1 1 00:00:00,870 --> 00:00:01,860 In this lesson, 2 2 00:00:01,860 --> 00:00:04,290 we're going to discuss passwordless authentication 3 3 00:00:04,290 --> 00:00:07,650 and an attack known as biometric impersonation. 4 4 00:00:07,650 --> 00:00:09,510 Now, passwordless authentication is 5 5 00:00:09,510 --> 00:00:11,160 an authentication mechanism 6 6 00:00:11,160 --> 00:00:13,440 in which a user can log into a computer system 7 7 00:00:13,440 --> 00:00:16,350 without entering and having to remember a password 8 8 00:00:16,350 --> 00:00:18,150 or other knowledge base secret. 9 9 00:00:18,150 --> 00:00:19,230 There are many different types 10 10 00:00:19,230 --> 00:00:21,720 of passwordless authentications in use today, 11 11 00:00:21,720 --> 00:00:24,660 most relying on a public key cryptography infrastructure 12 12 00:00:24,660 --> 00:00:27,690 with a private key being stored on a user's device. 13 13 00:00:27,690 --> 00:00:30,510 In general, passwordless authentication factors fall 14 14 00:00:30,510 --> 00:00:33,270 into two types of factors, ownership factors 15 15 00:00:33,270 --> 00:00:34,920 and inheritance factors. 16 16 00:00:34,920 --> 00:00:37,590 Now, ownership factors include something that the user has 17 17 00:00:37,590 --> 00:00:38,640 in their possession. 18 18 00:00:38,640 --> 00:00:41,490 This can be their smartphone, a one-time pin token, 19 19 00:00:41,490 --> 00:00:43,957 a smart car, or another type of hardware token. 20 20 00:00:43,957 --> 00:00:47,160 Inheritance factors include something the user is, 21 21 00:00:47,160 --> 00:00:49,740 and it's usually going to be a biometric identifier, such as 22 22 00:00:49,740 --> 00:00:53,100 their fingerprints, a retinal scan, a facial recognition, 23 23 00:00:53,100 --> 00:00:55,680 voice recognition or other things like that. 24 24 00:00:55,680 --> 00:00:58,170 Well, these are the most common replacements for a password. 25 25 00:00:58,170 --> 00:01:00,960 Any type of authentication system that no longer relies 26 26 00:01:00,960 --> 00:01:03,420 on a password could be considered a passwordless 27 27 00:01:03,420 --> 00:01:05,130 authentication system. 28 28 00:01:05,130 --> 00:01:07,350 For example, some organizations have begun 29 29 00:01:07,350 --> 00:01:09,810 to implement a passwordless authentication system 30 30 00:01:09,810 --> 00:01:11,250 that relies on the user entering in 31 31 00:01:11,250 --> 00:01:13,170 their email address to log in. 32 32 00:01:13,170 --> 00:01:14,190 When they do this, 33 33 00:01:14,190 --> 00:01:16,890 the system sends them a one-time use login link 34 34 00:01:16,890 --> 00:01:19,770 to their email that's valid for only five minutes. 35 35 00:01:19,770 --> 00:01:21,090 If the user doesn't click that link 36 36 00:01:21,090 --> 00:01:22,440 within the next five minutes, 37 37 00:01:22,440 --> 00:01:25,200 the link becomes invalid and it's no longer usable. 38 38 00:01:25,200 --> 00:01:27,480 If they do click the link, it logs them in. 39 39 00:01:27,480 --> 00:01:29,580 Again, here the user is not required 40 40 00:01:29,580 --> 00:01:32,523 to enter a password to login, only their email address, 41 41 00:01:33,439 --> 00:01:35,250 which, in this case, is acting as an ownership factor, 42 42 00:01:35,250 --> 00:01:38,250 and this makes it a passwordless authentication system. 43 43 00:01:38,250 --> 00:01:40,500 Now, passwordless authentication systems have 44 44 00:01:40,500 --> 00:01:43,200 many different benefits, such as greater security, 45 45 00:01:43,200 --> 00:01:46,050 a better user experience, reduced IT costs, 46 46 00:01:46,050 --> 00:01:47,640 better visibility into who's using 47 47 00:01:47,640 --> 00:01:50,610 a specific credential and scalability. 