The State of FIDO

The document discusses the FIDO Alliance's efforts to address the challenge of securely onboarding IoT devices. It summarizes that (1) the FIDO Alliance launched a working group to develop specifications for fast, scalable device onboarding and activation, (2) the specifications allow for zero-touch onboarding of a variety devices to multiple clouds and late binding of devices to clouds, and (3) the specifications have been contributed as an open source project under the Linux Foundation's LF Edge to promote further development and adoption.

This document summarizes LINE's deployment of FIDO2 authentication for its LINE Pay service. It discusses how passwords are insecure and the root of many breaches. FIDO2 provides a stronger alternative using public/private key attestation and is designed to be privacy-preserving. LINE joined the FIDO Alliance in 2017 and certified its universal server in 2018. It has implemented FIDO2 authentication flows for iOS using Touch ID/Face ID and for Android. Future plans include expanding FIDO2 to more financial services and LINE applications to encourage password-less authentication.

A detailed look at FIDO Authentication, how FIDO works, FIDO & federation, attestation and meta data, and more.

The document discusses modern authentication and Nok Nok Labs' role in pioneering this area. It notes that Nok Nok Labs invented modern authentication, founded and led the FIDO Alliance, and has deployed authentication solutions for major markets. The document promotes the benefits of leveraging modern authentication, such as improved customer experience, higher retention and satisfaction, and reduced fraud and costs. It argues that authentication, security, and privacy will be vital for society with the rise of cloud services, IoT, and other technologies.

This document discusses how FIDO authentication helps organizations meet the requirements of the General Data Protection Regulation (GDPR). It explains that FIDO uses public key cryptography and stores keys locally, avoiding shared secrets and preventing third parties from accessing data. FIDO also protects against phishing and man-in-the-middle attacks. The document notes that biometric templates are stored only on devices and not transmitted, avoiding the need for impact assessments when used privately. It concludes that FIDO offers a standardized solution that balances convenience and security while meeting privacy-by-design principles.

This document provides instructions for implementing passwordless authentication for a web application using WebAuthn and FIDO2 security keys. It describes setting up a sample Spring Boot web app with traditional username/password authentication and then enhancing it with passwordless authentication. The workshop is split into modules, with this module focusing on implementing the authentication REST endpoints and updating the UI to allow passwordless sign-in. It provides code examples and diagrams to explain how the authentication flow works when a user attempts to sign in using a previously registered security key.

A look at FIDO Authentication within Microsoft's Azure and Active Directory. Passwordless authentication for enterprise is now easy and accessible.

Presented at FIDO Authentication Seminar – Tokyo By: Anthony Nadalin, Chief Security Architect, Microsoft; Co-Chair, FIDO2 Technology Working Group

The document discusses using FIDO authenticators for IoT devices. It presents eWBM's biometric external FIDO authenticator and its security features. Potential applications of FIDO authentication for IoT are then described, including for device authentication over LoRa networks, drone control, and public WiFi access. The use of a BLE FIDO authenticator for personalized smart speaker services is also proposed. The conclusion recommends slimming down the FIDO client for embedded systems and achieving at least Security Level 2 certification for IoT authenticators.

An in-depth look at FIDO as high-assurance strong authentication, including the ecosystem, early adopters and how FIDO works.

The General Data Protection Regulation (GDPR) come into effect earlier this year, ushering in the most significant change to European data protection laws in twenty years. The regulation impacts not only impact firms resident in the European Union (EU), but around the world, as any organization doing business with EU citizens must comply with the regulation. FIDO Alliance standards were created from the outset with a “privacy by design” approach and are a strong fit for GDPR compliance. Crucially, FIDO delivers authentication with no third-party involvement or tracking between accounts and services. And when it comes to biometrics, FIDO standards prevent this information from being stored and matched in servers – it never leaves the user’s device – and FIDO(R) Certified devices do not allow for any biometric data to be captured. This presentation includes: - Key GDPR considerations when deploying strong authentication - Where FIDO Authentication relates to GDPR articles on data protection, consent of data subject and data subject rights - How FIDO can help your organization meet GDPR requirements

Henry Lee, Senior Vice President, Mobile Security Technologies, Samsung Electronics Co., Ltd. / a Board of Directors and Co-Chair of FIDO Korea WG, FIDO Alliance

This document summarizes a presentation given by Anthony Nadalin from Microsoft on FIDO2 and Microsoft implementations. It discusses the FIDO standards including CTAP2 and WebAuthn, and how Microsoft supports these standards in Windows 10, Microsoft Edge, and Microsoft Accounts. It provides an overview of authentication interactions and the different entities involved, such as relying parties, clients, authenticators, and platforms.

The FIDO Alliance has launched of the FIDO Device Onboard (FDO) protocol, a new, open IoT standard that enables devices to simply and securely onboard to cloud and on-premise management platforms. Through this standard, the FIDO Alliance addresses challenges of security, cost and complexity tied to IoT device deployment at scale. FIDO Device Onboard furthers the fundamental vision of the Alliance, which has brought together 250+ of the most influential and innovative companies and government agencies from around the world to address cyber security in order to eliminate data breaches, and enable secure online experiences.

The document discusses how governments are increasingly prioritizing strong authentication and looking to standards like FIDO to provide more secure, usable and privacy-preserving authentication. It notes that the UK and US governments have highlighted FIDO and endorsed its ability to deliver improved security without passwords. The document also discusses how authentication is an area of regulatory focus due to compliance needs around privacy, security and access across domains like digital government, healthcare, payments and financial services. It argues that FIDO specifications address regulatory needs by providing nimble, configurable and cost-effective strong authentication.

This presentation includes details on the FIDO Authentication deployments of NTT DOMOCO and Yahoo! Japan.

This document summarizes case studies of two companies, Intuit and T-Mobile, deploying passwordless authentication using Nok Nok's FIDO solution. Intuit wanted to improve security while providing a seamless customer experience on mobile and web. Their implementation of Nok Nok's FIDO reduced authentication failures from 20-15% to under 1% and cut authentication time by 20%. T-Mobile aimed to reduce password pains and increase confidence in the right user accessing accounts. Their rollout of Nok Nok's FIDO cut password resets by 65% and saw 50% adoption in the first 5 months. Both companies were able to successfully deploy modern, standards-based passwordless authentication improving the customer experience

Andrew Shikiar, Executive Director & CMO of the FIDO Alliance outlines what FIDO has achieved in the last 7 years, how the market is adopting FIDO, and new expanded work areas focusing on identity verification and binding and the Internet of Things.