1 00:00:00,440 --> 00:00:01,320 In this lesson, 2 00:00:01,320 --> 00:00:04,640 we are going to discuss multifactor authentication. 3 00:00:04,640 --> 00:00:06,480 Multifactor authentication, 4 00:00:06,480 --> 00:00:08,160 commonly referred to as MFA, 5 00:00:08,160 --> 00:00:10,080 is a security system that requires 6 00:00:10,080 --> 00:00:12,180 more than one method of authentication 7 00:00:12,180 --> 00:00:14,400 from independent categories of credentials 8 00:00:14,400 --> 00:00:16,740 to verify the user's identity. 9 00:00:16,740 --> 00:00:18,630 The goal of multifactor authentication 10 00:00:18,630 --> 00:00:21,960 is to create a layered defense and make it more difficult 11 00:00:21,960 --> 00:00:24,420 for an unauthorized person to access a target, 12 00:00:24,420 --> 00:00:26,940 such as a physical location, computing device, 13 00:00:26,940 --> 00:00:29,370 network, or database. 14 00:00:29,370 --> 00:00:32,640 Multifactor authentication revolves around the concept 15 00:00:32,640 --> 00:00:36,540 of combining at least two or more independent credentials 16 00:00:36,540 --> 00:00:39,540 from across five different categories of authentication, 17 00:00:39,540 --> 00:00:43,230 including something you know, or a knowledge-based factor, 18 00:00:43,230 --> 00:00:46,230 something you have, or a possession-based factor, 19 00:00:46,230 --> 00:00:49,350 something you are, or an inherence-based factor, 20 00:00:49,350 --> 00:00:52,500 something you do, or a behavior-based factor, 21 00:00:52,500 --> 00:00:56,670 and somewhere you are, or a location-based factor. 22 00:00:56,670 --> 00:00:58,920 First, we have something that you know. 23 00:00:58,920 --> 00:01:01,380 This is also known as a knowledge-based factor. 24 00:01:01,380 --> 00:01:03,870 Something you know involves knowledge-based information 25 00:01:03,870 --> 00:01:06,690 that the user must provide to authenticate their identity, 26 00:01:06,690 --> 00:01:08,670 such as a password or a PIN, 27 00:01:08,670 --> 00:01:11,220 or answer some secret question about the user, 28 00:01:11,220 --> 00:01:12,690 like their pet's name. 29 00:01:12,690 --> 00:01:14,610 For example, when you try to unlock your iPhone 30 00:01:14,610 --> 00:01:17,280 using the six-digit PIN, you are using something you know 31 00:01:17,280 --> 00:01:19,290 or a knowledge-based factor. 32 00:01:19,290 --> 00:01:21,600 Second, we have something you have, 33 00:01:21,600 --> 00:01:24,480 also known as possession-based factor. 34 00:01:24,480 --> 00:01:26,130 Something you have involves 35 00:01:26,130 --> 00:01:28,650 something the user physically possesses, 36 00:01:28,650 --> 00:01:31,530 like a smart card or a hardware token, like a key fob, 37 00:01:31,530 --> 00:01:34,290 or a software token used with your smartphone. 38 00:01:34,290 --> 00:01:36,870 A smart card is an identification card 39 00:01:36,870 --> 00:01:38,610 about the size of a credit card 40 00:01:38,610 --> 00:01:41,100 that is embedded with an integrated circuit 41 00:01:41,100 --> 00:01:43,980 that can process data to authenticate a user 42 00:01:43,980 --> 00:01:46,320 in a high security access system. 43 00:01:46,320 --> 00:01:48,150 When I used to work for the US government, 44 00:01:48,150 --> 00:01:49,650 I was issued a smart card, 45 00:01:49,650 --> 00:01:52,573 which acted as my employee identification badge. 46 00:01:52,573 --> 00:01:54,930 I would insert this smart card into my laptop 47 00:01:54,930 --> 00:01:58,200 and enter a six to eight digit PIN to unlock smart card, 48 00:01:58,200 --> 00:02:00,270 and this in turn would unlock my laptop 49 00:02:00,270 --> 00:02:01,920 to let me begin my workday. 