48 48 00:01:50,610 --> 00:01:51,480 In general, 49 49 00:01:51,480 --> 00:01:53,970 passwordless authentication systems are more secure 50 50 00:01:53,970 --> 00:01:56,040 than password-based authentication systems 51 51 00:01:56,040 --> 00:01:57,810 because you're removing the knowledge factor 52 52 00:01:57,810 --> 00:02:00,780 that could easily be stolen or guessed by an attacker. 53 53 00:02:00,780 --> 00:02:03,090 Passwords have been determined to be the top attack vector 54 54 00:02:03,090 --> 00:02:05,550 for hackers, and they're responsible for a tremendous amount 55 55 00:02:05,550 --> 00:02:08,370 of security breaches over the past few years. 56 56 00:02:08,370 --> 00:02:10,590 Passwordless authentication systems also provide 57 57 00:02:10,590 --> 00:02:13,290 a better user experience because the end user doesn't have 58 58 00:02:13,290 --> 00:02:15,270 to remember a complicated password 59 59 00:02:15,270 --> 00:02:18,750 or renew or change those passwords at frequent intervals. 60 60 00:02:18,750 --> 00:02:20,610 These systems can also lead to the reduction 61 61 00:02:20,610 --> 00:02:22,770 in IT costs because there's no longer a need 62 62 00:02:22,770 --> 00:02:23,603 for password storage or management 63 63 00:02:23,603 --> 00:02:27,120 because all of that is going to be taken away, 64 64 00:02:27,120 --> 00:02:29,010 along with the backend auditing involved 65 65 00:02:29,010 --> 00:02:30,210 with validating the security 66 66 00:02:30,210 --> 00:02:32,430 of your password management program. 67 67 00:02:32,430 --> 00:02:34,830 Also, passwordless authentication is going to allow 68 68 00:02:34,830 --> 00:02:37,500 for better visibility in terms of your credential use 69 69 00:02:37,500 --> 00:02:39,990 because the user's credentials are more tightly paired 70 70 00:02:39,990 --> 00:02:41,250 with a specific device 71 71 00:02:41,250 --> 00:02:43,830 or inherent attribute that is more likely to remain 72 72 00:02:43,830 --> 00:02:46,560 with the user at all times, like their fingerprints. 73 73 00:02:46,560 --> 00:02:48,420 because they're always with the user. 74 74 00:02:48,420 --> 00:02:50,850 Finally, passwordless authentication also leads 75 75 00:02:50,850 --> 00:02:52,200 to better scalability 76 76 00:02:52,200 --> 00:02:54,330 because the users can manage multiple logins 77 77 00:02:54,330 --> 00:02:56,370 without having member additional passwords 78 78 00:02:56,370 --> 00:02:59,250 because a single token can be used across multiple systems, 79 79 00:02:59,250 --> 00:03:01,200 platforms or applications. 80 80 00:03:01,200 --> 00:03:03,270 Now, unfortunately, there are a few downsides 81 81 00:03:03,270 --> 00:03:05,670 to relying on passwordless authentication, though, 82 82 00:03:05,670 --> 00:03:07,530 such as higher implementation costs, 83 83 00:03:07,530 --> 00:03:10,898 the additional training and expertise needed and the fact 84 84 00:03:10,898 --> 00:03:12,120 that this can provide a single point of failure 85 85 00:03:12,120 --> 00:03:13,680 since all of your systems are relying 86 86 00:03:13,680 --> 00:03:16,020 on a single passwordless authentication factor, 87 87 00:03:16,020 --> 00:03:18,180 like a token or a similar device. 88 88 00:03:18,180 --> 00:03:19,620 For example, if you're relying 89 89 00:03:19,620 --> 00:03:21,630 on a biometric authentication factor 90 90 00:03:21,630 --> 00:03:23,760 for your passwordless authentication system 91 91 00:03:23,760 --> 00:03:24,720 you're now going to have to worry 92 92 00:03:24,720 --> 00:03:27,480 about biometric impersonation as this could render all 93 93 00:03:27,480 --> 00:03:29,490 of our security useless. 