FIDO Promises a Life Without Passwords

How many passwords do you have to keep track of? Answer: Too many! In this video, cybersecurity guru Jeff Crume explains the FIDO standard which eliminates the need for passwords entirely. In addition to creating a passwordless login, FIDO's benefits include resistance to phishing and replay attacks.

[xcoder]

Fido is simply public key authentication, something we have since the early 90s and that everybody could have used but nobody wanted to use within the last 30 years; except for UNIX/Linux SSH users. Also it's not really the end of passwords, as if Fido keys are not encrypted, they can be stolen just like if you write your plain text passwords somewhere. Of course, this limits the amounts of passwords to just one but so does a password manager. Yet a password manager can be used with any device and from anywhere, as it requires no external hardware, no USB port or Bluetooth and also no special software support in the system or the browser.

[randomforest_dev]

How to handle the situation where phone is stolen or lost...? I guess still need email or similar OTP handling mechanism.

[JoseJimeniz]

"Help. I lost my phone. How do I get my passwords?"

[GrandpasPlace]

Ive been doing this for over 10 years with GPG though I never gave it a spiffy name. The difference is that when you register, you add the servers gpg key to your ring. The server encrypts with your pub key and signs with its private key, the client validates the sig with the servers pub key and decrypts with the client private key, then encrypts the challenge with the servers pub key and signs with the clients private key before sending it back to the server.

This way the server validates the user and the user has validated it is the correct server.

[bobanmilisavljevic]

Ive been having fun messaging my kid directly through TCP sockets but this inspires me to make a server that saves user info so we can talk regardless of if we know each other's IP addresses 🤔💡

[GoldenHeartNecklace]

Not even 3 minutes and I'm amazed by this guy's ability to write on a mirror for us to read HOLY CRAP.

[jdubz]

I appreciate the verification part of this process. It wasn't quite solidified in my mind till this video.

[Flankymanga]

Good video describing the basics. I think also explaining OTP and TOTP would be great topics.

[ultrastoat]

Password managers have really solved the "password" problem already. All this causes is headaches when people lose their security key device.

[CreachterZ]

I miss the FidoNet days. Good thing they’re bringing it back!

[JustWastedHoursHere]

I really like the way google handles linking your phone's messaging with the web version: You select "device pairing" from the settings menu on your phone and aim your phone (the camera is activated when pairing) at a large QR code on the screen. Instantly they are linked. No password needed and it's really fast. And since only my phone would work, it's secure as well.

[penrith]

Great explanation. Bonus points for seamlessly writing backwards the whole time!

[UtubeItube]

Can we just appreciate that he wrote everything in mirror image from his perspective on that transparent board 😮

[BenFaded]

I like how the camera's POV is a higher dimensional view. We see the speaker in a 3rdperson, while viewing his POV simultaneously.

[taylorpoole]

Clever filming trick. I bet he’s right handed.

[soulimanemammar]

I think that on top of that, the communication from the server to the client should be encrypted with the private key of the server and the responses from the client should be encrypted with the public key of the server. This way each side proves its identity to the other side

[DanielShamany]

I believe there was an error in the video.

I thought that one would use the receiving party's public key to encrypt the message, and the receiving party use their private key to decrypt the message.

The response to the sender is then encrypted by the sender's public key to be decrypted by the sender using their private key.

The video suggests the opposite, that the encryption occurs with the private key. If that was the case, the encrypted message would be decrypted by anyone holding the public key.

[sherrilltechnology]

This is a great video, I have heard of FIDO but never researched it at all, thanks so much!

[natedavisshow]

Absolutely love this. Going to set this up in my lab.

[AJGamer]

So when the device is compromised. They have access to all the user's accounts. 😅😂🤣