Securing Authentication with and within FIDO
summary
Target runs passwordless across 2000+ apps and shows how FIDO breaks only when deployments misconfigure or key material or mappings are altered. Recommendations include using the FIDO Alliance metadata service and attestation to allow/disallow models, enforcing and checking authenticator sign count, signing every DB entry to prevent key substitution attacks, avoiding wildcard subdomain RP IDs, and feeding sign-count and AGUID/UA mismatches into risk engines for step-up or block actions.
AI-written summary · about
chapters (12)
- 0:00Introduction and welcome
- 1:05FIDO recap and architecture
- 2:52FIDO implementation compromises
- 3:58FIDO server attack vectors
- 5:44Subdomain compromise risks
- 7:11Key cloning and sign count
- 8:18Database compromise risks
- 9:44Data integrity measures
- 10:26Anomaly detection beyond FIDO
- 11:51Risk engine enhancements
- 12:32Conclusion and defense in depth
- 13:16Q&A session
related talks
24mAchieving strategic outcomes with FIDO: The phishing-resistant user
23mEnhancing FIDO2 Security for Safety-Critical Applications: Best Practices and Consid...
07mImagine: A world without passwords, it is easy if you try
56mPasskeys 101: Technical Principles of FIDO
23mBorderline: Examining the edge cases of FIDO
43mPasswordless: a story of risk, protection and excellent UX
38mJourney to passwordless
38mBreaking FIDO: Are Exploits in There?