94 94 00:03:29,490 --> 00:03:31,800 Biometric impersonation is the actor pretending 95 95 00:03:31,800 --> 00:03:34,740 to be another user to bypass a biometric-based 96 96 00:03:34,740 --> 00:03:36,780 passwordless authentication system. 97 97 00:03:36,780 --> 00:03:39,150 For example, if you've ever watched a spy movie, 98 98 00:03:39,150 --> 00:03:40,920 you've probably seen a spy try to collect 99 99 00:03:40,920 --> 00:03:42,450 an authorized user's fingerprints 100 100 00:03:42,450 --> 00:03:44,370 from a can of soda or a glass 101 101 00:03:44,370 --> 00:03:47,250 and then they try to recreate that user's unique fingerprint 102 102 00:03:47,250 --> 00:03:48,840 with all of its ridges and valleys 103 103 00:03:48,840 --> 00:03:50,820 in order to bypass a fingerprint scanner 104 104 00:03:50,820 --> 00:03:53,550 and steal whatever secrets lie beyond the locked door. 105 105 00:03:53,550 --> 00:03:56,640 This is the Hollywood version of biometric impersonation. 106 106 00:03:56,640 --> 00:03:58,950 That's essentially what we're talking about here. 107 107 00:03:58,950 --> 00:04:01,650 If you're going to rely on a passwordless authentication system 108 108 00:04:01,650 --> 00:04:04,470 with only a single factor, such as a fingerprint reader 109 109 00:04:04,470 --> 00:04:06,810 or a facial scanner or a retinal scanner, 110 110 00:04:06,810 --> 00:04:07,643 you need to ensure 111 111 00:04:07,643 --> 00:04:10,530 that that system has a very low false positive rate 112 112 00:04:10,530 --> 00:04:12,750 in order to prevent biometric impersonation 113 113 00:04:12,750 --> 00:04:14,220 from being successful. 114 114 00:04:14,220 --> 00:04:15,960 Overall, though, using fingerprints 115 115 00:04:15,960 --> 00:04:18,930 and facial recognition is considered fairly secure. 116 116 00:04:18,930 --> 00:04:21,660 For example, if you consider the iPhone's touch ID 117 117 00:04:21,660 --> 00:04:23,130 and face ID systems, 118 118 00:04:23,130 --> 00:04:25,530 as compared to a standard pin for authentication, 119 119 00:04:25,530 --> 00:04:27,900 you're going to see they're decently secure. 120 120 00:04:27,900 --> 00:04:29,820 A standard four digit pin has a one 121 121 00:04:29,820 --> 00:04:32,370 in 10,000 chance of being guessed by an attacker, 122 122 00:04:32,370 --> 00:04:34,560 but if you're using touch ID with your fingerprint 123 123 00:04:34,560 --> 00:04:36,480 to unlock your device, the chances somebody 124 124 00:04:36,480 --> 00:04:38,700 else's fingerprint will unlock your device goes 125 125 00:04:38,700 --> 00:04:42,660 up to one in 50,000, may get five times more secure. 126 126 00:04:42,660 --> 00:04:44,100 If you're using face ID 127 127 00:04:44,100 --> 00:04:46,800 with its facial recognition scanning to secure your device, 128 128 00:04:46,800 --> 00:04:48,780 the chances of somebody else's face unlocking 129 129 00:04:48,780 --> 00:04:51,690 your device goes up to one in one million. 130 130 00:04:51,690 --> 00:04:53,610 But for the most secure implementation 131 131 00:04:53,610 --> 00:04:55,740 of a passwordless authentication system, 132 132 00:04:55,740 --> 00:04:56,910 you should still combine two 133 133 00:04:56,910 --> 00:04:58,860 or more factors to unlock a device 134 134 00:04:58,860 --> 00:05:02,610 and create a multi-factor authentication schema or MFA. 135 135 00:05:02,610 --> 00:05:05,070 For example, if you combine facial recognition 136 136 00:05:05,070 --> 00:05:07,560 with a onetime pin from an RSA key fob, 137 137 00:05:07,560 --> 00:05:08,550 your overall security 138 138 00:05:08,550 --> 00:05:10,890 of your systems is going to increase tremendously 139 139 00:05:10,890 --> 00:05:14,193 because MFA is much more secure than any single factor.