Microsoft has joined the board of directors of the FIDO (“Fast IDentity Online”) Alliance, an industry consortium that is attempting to create a set of protocols to enable consistent, secure, passwordless access to Web-based applications.

Other members include Google, BlackBerry, PayPal, Lenovo, and MasterCard.
The problems with passwords are well-known.

They’re poorly chosen, regularly stolen, and routinely reused across sites, meaning that a compromise of one account can lead to compromises of many others.
FIDO hopes to replace passwords with a system built around public key cryptography. To register with a FIDO site, you won’t enter a password into the site. Instead, hitting register will alert your authentication devices—typically an app on your smartphone—of the attempt to register.

If that attempt is approved (for example, by using a registered fingerprint or entering a PIN), the device will generate a public/private key pair.

The public key will be sent to the online service; the private key will be retained on the authentication device.

Leave a Reply