50 00:02:01,920 --> 00:02:04,707 In this setup, the smart card was the possession factor 51 00:02:04,707 --> 00:02:07,050 and the PIN was a knowledge factor, 52 00:02:07,050 --> 00:02:08,850 so using the smart card and PIN 53 00:02:08,850 --> 00:02:12,300 created a pretty secure multifactor authentication 54 00:02:12,300 --> 00:02:14,940 or two-factor authentication system. 55 00:02:14,940 --> 00:02:16,980 A hardware token, also known as a key fob, 56 00:02:16,980 --> 00:02:19,830 is a physical device used for securing access 57 00:02:19,830 --> 00:02:23,310 by generating a unique code that is then typically used 58 00:02:23,310 --> 00:02:26,100 within a multifactor authentication system. 59 00:02:26,100 --> 00:02:28,560 These portable devices enhance security 60 00:02:28,560 --> 00:02:30,720 by creating a rapidly changing code 61 00:02:30,720 --> 00:02:33,690 that is sent to the user every 30 to 60 seconds 62 00:02:33,690 --> 00:02:36,270 during the authentication process. 63 00:02:36,270 --> 00:02:38,160 This user must provide the code, 64 00:02:38,160 --> 00:02:40,500 in addition to their regular login credentials, 65 00:02:40,500 --> 00:02:43,440 to ensure that the person who is attempting to gain access 66 00:02:43,440 --> 00:02:46,650 actually possesses the correct physical device. 67 00:02:46,650 --> 00:02:48,690 This significantly reduces the likelihood 68 00:02:48,690 --> 00:02:51,330 of unauthorized access through stolen credentials, 69 00:02:51,330 --> 00:02:53,820 since the attacker would also need to be in possession 70 00:02:53,820 --> 00:02:57,570 of the hardware token in order to access the given system. 71 00:02:57,570 --> 00:02:59,880 Another commonly used type of hardware token 72 00:02:59,880 --> 00:03:02,730 is a USB-based hardware token 73 00:03:02,730 --> 00:03:05,310 that contains a digital private key certificate 74 00:03:05,310 --> 00:03:08,520 that can be used during the authentication process. 75 00:03:08,520 --> 00:03:10,230 With these types of hardware keys, 76 00:03:10,230 --> 00:03:12,210 you simply need to have the device connected 77 00:03:12,210 --> 00:03:15,360 to your workstation or laptop during the login process. 78 00:03:15,360 --> 00:03:18,150 The digital certificate located on the hardware token 79 00:03:18,150 --> 00:03:20,220 is checked as part of your possession factor 80 00:03:20,220 --> 00:03:22,320 authentication process. 81 00:03:22,320 --> 00:03:24,108 A software token or a soft token 82 00:03:24,108 --> 00:03:27,600 is used to perform the same function as a hardware token, 83 00:03:27,600 --> 00:03:30,180 but don't require a dedicated piece of hardware, 84 00:03:30,180 --> 00:03:34,170 like a smart card, key fob, or USB hardware token. 85 00:03:34,170 --> 00:03:37,710 Instead, a software token, or soft tokens, 86 00:03:37,710 --> 00:03:39,600 are typically configured as an application 87 00:03:39,600 --> 00:03:42,210 or a piece of software that's installed on an device 88 00:03:42,210 --> 00:03:44,850 that the user already possesses, like their smartphone, 89 00:03:44,850 --> 00:03:48,930 tablet, smartwatch, laptop, or desktop computer. 90 00:03:48,930 --> 00:03:51,000 When the user attempts to log in, 91 00:03:51,000 --> 00:03:54,630 the software token software will generate a one-time code 92 00:03:54,630 --> 00:03:57,480 that the user enters during the authentication process. 93 00:03:57,480 --> 00:04:00,660 Like hardware tokens, these codes are typically time-based 94 00:04:00,660 --> 00:04:03,210 and will change every 30 to 60 seconds. 