LEARN THINK BLOG REPEAT
Passkeys Across Domains
There’s a plan for passkeys to work across vendors, but we’re not there yet. Here’s how they can work across domains though, and it works today.
In a multi-device passkey world, what can we know about a key?
Attestation, TOFU, and Provenance
These are not edge cases…
Listening to a FIDO UX podcast, wanted to get this down while I’m thinking about it.
Let’s all get [more] familiar with password autofill
We’ll be seeing (and using) a lot more of it with passkeys.
What does CABLE have to do with passkeys?
This is my third post about passkeys, and with all that’s going on it looks like there will be a few more after this.
More about passkeys
Following up on my previous post on FIDO announcements, I have some new info from this morning’s Yubico webinar entitled Passkeys and the future of modern authentication: Q&A with Yubico’s CTO. Here are my takeaways
About the new FIDO announcements…
This March and May brought several new announcements about the expansion of FIDO standards and of passwordless in general. The announcements came from Microsoft, Apple, and Google and followed announcements by Yubico earlier this spring and by Apple last year. It has even generated mainstream news coverage at several venues. So, what exactly was announced?
A bazillion keys
This is my favorite and most interesting “new” problem that is not new 😊.
Consent culture
I feel like maybe we all unknowingly agreed to something in Apple’s Terms of Service
Corinne FIsher (@philanthropygal)
The factors we choose
As most of us know by now, there is always more than one way in: to an app, to a website, to your house.
The principles of good auth
The challenge of auth is the challenge of security in general: our goals are opposite right out of the gate. Let them in, keep them out. At the same time, efficiently, at scale.
Why “auth”?
If you ask me what I focus on in tech, I’ll tend to say “auth”, a subset of identity, which is itself a subset of information security. I define “auth” as the process, technology, and user experience of “getting in” and accessing resources. This includes sign in / authentication, authorization / consent, ongoing session management
Introduction
Introductions are so annoying. Why isn’t the prologue just chapter 1? What is the author trying to prove? The length of their backstory? The depth or complexity of their work? I’m not sure. It seems so self-important. Picture it: Redmond, Washington, 2010. A young identity professional is dealing with the aftermath of the great recession…