Passwords are a terrible way of doing security and they're going
to get you hacked! You should be using something like this instead. Here's why.
Welcome back to The Pro Tech Show. We all use passwords on the internet but we really
shouldn't. Think about it: our password needs to be complicated enough that a computer can't guess it
but simple enough that you can remember it. It's your brain versus a computer, but computers can
do billions of calculations per second and get faster every year. Sadly, my brain doesn't.
That's not even the worst part. Every time you use a password to sign up for something or to
log in you literally give away your key; making them massively vulnerable to theft. Everyone agrees
they're a bad idea but whilst it's easy to get everyone to agree that something is bad
it's really difficult to get everyone to agree on what to use instead - hence why passwords are still
around. To replace passwords you'd need all of the biggest tech companies in the world to agree on
what to replace them with... which is exactly what the FIDO Alliance have done. Just about every tech
company you've heard of is a member and they have defined new ways of authenticating online that do
not require passwords. The solution exists and you can use it today. We're just waiting for the
rest of the internet to catch up so passwords can become a thing of the past. The device I'm
using is called a YubiKey. This is not the only way of doing passwordless authentication; but it
is a convenient, secure, and well-supported one. As well as supporting FIDO's current standard
it supports older attempts at reducing the risk of passwords through multifactor and passwordless
authentication - things you're probably familiar with like smart cards and one-time passcodes. The
fact that this works with all of them makes it really useful because you're not limited to just
websites using FIDO2. Because Yubico have been making these things for quite a while they have a huge
list of compatible services. To be clear, this video is not sponsored and this is not the only device
you can use, but that broad support is the reason I recommend it. Because YubKeys are so popular, if
a website supports strong authentication and is going to write a guide on how to use
it, they're probably going to write one for one of these. I'll link them in the description but
let me show you how it works, first. I've set up Keycloak as a demo using web authentication. The
terminology is a little confusing here but if you see the words "W3C Web Authentication API",
"WebAuthn" or "FIDO2": it means the same thing. Tou might also see U2F or UAF. Those were older FIDO
standards. FIDO1, essentially. Let's log in. I need to have my YubiKey plugged in, and it asks for a PIN.
Then I need to tap the button on the key.
That's it. Easy-peasy and much more secure than a password; but why? One obvious reason is that
you need this physical device to log in. That makes it invulnerable to remote attacks over
the internet, unlike a password that can be guessed at from anywhere. There's much more to it than that,
though. Let's look at what actually happened when I pressed that button. We'll start with how passwords
work so you can see the difference. When you sign up for an account using a password you have to
send a copy of the password to the website. Every time you ask to log in the website asks for your
password and compares it to the one they recorded when you signed up. The password is your key; but
every time you use it, it is exposed on your computer where it could be stolen by malware.
Then it is exposed in transit where it could be stolen by a man in the middle attack or over an
insecure connection. It is also permanently exposed on the website itself, where they keep a copy. When
that website gets hacked (and it really is a "when" rather than an "if") they've got your key. There are
some things that can be done about that last point. Websites shouldn't literally store your
password as-is. Many do, unfortunately, but there are things they can do to make it more difficult
for attackers; like a technique called hashing. Hashing is a mathematical function that takes
information and spits out a fixed-length value. The principles are that every time you calculate
the hash of the same information, the hash will be the same. If the information changes even a
tiny bit, the hash will be completely different. The hash is also not reversible. By that I mean
you cannot take the hash value and work back from it to find the original information. This is useful
for passwords because instead of storing your actual password the website can instead store
the hash of your password. Every time you log in it hashes the password you supply and compares
it to the stored hash. If the hashes match then it knows you provided the correct password. The
advantage of doing it this way is that when the website gets hacked the bad guys steal the hash
of your password, and not the password itself. Unfortunately, this is not perfect; and unless
you've used a really long password the hash can be easily cracked using pre-computed lists called
rainbow tables. The right thing for website to do with the password is to salt, hash, and stretch it;
but we're not going to go into that now, other than to say that many (if not most) of them don't,
and it only addresses one of the places where your password is exposed because you still have
to send your password to the website every single time you log in, anyway. Instead, let's show how this
process compares to the method our YubiKey uses. This relies on something called public key cryptography.
That might sound a little intimidating, but the basics are easy to understand. Cryptography means
"encryption" - taking readable data and scrambling it up so nobody can read it without a special key.
There's a big difference between TV and reality, here. On TV there's always a computer specialist
who has to crack the encryption. You know the scene, right? "How long will it take you to crack
the encryption?" "About an hour." "You've got 30 minutes!" And then of course they manage it just in time.
In the real world world the correct answer to "How long will it take you to crack the encryption?" is
"Millions of years." It's just not happening on unless they messed up and didn't encrypt it properly in the first
place. The type of encryption you're probably familiar with from TV is symmetric encryption.