95 00:04:03,210 --> 00:04:05,820 Generally, software tokens will take two forms, 96 00:04:05,820 --> 00:04:07,110 an authenticator app 97 00:04:07,110 --> 00:04:11,040 or an SMS-based one-time-code-use token. 98 00:04:11,040 --> 00:04:13,410 Authenticator apps like Google Authenticator 99 00:04:13,410 --> 00:04:15,750 or Microsoft Authenticator can be used 100 00:04:15,750 --> 00:04:18,990 to generate time-based, one-time passcodes 101 00:04:18,990 --> 00:04:20,940 for use in the authentication process 102 00:04:20,940 --> 00:04:23,220 for most websites or applications. 103 00:04:23,220 --> 00:04:24,630 These authenticator apps 104 00:04:24,630 --> 00:04:27,210 work exactly like the hardware token key fobs 105 00:04:27,210 --> 00:04:30,300 we just discussed, but use a software authenticator app 106 00:04:30,300 --> 00:04:32,550 that allows for cheaper and faster deployments 107 00:04:32,550 --> 00:04:36,420 to your user located across your enterprise network. 108 00:04:36,420 --> 00:04:38,220 The second type of software token 109 00:04:38,220 --> 00:04:39,930 relies on using your smartphone 110 00:04:39,930 --> 00:04:42,210 as the token receiving system itself 111 00:04:42,210 --> 00:04:44,130 by sending you a one-time code 112 00:04:44,130 --> 00:04:47,490 to the user's registered phone number or email address. 113 00:04:47,490 --> 00:04:50,520 In this system, the SMS-based message is received 114 00:04:50,520 --> 00:04:52,710 with a one-time code that is then valid 115 00:04:52,710 --> 00:04:54,720 for between three to 10 minutes. 116 00:04:54,720 --> 00:04:55,860 During that time, 117 00:04:55,860 --> 00:04:58,320 the user must enter their login credentials, 118 00:04:58,320 --> 00:05:01,200 which is something they know, and this one-time code, 119 00:05:01,200 --> 00:05:03,390 which is now considered something they have, 120 00:05:03,390 --> 00:05:06,840 or possession factor, since they had to have the phone 121 00:05:06,840 --> 00:05:09,300 to receive that one-time code. 122 00:05:09,300 --> 00:05:11,940 Using either a hardware or a software token 123 00:05:11,940 --> 00:05:14,100 can provide an extra layer of security 124 00:05:14,100 --> 00:05:16,800 in the multifactor authentication system. 125 00:05:16,800 --> 00:05:19,080 The specific choice between using a hardware 126 00:05:19,080 --> 00:05:21,750 or software token would depend on the specific needs 127 00:05:21,750 --> 00:05:24,030 and resources of your organization. 128 00:05:24,030 --> 00:05:25,950 Third on the list is something you are, 129 00:05:25,950 --> 00:05:28,800 also known as inherence-based factor. 130 00:05:28,800 --> 00:05:31,680 Something you are involves biometric characteristics 131 00:05:31,680 --> 00:05:34,560 that are unique to individuals, including fingerprints, 132 00:05:34,560 --> 00:05:38,310 facial recognition, voice recognition, or iris scans. 133 00:05:38,310 --> 00:05:41,400 Older iPhones, for example, rely on a fingerprint scan 134 00:05:41,400 --> 00:05:43,380 to unlock a user's smartphone. 135 00:05:43,380 --> 00:05:46,200 According to Apple, there's a one in 50,000 chance 136 00:05:46,200 --> 00:05:48,450 that another person's finger could be used 137 00:05:48,450 --> 00:05:49,560 to unlock your iPhone 138 00:05:49,560 --> 00:05:51,330 because their systems are tuned pretty well 139 00:05:51,330 --> 00:05:53,700 to prevent a false acceptance. 