Enterprise Connect Passwordless

Welcome to Intro to Identity.
I'm Jeff.
This is Ben, and today we're gonna be talking about password lists.
Ben, I'm gonna go ahead and take a shot at the definition of password list.
It's a login that does not require or have anything like a password associated with it.
You nailed it.
Awesome.
Well, thank you for joining us, and, uh, is there more?
Yes, there are actually.
It is so password lists, Um, why is it a thing?
I mean, what's going on?
Well, let's start off by talking about passwords, because you can't talk about password Lists without talking about passwords, right?
And passwords are the worst of all worlds.
They are a bad user experience and the majority of hacks.
The majority of security concerns come through the password.
Password channel, whether that be because someone reuses passwords and one of the places where they use the password gets hacked or whether they're easily guessed, Or just if it's a horrible user experience, there is nothing good about password and I have Yet to meet a person who says they like to log in with a username and password.
Yeah, it's perhaps the most universally believed thing in this industry.
That passwords just everywhere they exist, they should be gotten rid of.
Absolutely right.
So why, if that's the case, Then I guess somebody, you know, who's watching this video is gonna say, OK, well then, what are you guys doing about it?
What are vendors in this space doing about it?
Getting rid of passwords?
Yeah, so if passwords are horrible, Why are they still here?
Well, the reality is we haven't had something to replace them with.
And so we needed fundamentally something to Replace them with, and there's been a march That's occurred over the last couple of years.
First of all, most of us have in our pockets these devices that have biometrics on them.
They can authenticate my face.
They can authenticate my finger.
Um, they are something that I have, and they can identify who I am, Right?
And that's password.
That is passwordless.
And so, first of all, we made people comfortable with using these devices to log in because they do it 10-20, 50 times a day to go access their device.
Now if we can leverage that capability to log into other APPs and services, All of a sudden we really can achieve a passwordless world.
How would somebody go about implementing passwordless?
Well, the technology exists today.
And so we often talk about a passwordless Future, but the tech is here.
And so the question is, If the tech is here, why aren't people using it?
There's a variety of different reasons for that.
And, here's how I would recommend people Approach it.
First of all, you have to have the right Identity Platform.
You have to have an Identity Platform that Supports the standards like WebAuth and FIDO that enable password lists.
That's step one.
Step 2 is you have to really understand the end User workflow, understand what could go wrong, and make sure that you have a platform that has Orchestration in order to be able to adjust to those things that could go wrong, Because you're never going to only have the happy path.
Sometimes things are going to go askew, and you need to have the flexibility and power in your Identity Platform to handle it.
So the key thing is, this isn't exclusively a technology problem, But if you have the right platform that has the right technology in it, All those other problems become much more attainable or much more preventable.
Seems like it’s doable, but let’s get into the mechanics of how it’s done exactly.
How is passwordless attained?
Yeah, so fundamentally, you do want to remove the password.
So you don't just want passwordless experience, but you really want the password to Be gone.
And so, in addition to replacing it with Something like your face or your finger, you also need to have a way of presenting that to An application.
And the way we do that is by using what's called a token.
It's basically a cryptographic key that I Present to an application instead of my password.
And so now when I go on my phone and I unlock it with my face, I'm actually unlocking a Key that can then be handed to an Application to use to sign me in, Right?
And you're actually talking about a token.
That's in the logical world, not like an MFA token, right?
So let's talk about the difference between.
Password lists, MFA, and what technologies are out there today that can truly be called password lists.
Sure, so when we talk about MFA, We're talking about multi-factor authentication.
And so let's talk about the three core factors.
The first factor is something you know, and that has traditionally been a password or a PIN.
The second one is something you have, that's a physical token.
Like a UI key or a USB key, or if you recall the SecureID keys, It could also be your phone itself because you have to have your phone on you in some cases to Authenticate.
And finally, there's something you are, That's the things about you, the things like your face or your iris or your voice or your Fingerprint.
And so when you combine any two of those factors, it's 2FA.
When you combine multiple of them, it's MFA.
Now MFA doesn't necessarily mean password list because one of those factors could be a Password a password.
So password list means that that.
Something I know is no longer an option, and I'm using a combination of the other factors in Order to authenticate the user.
And so the key thing is passwordless doesn't mean no authentication.
What it means is it's an authentication without a password and often as a result, More secure, better user experience, absolutely.
And I was gonna ask you about the benefits there, but let's do this.
Why don't you paint a picture.
Of a passwordless world, the kind that many of our customers are experiencing or going down The road of.
Yeah, so in a passwordless world, We have the capability of authenticating to APPs by looking at our phones.
And so you may see this done in-band or out of band.
So you may start on your desktop and go to log in, and then your phone buzzes, and you look at Your phone and then boom, you're in or.
You may be on your phone itself and your Authentication that was done with a username and password is now replaced with just a simple Glance at your phone.
Yeah, exciting world there and it's one that Uses a combination of technologies that we've talked about single sign-on and federation, and Uh, you know, different risk-based AI machine learning.
There's a lot of stuff that can go in there, but it is just within our reach and we have Many customers that are doing it today.
So a passwordless future.
I look forward to being a part of that.
Absolutely, you bet.
Thanks for joining us today, Ben.
This has been intro to Identity Passwordless.