Protecting medical data with passwordless authentication
summary
KRY/LIVI builds a passwordless system that generates a private key on the phone and stores the public key server-side, using public-key challenge-response for authentication; accounts start as low-trust (phone+email with SMS) and upgrade to patient status after an on Fido identity check, creating a tiered identity model. Multiple devices per user are allowed, revocation is currently handled manually via customer support, system is live six months with no known hijacks and low support volume.
AI-written summary · about
chapters (5)
related talks
22mComplementing Passkeys with Strong Identity Assurance for High-Risk Actions and Account Recovery
05m“You still use the password after all” – Exploring FIDO2 Security Keys in a Small
47mPasswordless Web
14mThe challenges of account recovery
43mPasswordless: a story of risk, protection and excellent UX
21mPasswords are so 1990- 47mPasswordless Web
41mUsing FIDO authentication to defend against account takeover