140 00:05:53,700 --> 00:05:56,910 But using a Face ID system is even better 141 00:05:56,910 --> 00:06:00,480 and has been widely used for about the last five years now. 142 00:06:00,480 --> 00:06:02,400 If you use a modern smartphone, 143 00:06:02,400 --> 00:06:05,580 like an Apple iPhone or an Android phone, 144 00:06:05,580 --> 00:06:08,190 you probably use biometrics to unlock your phone 145 00:06:08,190 --> 00:06:11,850 on a daily basis by using a facial recognition scan. 146 00:06:11,850 --> 00:06:14,340 With Apple's Face ID, for example, 147 00:06:14,340 --> 00:06:16,650 you can simply look at the front-facing camera 148 00:06:16,650 --> 00:06:18,810 whenever you want to unlock your phone, 149 00:06:18,810 --> 00:06:21,540 and the phone will then use the TrueDepth camera 150 00:06:21,540 --> 00:06:24,060 to capture a new image in depth map, 151 00:06:24,060 --> 00:06:25,980 which is then analyzed by a neural engine 152 00:06:25,980 --> 00:06:29,130 inside of the phone that compares this newly taken image 153 00:06:29,130 --> 00:06:31,470 against the biometric facial data 154 00:06:31,470 --> 00:06:33,240 already stored on the phone. 155 00:06:33,240 --> 00:06:35,280 If the image and the stored data match, 156 00:06:35,280 --> 00:06:37,680 then the device will unlock itself. 157 00:06:37,680 --> 00:06:40,410 With Face ID, Apple claims that the probability 158 00:06:40,410 --> 00:06:43,050 that another person's face will unlock your iPhone 159 00:06:43,050 --> 00:06:44,880 is approximately one in a million, 160 00:06:44,880 --> 00:06:47,100 making it about 20 times more secure 161 00:06:47,100 --> 00:06:49,530 than a former fingerprint-based authentication system 162 00:06:49,530 --> 00:06:52,320 used in older models of the iPhone. 163 00:06:52,320 --> 00:06:54,570 In recent years, biometric factors 164 00:06:54,570 --> 00:06:57,030 have rapidly increased in their utilization, 165 00:06:57,030 --> 00:06:59,340 especially with multifactor authentication systems, 166 00:06:59,340 --> 00:07:00,390 due to the advancements 167 00:07:00,390 --> 00:07:02,730 of this type of authentication technology 168 00:07:02,730 --> 00:07:04,650 and its inherent difficulty 169 00:07:04,650 --> 00:07:08,220 in replicating someone's biometric authentication data. 170 00:07:08,220 --> 00:07:10,260 Fourth, we have somewhere you are, 171 00:07:10,260 --> 00:07:12,810 also known as a location-based factor. 172 00:07:12,810 --> 00:07:15,810 Somewhere you are involves determining a user's location 173 00:07:15,810 --> 00:07:17,250 to help authenticate them. 174 00:07:17,250 --> 00:07:19,770 This could be done through IP address verification, 175 00:07:19,770 --> 00:07:23,250 GPS tracking, or by connecting to a specific network. 176 00:07:23,250 --> 00:07:26,670 For example, access points may be restricted to a user 177 00:07:26,670 --> 00:07:28,980 within a specific geographical location, 178 00:07:28,980 --> 00:07:31,650 such as allowing someone to log into a given website 179 00:07:31,650 --> 00:07:34,890 only if they're located outside of the United States. 180 00:07:34,890 --> 00:07:36,840 Fifth, we have something you do, 181 00:07:36,840 --> 00:07:39,540 also known as a behavior-based factor. 182 00:07:39,540 --> 00:07:42,180 Something you do involves recognizing patterns 183 00:07:42,180 --> 00:07:44,100 that are typically associated with a user, 184 00:07:44,100 --> 00:07:46,920 such as their keystroke patterns, mouse movement, 185 00:07:46,920 --> 00:07:49,710 or even the way they walk down the hallway. 