Passwordless Authentication in the Regulatory MFA Landscape
summary
Regulatory MFA is tightening: PSD2 disqualifies typical device biometrics as an inherence factor because device biometric control rests with manufacturers, though the underlying key binding can qualify as a possession factor, and the UK accepts on‑device biometrics with documented risk mitigations. SMS OTPs remain common but costly and vulnerable (rolling out SMS to millions can cost millions and suffers SS7/social‑engineering attacks). Passkeys show ~96–98% success rates and NIST now treats them as equivalent to two factors, but passkeys synced from cloud weaken the possession signal unless device‑bound metadata or secure credentials prove origin.
AI-written summary · about
chapters (8)
- 0:00Introduction and welcome
- 1:07Speaker introduction and topic overview
- 4:04MFA refresher and current landscape
- 8:20Global regulatory MFA mandates
- 10:25Biometrics in MFA and security benefits
- 14:20Regulatory nuances for Biometrics
- 17:09Future of MFA and Pass Keys
- 20:45Summary and regulatory lobbying
related talks
22mPhising resistant MFA
50mOne Does Not Simply Add MFA
27mSecure Authentication without the Need for Passwords
17mImplementing Multi-factor Authentication
47mThe Psychology of Multi-Factor Authentication
19mAdvanced Authentication Framework
50mA tale of two sides of 2FA
28mAuthentication Digital Financial Services