You encrypt information using a key, and then it's impossible to read without the same key. This is
pretty accurate for a lot of encryption, but public key cryptography works a little differently. It is
asymmetric and uses two different keys. The deal is that information encrypted using one key can
only be decrypted using the opposite key. That's all you need to know for this: two keys and if
you encrypt something using one key, the only way to read it is with the other key. One of these we
call the private key, and the other we call the public key. You're now an encryption expert so
let's show how this actually gets used. When you sign up for an account using web authentication
your YubiKey generates a new public and private key pair, and sends the public key to the website.
The private key stays on the YubiKey. The public key (as the name suggests) is not intended to be a
secret. We're sending a copy to the website to make sure they have a copy. Not because we need them to
keep it safe. If you're watching this video in a web browser and click on the padlock icon at the
top you'll be able to see YouTube's certificate. That certificate contains YouTube's public key.
Public keys are meant to be public knowledge, so when the website gets hacked and our public key
gets stolen... we don't care. Already better than a password! When you ask to log in to the website,
instead of asking for your key the website sends you a bunch of information and asks you to sign
it. That information (amongst other things) includes a random challenge and the address of the website.
The challenge is just some randomly generated information. It doesn't matter what it is and
it's different every time. Now you already know how a digital signature works, because they use hashing
and public key cryptography. It's important to note that the actual signing gets done by the YubiKey,
not your computer. The YubiKey calculates the hash of the data sent by the website. Once it has that
hash it encrypts it using your private key. That encrypted hash is the signature. The YubiKey gives
the signature to your computer to send back to the website. To confirm your identity the website
simply needs to decrypt the signature, which it can do using your public key. If that decryption
works, if they can decrypt it using the public key they have on file for you, then they know it must
have been signed using your private key - proving you're the owner of the correct YubiKey. The website
then compares the encrypted hash value from the signature to the correct hash value for the data
they sent you. Thanks to the randomly generated challenge, if those hashes match then they know
that not only was the signature generated using your YubiKey, but it was generated in response to
this specific login attempt. If someone managed to steal the signature in transit they won't be able
to reuse it because every login attempt will have a different randomly generated challenge in it,
and the hashes of the data wouldn't match. The other information I mentioned that gets sent to
be signed is the address of the website. This prevents man-in-the-middle attacks where you get
tricked into accessing a fake website simply presents the real one through to you and passes on everything
you type into it, while stealing your information at the same time. How does the YubiKey prevent this?
Because when it generates your keys they are tied to the address of the website. If you connect to a
fake website by accident then one of two things is going to happen: either it passes through the data
to be signed as-is in, which case your browser will notice that the website address in the signature
request doesn't match the website you're connected to; or they try to fudge it with their fake scammer
website address, in which case it's not going to match the key in the YubiKey and the signatures will be
different, anyway. In either case, even if you don't notice you've been tricked, either your browser or
your YubiKey will. This is so much more secure than a password. In this setup the private key is the
equivalent to the password, but not only is it a much longer and cryptographically secure key: it
is never directly exposed anywhere. Throughout all of this the key never leaves your YubiKey device.
It's not even visible to your computer! It can't be attacked over the internet. No one can log on
without first plugging our key into their computer. The only thing the website needs to store is a
public key, which doesn't matter if it gets stolen. If a login attempt gets cloned it won't work, and
the identity of the website you're connected to is validated automatically to ensure your YubiKey
only responds to legitimate login requests that have not been tampered with. This is why
these things beat passwords by a wide margin. One thing I didn't quite explain though was that PIN
code. Isn't that kind of like a password? No. That's actually optional, but it's a good idea. If you've
been on this channel before you'll probably have heard me bang on about multifactor authentication.
Essentially, you should make sure you need to prove your identity in more than one way. YubiKeys
are great, but if all you have to do is plug it in then if someone else gets hold of it you're
screwed. Like, if you get mugged then the mugger has access to all of your online accounts. The PIN code
makes the YubiKey's strong authentication, multifactor authentication. You now need a combination of
something you have (the YubiKey) and something you know (the PIN code). If you lose it or someone steals
it they can't use it to log in without also knowing your PIN. The PIN is not as insecure as
a password, though. You might think it would be vulnerable to brute force guessing attempts,
but you'd be wrong. The PIN is handled by your YubiKey, not your computer; and it only lets you have a
certain number of attempts. Now this still sounds like a password, but it is different. Passwords
will typically lock you out for a short time if you guess wrong too many times in a row within a
short space of time. In most cases that password will unlock after a cooldown period, or at least
someone can choose to unlock it, at which point the attack can continue. With the PIN in the YubiKey
you have 8 attempts. It doesn't matter if you use them all up in 10 seconds or 10 years, you've
eight tries. Every time you use one it's gone and the only way to reset the counter is to get the
PIN right. If it reaches zero you permanently lose access to all of your FIDO private keys. There is
no way to unlock it. They're gone. Brute force attacks don't work when you only get 8 tries.