186 00:07:49,710 --> 00:07:52,980 Something you do is considered one of the newer categories 187 00:07:52,980 --> 00:07:55,560 that are used in multifactor authentication systems, 188 00:07:55,560 --> 00:07:57,870 and something you do is often used 189 00:07:57,870 --> 00:08:00,540 as a secondary factor in authentication systems 190 00:08:00,540 --> 00:08:04,080 and is rarely used in a single-factor authentication system. 191 00:08:04,080 --> 00:08:06,330 Another example of behavior-based factors 192 00:08:06,330 --> 00:08:08,610 could be the way someone interacts with an device, 193 00:08:08,610 --> 00:08:11,520 such as their specific pattern of swiping, scrolling, 194 00:08:11,520 --> 00:08:14,130 or even the way they hold their device. 195 00:08:14,130 --> 00:08:16,230 These unique behavior patterns 196 00:08:16,230 --> 00:08:17,940 can then be used to create a profile 197 00:08:17,940 --> 00:08:20,430 that helps authenticate the user's identity. 198 00:08:20,430 --> 00:08:22,140 Now, when it comes to authentication, 199 00:08:22,140 --> 00:08:23,760 we have three main types, 200 00:08:23,760 --> 00:08:27,069 single-factor, two-factor, and multifactor. 201 00:08:27,069 --> 00:08:28,770 Single-factor authentication 202 00:08:28,770 --> 00:08:31,290 involves using a single authentication factor 203 00:08:31,290 --> 00:08:32,970 to access a user account. 204 00:08:32,970 --> 00:08:36,360 For example, if you simply enter your username and password 205 00:08:36,360 --> 00:08:37,799 to log into the website, 206 00:08:37,799 --> 00:08:40,020 that is a single-factor authentication. 207 00:08:40,020 --> 00:08:41,190 Now, wait a minute. 208 00:08:41,190 --> 00:08:42,417 Isn't the username one factor 209 00:08:42,417 --> 00:08:44,100 and the password a second factor, 210 00:08:44,100 --> 00:08:46,590 so wouldn't this be considered two-factor authentication? 211 00:08:46,590 --> 00:08:49,830 Well, no, because both of those are something you know 212 00:08:49,830 --> 00:08:51,900 or knowledge-based factors. 213 00:08:51,900 --> 00:08:53,940 Even if I added a security question 214 00:08:53,940 --> 00:08:56,010 after you enter your username and password, 215 00:08:56,010 --> 00:08:57,750 like asking you your first pet's name 216 00:08:57,750 --> 00:08:59,490 or the high school mascot, 217 00:08:59,490 --> 00:09:02,220 this is still considered a single-factor authentication 218 00:09:02,220 --> 00:09:04,800 because all three pieces of authentication data, 219 00:09:04,800 --> 00:09:06,570 your username, your password, 220 00:09:06,570 --> 00:09:08,220 and the answer to your security question, 221 00:09:08,220 --> 00:09:11,400 are considered to be knowledge-based factors. 222 00:09:11,400 --> 00:09:13,500 This brings us to our next type of authentication, 223 00:09:13,500 --> 00:09:15,570 which is two-factor authentication. 224 00:09:15,570 --> 00:09:18,720 Two-factor authentication, also known as 2FA, 225 00:09:18,720 --> 00:09:21,090 involves using two different authentication factors 226 00:09:21,090 --> 00:09:22,830 to gain access to a system. 227 00:09:22,830 --> 00:09:25,660 So, if you enter your username and password 228 00:09:25,660 --> 00:09:27,210 as part of the authentication process, 229 00:09:27,210 --> 00:09:28,980 that will be the first factor. 230 00:09:28,980 --> 00:09:31,170 Then, if you are sending a text message to your smartphone 231 00:09:31,170 --> 00:09:34,110 with a random six-digit code, that will be a second factor, 232 00:09:34,110 --> 00:09:35,700 since this is a possession factor, 233 00:09:35,700 --> 00:09:37,890 proving that you have your smartphone with you. 234 00:09:37,890 --> 00:09:40,560 Now we have 2FA or two-factor authentication, 235 00:09:40,560 --> 00:09:43,320 since we're required to enter our knowledge-based factor 236 00:09:43,320 --> 00:09:45,660 and then provide our possession-based factor, 237 00:09:45,660 --> 00:09:48,540 giving us two factors of authentication. 