of your systems are relying 86 86
on a single passwordless authentication factor, 87 87
like a token or a similar device. 88 88
For example, if you're relying 89 89
on a biometric authentication factor 90 90
for your passwordless authentication system 91 91
you're now going to have to worry 92 92
about biometric impersonation as this could render all 93 93
of our security useless. 94 94
Biometric impersonation is the actor pretending 95 95
to be another user to bypass a biometric-based 96 96
passwordless authentication system. 97 97
For example, if you've ever watched a spy movie, 98 98
you've probably seen a spy try to collect 99 99
an authorized user's fingerprints 100 100
from a can of soda or a glass 101 101
and then they try to recreate that user's unique fingerprint 102 102
with all of its ridges and valleys 103 103
in order to bypass a fingerprint scanner 104 104
and steal whatever secrets lie beyond the locked door. 105 105
This is the Hollywood version of biometric impersonation. 106 106
That's essentially what we're talking about here. 107 107
If you're going to rely on a passwordless authentication system 108 108
with only a single factor, such as a fingerprint reader 109 109
or a facial scanner or a retinal scanner, 110 110
you need to ensure 111 111
that that system has a very low false positive rate 112 112
in order to prevent biometric impersonation 113 113
from being successful. 114 114
Overall, though, using fingerprints 115 115
and facial recognition is considered fairly secure. 116 116
For example, if you consider the iPhone's touch ID 117 117
and face ID systems, 118 118
as compared to a standard pin for authentication, 119 119
you're going to see they're decently secure. 120 120
A standard four digit pin has a one 121 121
in 10,000 chance of being guessed by an attacker, 122 122
but if you're using touch ID with your fingerprint 123 123
to unlock your device, the chances somebody 124 124
else's fingerprint will unlock your device goes 125 125
up to one in 50,000, may get five times more secure. 126 126
If you're using face ID 127 127
with its facial recognition scanning to secure your device, 128 128
the chances of somebody else's face unlocking 129 129
your device goes up to one in one million. 130 130
But for the most secure implementation 131 131
of a passwordless authentication system, 132 132
you should still combine two 133 133
or more factors to unlock a device 134 134
and create a multi-factor authentication schema or MFA. 135 135
For example, if you combine facial recognition 136 136
with a onetime pin from an RSA key fob, 137 137
your overall security 138 138
of your systems is going to increase tremendously 139 139
because MFA is much more secure than any single factor.