Lessons learnt in – and outside of – the FIDO Alliance Asia Pacific Summit 2023.

At the recent FIDO Alliance Asia Pacific Summit held in Nha Trang, Vietnam, attendees from around the region celebrated 11 years of developing and promoting authentication standards that help to reduce over-reliance on passwords.

It may come as a surprise to many, but the open standard online identity authentication advocated by the FIDO Alliance (and more recently in collaboration with W3C) took less than 15 years to take the shape it currently has, to become the leading global standard.

Having heard and learnt so much at the event, I felt it behooved me to crystallize and clarify some key issues by seeking out insights from Geoff Schomburgk, Vice President, Asia Pacific & Japan, Yubico.

In addition to Microsoft, Google and Apple, many Identity and Access Management vendors have also enabled this: Ping, Okta, Cisco (Duo), Citrix, eBay, Facebook, to name a few. Support for passwordless or FIDO security keys or passkeys has now been added to all these platforms. 

How secure are passkeys based on FIDO2 standards?

Schomburgk: All too often we see that “complexity reduces security”.  Conversely, to increase security, we need to reduce complexity and make it easy for anyone to login securely. 

Passkeys are based on open industry standards (FIDO) which were designed from the ground up to be highly secure, easy to use and deployable at scale. 

The security built into the standard supports the latest cryptographic constructs available, which makes passkeys phishing-resistant and the most secure form of MFA available today.  In addition, the FIDO standard has been designed to allow adoption of post quantum computing algorithms in the future.

What does the broad move towards passkeys spell for businesses and end-users in Asia Pacific?

Schomburgk: Anyone who requires a simpler, faster and more secure login experience will benefit from passkeys.  That is why governments are upgrading their advice to businesses and consumers alike to encourage and/or enforce adoption of phishing-resistant MFA – i.e. passkeys – as the most secure option we have today.

Whilst the tech industry has clearly embraced support for Passkeys, the adoption by businesses and end users across Asia Pacific will be a gradual change.  Most online services today support some form of two factor or multi-factor authentication.  But we know that moving from legacy MFA such as email, SMS, or authenticator apps takes time.  For businesses this change to passkeys can be enforced for some or all users, depending on the organization’s risk appetite. 

Typically we see businesses requiring secure phishing-resistant passkeys for users with access to sensitive information.  And broader adoption is accelerating for other user groups who see the simpler login experience and increased security as a win-win.

Those businesses that realize the cost savings made when passwords no longer exist (replaced with a simple yet secure technology) will be seen by their peers as industry leaders and others will follow suit.

For consumers, online services allow users to now have different methods of logging in to the service. Industry leaders are already offering Passkeys as an option for users, then progressively this will move to a recommendation, and then ultimately become the default. This will take time and not all providers will get it right, but we will be on the path to solving the password problem.

What are some key hurdles to a passwordless future, and how could they be overcome?

Schomburgk: Simple phishing-resistant authentication has been available since 2014 and over the last few years the remaining big tech vendors have added support for passkeys into their platforms. 

So, it is fair to say that the “supply” side or availability has been addressed by the tech industry.  The challenge really now lies on the “demand” side – one of encouraging user adoption.

And the biggest hurdle to adoption is the belief that a malicious attack won’t happen to me! The result is that organizations are either ignoring the uptick in phishing attacks or simply making their passwords more complex and forcing password change more frequently. As stated earlier, “complexity reduces security”. 

So there is some work to do around broader awareness of passkeys as a better, more secure alternative.  When users start to see that passkeys remove or reduce the “MFA fatigue”, I think we will see a big increase in adoption across businesses and consumers alike.

In your opinion, why and how should industries and organizations in Asia Pacific see a wider adoption of and access to passkey security?

Schomburgk: Industries and organizations in Asia Pacific should see a wider adoption of and access to passkey security because they’re secure! They’re also easy to use and are an affordable option that is scalable within organizations of all sizes – which makes it a cost-effective and secure solution.

What is equally important is that having a strong phishing-resistant MFA option reduces the risks of attacks, which are costly for any organization.

With regards to how we can get organizations to adopt the wider use of passkey security… it comes down to providing a better user experience. Passkeys are easy to use and, as a result, this provides a convenience for the user that helps to remove MFA fatigue.

Organizations may look to implement the use of passkeys by enforcing or making their use part of their compliance. While this may be easier for corporates to implement, the risk is that they may encounter some user resistance. Offering an alternative that makes life easier for the end-user is a more effective means of ensuring sustainable change.