238 00:09:48,540 --> 00:09:49,890 Now, if you have two factors, 239 00:09:49,890 --> 00:09:52,410 you may also hear this called multifactor authentication. 240 00:09:52,410 --> 00:09:55,410 Multifactor authentication occurs whenever you use two 241 00:09:55,410 --> 00:09:58,530 or more factors to authenticate within a given system. 242 00:09:58,530 --> 00:10:01,740 So, 2FA is actually considered MFA as well, 243 00:10:01,740 --> 00:10:06,210 but it is a specific type of MFA, since MFA can use two, 244 00:10:06,210 --> 00:10:09,780 three, four, or five factors for authentication. 245 00:10:09,780 --> 00:10:12,330 As a basic rule, the more types of authentication 246 00:10:12,330 --> 00:10:13,830 that you use to validate a user, 247 00:10:13,830 --> 00:10:15,660 the safer your system will be. 248 00:10:15,660 --> 00:10:18,360 But conversely, the more factors you require, 249 00:10:18,360 --> 00:10:19,980 the harder it is for your end users 250 00:10:19,980 --> 00:10:21,240 to gain access to the system 251 00:10:21,240 --> 00:10:22,740 in order to complete their work, 252 00:10:22,740 --> 00:10:25,860 making this a security versus convenience trade-off. 253 00:10:25,860 --> 00:10:27,420 For this reason, most companies 254 00:10:27,420 --> 00:10:29,700 will use multifactor authentication systems 255 00:10:29,700 --> 00:10:32,910 using two or three factors, something you know, 256 00:10:32,910 --> 00:10:33,750 something you have, 257 00:10:33,750 --> 00:10:36,360 or something you know, something you are, 258 00:10:36,360 --> 00:10:39,180 something you have, and somewhere you are. 259 00:10:39,180 --> 00:10:40,650 As you have probably guessed 260 00:10:40,650 --> 00:10:42,810 the most commonly used authentication factor 261 00:10:42,810 --> 00:10:44,490 is knowledge-based authentication factor, 262 00:10:44,490 --> 00:10:46,230 like passwords and PINs. 263 00:10:46,230 --> 00:10:47,970 Passwords have been a fundamental part 264 00:10:47,970 --> 00:10:51,240 of security for a long time, but they often pose challenges 265 00:10:51,240 --> 00:10:53,820 for both our users and our developers. 266 00:10:53,820 --> 00:10:55,890 Remembering a lot of different complex passwords 267 00:10:55,890 --> 00:10:57,810 can be difficult tasks for most users, 268 00:10:57,810 --> 00:11:00,120 so this leads to many simply using weaker 269 00:11:00,120 --> 00:11:01,590 and easy to remember passwords, 270 00:11:01,590 --> 00:11:04,200 or reusing the same long, strong password 271 00:11:04,200 --> 00:11:06,330 across multiple websites, which in turn 272 00:11:06,330 --> 00:11:08,220 removes most of the security benefits 273 00:11:08,220 --> 00:11:11,490 of having that long, strong password to begin with. 274 00:11:11,490 --> 00:11:13,590 Many users will also use a password manager 275 00:11:13,590 --> 00:11:17,010 like Bitwarden or even a built-in password manager, 276 00:11:17,010 --> 00:11:18,690 like the one provided in Google Chrome, 277 00:11:18,690 --> 00:11:21,000 which is called the Google Password Manager. 278 00:11:21,000 --> 00:11:23,460 These password managers can generate different 279 00:11:23,460 --> 00:11:26,400 long, strong, and complex password for each website 280 00:11:26,400 --> 00:11:28,050 or application that you use, 281 00:11:28,050 --> 00:11:30,150 and then it will store these passwords safely 282 00:11:30,150 --> 00:11:32,160 in a centralized vault that's encrypted 283 00:11:32,160 --> 00:11:35,370 using a single long, strong password that you created. 