How do you currently register for and log into Internet\/online services? Do you use a password that at least meets the complexity requirements, i.e. the golden password rules? Or are you already using the FIDO key? FIDO means \u201cFast IDentity Online\u201d. In other words, fast identification with digital connections for completely passwordless registration on platforms. Identity theft is big business these days, and phishing and data leaks from hacked or badly-administered servers have become sadly all too familiar, as also clearly demonstrated by the recently-published Bitkom study dated November 6, 2019 \u2013 Economic Protection in the Digital World.<\/p>\n
Phishing is the attempt to gain access to data such as log-ins or passwords using fake e-mails, websites or text messages. With this technology, cybercriminals can obtain sensitive information from companies or inject malware into their systems relatively easily.<\/p>\n
The non-commercial FIDO Alliance<\/a> was launched in July 2012 and officially founded in February 2013 to work with many different companies to develop open and royalty-free industry standards for global authentication on the Internet. Under this umbrella, Google, Microsoft, Facebook, Amazon, PayPal, Visa, Mastercard and others are working to establish a web standard for secure, passwordless logins.<\/p>\n A FIDO key is always unique and therefore cannot be copied. If this were not the case, it would represent a security risk. This is also the fundamental idea behind the FIDO Alliance.<\/p>\n A FIDO key can be used instead of a password or additionally as a second factor. Logging in without a password already works with Microsoft.com and associated services such as Outlook.com, Office 365 and OneDrive \u2013 but only if Edge is used. With Google, GitHub, Dropbox, Twitter and BoxCryptor, the FIDO key can be used as a second factor (two-factor authentication at the touch of a button). You are then protected against phishing, etc. but still have to enter your password. You can see how this works on the demo page https:\/\/webauthn.io\/<\/a><\/p>\n FIDO offers the possibility to further increase security as desired \u2013 up to the requirements of high-security environments. Fingerprint or biometric data is only used for actual registration with a service. This data remains strictly local on the security key and proves the identity of the user (user verification). Consequently, the process entails higher costs coupled with reduced comfort. But even at the lowest security level, FIDO security keys are much more convenient and secure than normal passwords could ever be.<\/p>\n The question that then arises, of course, is whether a user can be tracked using a security key, especially if they use the same security key everywhere. Although there is an optional recognition mechanism whereby the server asks the key to provide its serial number, the user must agree to this request in a separate dialog. Secret tracking is therefore impossible. The security key generates a separate key pair for each service, based on the domain of the other party.<\/p>\n If you lose your FIDO key, it’s important that you block access to the accounts associated with it as quickly as possible. This applies even if the built-in virtual keys in Windows and Android are always protected by a second factor. Such as a fingerprint or a PIN \u2013 that prevents them from being used by others. The great thing here is that cybercriminals can no longer get hold of millions of passwords with a Trojan. Or by breaking into a server. Someone has to actually physically steal the FIDO key and then misuse it. However, this isn’t something that appeals to cyber criminals as it’s no longer big business for them. With access limited to individual accounts.<\/p>\n Maybe now is a good time, therefore, to add a FIDO key to your Christmas list and try it out?<\/p>\n To be continued with application examples from industry.<\/p>\nThe wonderful thing about a FIDO key<\/h2>\n
Traces on the net?<\/h2>\n
What to do if a FIDO key is stolen<\/h2>\n
\n