Finally the age of having to remember all your website passwords is over. Well almost
Probably because there is a new protocol in town how exciting I know you guys love to hear about protocols
But it actually is a little bit more interesting than it may sound
So hopefully you'll stick around and you'll get a glimpse of how we may log into websites in the near future like within the next
Couple years tops and maybe even this year starting for some of you guys who are willing to be early adopters
now this new protocol is called WebAuthn sort for web authentication and
It basically is a new method for supporting two-factor authentication
Using physical device keys or biometric devices including those on your phone
Or maybe your laptop has one as well
And I've actually talked about a similar technology in the past called
u2f which basically uses a physical security key that has some
encryption
Going on and set in there where you tap the side of it while it's plugged into the computer and that is enough to prove
That you have that factor of authentication you can't be phished but this is a little bit different because it does kind of support that
Same technology with a security key and biometrics, but it has another trick up its sleeve this new protocol
Which is that it doesn't require
passwords at all
you can use it as your only method of logging in and what's also more important about this protocol is
Unlike u2f which didn't really take hold all over the place
This new one is getting big pushes by like Google Microsoft and is actually being supported in all major browsers
So the next version of Chrome
67 will support it and it actually is already in the 67 beta
there's also the new Firefox 60 the latest public version does support it and
Microsoft edge as well should soon so already it's ahead of the u2f which was already a really good protocol
It just wasn't really supported that much and it does support more features
So this is probably something that we are going to see for sure more adoption from companies
So you may be thinking. Ah, this is just a bunch of theoretical stuff. We're not gonna really see this anytime soon
Are we actually there's already a live demo page called web off an org that you can go to and if you're using Firefox
60 which does support it
You can actually literally use this protocol now I can do it because I have one of those u2f security keys
Which also does support web authn. I know it a lot of the same technology into this so I can use it
But if you don't have one of those you might not be able to but I'll show you the example
right now so you can at least see so when you go to this website and you want to register for this example you literally
Just type in a username and hit register and then in this case
Firefox kind of prompts you to let you know that the site is asking you to register with this encryption
token that you have built into the browser and in that device and then when you press on the
u2f key in this case
It will create the whole key pair do all the stuff in the background and create that login and now you are
Registered for that website and then when you go to login, it's just as easy you type in the username and click
login
It will ask you to tap the thing with your key which is unique you tap it and you're logged in and that's it
No need to type in a password or anything now at this point
There are some hurdles that it will need to overcome before getting
Widespread adoption by users at least and the biggest one being that you need some sort of device that will support that
protocol
so in this case if it's on a desktop
you probably need a key of some kind like a UB key or
One of the basic ones that I have which aren't expensive by the way, and I've recommended in the past for regular two-factor authentication
But that's besides the point, but also it is probably going to be supporting
Fingerprint sensors built right into phones and that's going to be down to the manufacturers obviously
Google is pushing this so Android it's gonna work with Android. No doubt and I'm assuming
Apple isn't gonna want to be behind the times especially if a lot of websites start pushing this and
Apple users start saying wait, why can't I use this on iPhone and then that'll be all it takes they'll implement event
But as you may know a lot of laptops these days have fingerprint sensors built right into the top-4 using log in with Windows
Hello or anything else? So I think we're gonna start to see adoption faster than you may realize
so what about some downsides we can kind of mention those and also some solutions and the first one that I notice is that
If you're using one of those security keys and you just tap the side, well, it doesn't check your fingerprint. Obviously
There's no fingerprint sensor on there. So, theoretically if you just keep that plugged into your computer
Someone you don't really want using your computer like a friend could go and log into all your websites
but maybe if you keep it on a keychain or something and then also what could be supported is maybe
Phones being able to hook up to your computer. So it's by Bluetooth or
Maybe some sort of other device that you carry around all the time
You don't even have to plug it in it
automatically connects to your computer or anything else and that would literally be just as easy as
something that you keep plugged in another obvious issue is what if you lose the key or
You break your phone and have to get a new one
And then those software Keys stored on those old ones are gone
You have to use a unique one and it's not going to be on any new one
And I think obviously we could probably use passwords as a backup and recovery in that case or maybe obviously
email as a
recovery, so you would hopefully still have access to your email address and then you could use that to temporarily log in and register your
Keys again or another option is using a token generator on your phone
Like we do now for two-factor authentication we could use that as like a backup now. You may be thinking wait a minute
That sounds great. There's no password, but that is no longer two-factor authentication anymore
That's just one factor authentication. And yeah, that's true
If you're just using one of the keys where you tap the side that is just one factor of authentication
But if you have a fingerprint sensor added to the mix you like on your phone
Or maybe if they do start implementing these keys with fingerprint sensors built-in
That's basically two methods right off the bat automatically because think about it this way
It's pretty common that there's I think three methods of authentication
Generally, and those are something you know
Like a password something you have like a token generator app or a cryptographic?
Key, and the third one is something you are. So that would be like a fingerprint or an iris scanner
So if you had one of these keys where you have to touch it and have the key physically there
That's something you have as well as the fingerprint sensor built into it. That's also something you are. So it's like
Two-in-one. And the reason that would be important is then even if someone steals the key they have something you are supposed to have
But they can never get what you are
They would have to force you to do it by yourself
So they wouldn't be able to get in because they only have one of those
Factors and at this point you might be thinking well, that sounds great. But is there any actual websites that support this protocol yet?
And the answer is yes kind of the first one is at least Dropbox
They announced pretty recently actually like just within the last month that they do support this web off end web authentication
Protocol now they use it now as a method of two-factor authentication not as a pure login
So you still need to have to use your password?
But like I said, it's a protocol that you can use in several different ways
You can use it as two-factor authentication or in the future
We'll probably see more people using it as their only factor
But the benefit again for using web authentication is that it is going to be supported by more browsers
So now that Dropbox has that literally anyone on any browser can use the key whereas before it would have had to support
U2f which is not all of them
So I really do think we're going to see a lot more
Support very quickly with this whole web authentication and maybe even a push to get rid of passwords
I mean, especially with the whole password breaches the battle's we've been seeing it's happening more and more frequently
You have to assume that a password database is going to be breached and a lot of people do not follow basic password security
but the fact is that a lot of decent number websites at least do support u2f which is for the security keys and
since it's basically the same thing kind of it shouldn't be that difficult for them to just now implement web authentication and
Since it's now going to be supported on basically all browsers
It would be a No Rayner if you already support you to f2 then just add this web authentication
Thing and it'll kind of be like a domino or snowball effect
I think because now there is more support on all browsers more websites that are to use
two-factor authentication will support this and then if more users
therefore use it than web sites that had this not at all will start implementing it because again,
There's more reason to use it
They'll say well at least all users can use it if they want
Even if they don't because all browsers have it, so I'm actually kind of hopeful
I'm thinking really by the end of this year
we might start to see websites that allow you to register with this web authentication method and
definitely websites that will probably allow you to at least log in and then still let you use a password if you want but
also allow this and this will be especially so on mobile I think because typing in passwords is
Really a pain on mobile even more because at least on a desktop, it's a lot easier to use like a auto-filling password manager
It's not super supported as much on phones
So if you literally just have to go to the website login with a fingerprint so much easier
So again, I'm hopeful you guys can let me know what you think. Do you expect to use this?
Are you already using like a security key? We can talk about that down in the comments if you want to keep watching
I'll put some other videos right here
You can just click on those and if you want to subscribe
I make a few new videos every week. So it should be worth it again. I'm looking forward to hearing from you guys
So thanks so much for watching. I'll see you next time. Have a good one