284 00:11:35,370 --> 00:11:37,170 Personally, I found this to be an effective way 285 00:11:37,170 --> 00:11:40,560 to maintain high security when using a password-based system 286 00:11:40,560 --> 00:11:43,500 without having to remember 300-plus passwords. 287 00:11:43,500 --> 00:11:45,870 In reality, though, the use of password managers 288 00:11:45,870 --> 00:11:49,080 to create unique passwords does increase our security a bit, 289 00:11:49,080 --> 00:11:52,050 but passwords in general still inherently lack 290 00:11:52,050 --> 00:11:55,290 a lot of the robust security that we want to achieve. 291 00:11:55,290 --> 00:11:56,730 To increase our security, 292 00:11:56,730 --> 00:11:59,130 we may opt to use multifactor authentication, 293 00:11:59,130 --> 00:12:00,780 but this will introduce additional steps 294 00:12:00,780 --> 00:12:03,030 that the user must take when logging into the system, 295 00:12:03,030 --> 00:12:04,710 and it increases our overall cost 296 00:12:04,710 --> 00:12:07,500 to implement an authentication solution. 297 00:12:07,500 --> 00:12:10,200 Fortunately, there is now a valid alternative 298 00:12:10,200 --> 00:12:12,060 to using passwords for authentication, 299 00:12:12,060 --> 00:12:14,700 and this brings us to the world of passkeys. 300 00:12:14,700 --> 00:12:17,100 Passkeys are the next evolutionary step 301 00:12:17,100 --> 00:12:19,080 towards passwordless authentication, 302 00:12:19,080 --> 00:12:20,970 and they can offer us a simpler, 303 00:12:20,970 --> 00:12:23,760 more secure cross-device authentication method, 304 00:12:23,760 --> 00:12:26,820 where users can create and access online accounts 305 00:12:26,820 --> 00:12:29,340 without needing to input a password. 306 00:12:29,340 --> 00:12:32,070 With passkeys, the browser or operating system 307 00:12:32,070 --> 00:12:34,260 prompts users to create a passkey. 308 00:12:34,260 --> 00:12:36,690 Users then simply use their device's lock screen, 309 00:12:36,690 --> 00:12:39,600 like a fingerprint sensor or facial recognition scan, 310 00:12:39,600 --> 00:12:43,020 to secure these passkeys, which eliminates the need to type 311 00:12:43,020 --> 00:12:45,900 or remember anything during the authentication process. 312 00:12:45,900 --> 00:12:48,510 Instead, when the user wants to log in, 313 00:12:48,510 --> 00:12:50,760 they are simply prompted to unlock the device 314 00:12:50,760 --> 00:12:52,590 using their preferred authentication factor, 315 00:12:52,590 --> 00:12:54,210 like a facial scan or a fingerprint, 316 00:12:54,210 --> 00:12:57,000 depending on the type of device being used. 317 00:12:57,000 --> 00:12:59,280 Many websites and apps have already adopted 318 00:12:59,280 --> 00:13:01,830 the use of passkeys, and they are already reporting 319 00:13:01,830 --> 00:13:03,540 that they're seeing multiple benefits, 320 00:13:03,540 --> 00:13:05,495 including increased login success rates, 321 00:13:05,495 --> 00:13:08,310 lower drop-off rates, improved conversion rates, 322 00:13:08,310 --> 00:13:09,840 and reduced costs associated 323 00:13:09,840 --> 00:13:12,750 with separate multifactor authentication solutions. 324 00:13:12,750 --> 00:13:15,000 Passkeys offer more robust protection 325 00:13:15,000 --> 00:13:17,430 against phishing and data breaches as well, 326 00:13:17,430 --> 00:13:19,140 which is important, since these are probably 327 00:13:19,140 --> 00:13:21,150 the two most significant security threats 328 00:13:21,150 --> 00:13:23,700 that passwords fail to mitigate against. 