You can't make password lockouts this secure because if your account self-destructed after 8 password
attempts all an attacker would need to do is spam your website with random password attempts
and they could take your entire business down. It works for a YubiKey because you need physical
access to even attempt it. Nobody can spam it over the internet. If you don't want to use a PIN but
still want to be extra secure, Yubico do sell more advanced versions where the button you
press is a fingerprint reader; so you can use biometrics as a second factor instead of a PIN
code. There are a few different models of these with different connectors like USB-A, USB-C, and
Lightning. The one I have supports NFC so I can tap it against my phone instead of plugging it
in. You can find one to suit your devices. I'll try and find a few links and put them below. If you use
any of those it doesn't cost any more, but it does help support the channel. Obviously I think these
are a good option, but before you go clicking on the links and buy one for everyone in your
family or your business... are there any downsides? Yeah, there are; so let's talk about those. Firstly,
the elephant in the room: not every site supports these. Many websites are stuck in the past. I don't
consider this a reason not to use them but ultimately there's a bit of chicken and egg
going on here, where many websites aren't going to implement it until enough people want it. The only
way to progress that is to start using them and give websites a hard time for not supporting it
until they bow to the pressure. By "them" I don't necessarily mean YubiKeys. I mean FIDO2 or web
authentication. Like I said at the start, this is not the only device. In fact in some cases you
can use an Android phone as your FIDO2 authenticator. That's not as well-supported right now, and it does
make me nervous about storing my keys on something that physically fragile; but there are standards
for syncing the key between your phone and your online accounts so you can move it to a new device.
Of course, if you can't get into your account to get your key because you need your key to get into
your account... that will be a problem. There will be ways around this but sometimes simple is good.
It's also good for security. The phone-based method uses Bluetooth to check the device is physically
close to the computer you're logging in with; but because smartphones run full operating
systems with apps, they can themselves be hacked. I'm not saying it's 100% impossible that someone
will eventually find a way to hack a YubiKey, but to my knowledge it hasn't happened yet and it has a tiny
attack service compared to a phone. Of the websites that do support FIDO2 standards, only some of them
have gone full passwordless. Others simply use your YubiKey as a second factor to a password. It's still
more secure than a text message or an app prompt, but obviously some people didn't get the memo
that these aren't supposed to just supplement a password: they're supposed to replace it.
Another thing to think about is what do you do if you lose your YubiKey or it breaks? If this is the
only way into your accounts you'd be in trouble. Yubico's suggestion is to have a backup key.
Every time you register a new account you add both YubiKeys to it. That way if you lose one you have a
backup. That's a fairly sensible suggestion. The way most accounts work by default is by registering
multiple reset methods: like maybe a text message, an email to registered address, or a multifactor
app prompt. The problem with having these enabled is it somewhat undermines the security of your
YubiKey because an attacker could just tell your provider that they've lost the YubiKey, and use a
reset mechanism to target a weaker authentication type like SMS. I look at this like a journey. On day
one you'll be adding your YubiKey as an additional second factor alongside the ones you already have.
That benefits you immediately because there's no way for someone to attack these through
multifactor spamming and they're resistant to man-in-the-middle attacks. Then over time as more
websites adopt full passwordless you can start cutting away weak authentication methods
until maybe you're left with two YubiKey, or a YubiKey and a phone. Going back to that scenario
of "How you recover the key on a new phone if you need the key to get to the key?", this could be your
backup to your phone in case it breaks or runs out of battery. The last challenge you might have
using these (and this is more for businesses than home users) is remote or virtual desktops. These
are designed to be plugged into the device you're using, or at least tapped against them using NFC.
If the device you're sitting at is just acting as a dumb terminal and your real computer is in
a datacenter or the cloud, that poses a problem. That's not to say it won't work, but there are a
lot of variables. Whether your YubiKey will pass through to the remote device correctly depends
on the remote access technology you're using, the application you're connecting to, and the
type of authentication you're using. In some cases it won't work. With other combinations it will. If
this is something that applies to you, if you use virtual desktop infrastructure or remote
desktops, then buy a couple of these and test all of your applications before ordering a few hundred
of them for your staff. I mean, you should do that anyway... but especially do it if you're not actually
plugging it into the real end-user device and there's some kind of remote redirection in play; because
that can cause problems. Those are some of the pros and cons. The more websites adopt full passwordless,
and the more FIDO2 compliant devices we see on the market, the better; because passwords really aren't
good enough, anymore. Let me know in the comments what sort of passwordless methods you're using, and
any tips you have for other people watching the video. Of course not everything can be
passwordless yet so YubiKeys won't cover you in all scenarios. That's why you should watch this
video to learn about other ways you can protect your online accounts from getting hacked. In fact
I made whole series about it so check the video description on that video for links to the rest.