329 00:13:23,700 --> 00:13:26,400 Passkeys utilize public key cryptography, 330 00:13:26,400 --> 00:13:29,130 with the private key securely stored on the user's device 331 00:13:29,130 --> 00:13:31,650 and created using the screen lock functionality 332 00:13:31,650 --> 00:13:34,200 and the user's fingerprint, facial recognition, 333 00:13:34,200 --> 00:13:36,300 PIN or unlock pattern. 334 00:13:36,300 --> 00:13:38,280 The corresponding public key is stored 335 00:13:38,280 --> 00:13:40,050 on the authentication server. 336 00:13:40,050 --> 00:13:42,030 Since there are no secrets on the server, 337 00:13:42,030 --> 00:13:43,470 only the public keys, 338 00:13:43,470 --> 00:13:45,930 these passkeys are not acceptable to compromise 339 00:13:45,930 --> 00:13:48,060 if the server is breached by an attacker. 340 00:13:48,060 --> 00:13:50,250 Also, each passkey is unique 341 00:13:50,250 --> 00:13:53,340 to the service it was created for, so this prevents users 342 00:13:53,340 --> 00:13:55,890 from being misled into using their stored passkeys 343 00:13:55,890 --> 00:13:58,800 on malicious websites or applications. 344 00:13:58,800 --> 00:14:01,440 So remember, multifactor authentication methods 345 00:14:01,440 --> 00:14:03,120 provide a higher level of security 346 00:14:03,120 --> 00:14:05,190 than single-factor authentication methods. 347 00:14:05,190 --> 00:14:06,990 Authentication factors are crucial 348 00:14:06,990 --> 00:14:08,700 in validating a user's identity, 349 00:14:08,700 --> 00:14:12,210 and various methods offer us different layers of security. 350 00:14:12,210 --> 00:14:14,760 Something you know refers to a piece of information 351 00:14:14,760 --> 00:14:17,640 only the user should know, like a password or a PIN. 352 00:14:17,640 --> 00:14:20,580 Something you have involves the physical device 353 00:14:20,580 --> 00:14:21,810 that a user possesses, 354 00:14:21,810 --> 00:14:24,090 such as a smartphone receiving a verification code 355 00:14:24,090 --> 00:14:26,550 or a hardware token like a key fob. 356 00:14:26,550 --> 00:14:29,010 Something you are encompasses biometrics, 357 00:14:29,010 --> 00:14:31,740 which are unique physical characteristics of a user 358 00:14:31,740 --> 00:14:33,240 that are used to verify identity, 359 00:14:33,240 --> 00:14:36,360 including fingerprints or retina scans. 360 00:14:36,360 --> 00:14:39,390 Something you do captures the unique behavior of a user, 361 00:14:39,390 --> 00:14:42,870 like signature dynamics or keystroke patterns. 362 00:14:42,870 --> 00:14:46,410 Lastly, somewhere you are leverages the user's location 363 00:14:46,410 --> 00:14:49,140 as an authentication mechanism to restrict access 364 00:14:49,140 --> 00:14:52,710 to specific services unless the user's geographic location, 365 00:14:52,710 --> 00:14:55,410 often determined through GPS or IP address, 366 00:14:55,410 --> 00:14:57,480 matches the expected area. 367 00:14:57,480 --> 00:15:00,600 Each factor contributes to a holistic approach to security 368 00:15:00,600 --> 00:15:02,400 and ensures that your authentication systems 369 00:15:02,400 --> 00:15:04,770 are robust and multi-dimensional. 370 00:15:04,770 --> 00:15:07,170 Implementing multifactor authentication systems 371 00:15:07,170 --> 00:15:10,320 makes it harder for unauthorized users to attack 372 00:15:10,320 --> 00:15:11,310 or to gain access 373 00:15:11,310 --> 00:15:13,983 to your organization's information systems or data.