Paweł Łukaszuk: Passwordless Web

This talk focuses on the concept of passwordless security and the challenges associated with traditional password usage. The speaker, Pavl, highlights the issues surrounding password creation, user behavior, and the danger of weak or repetitive passwords, citing statistics on how users frequently resort to simple and common passwords. He discusses the risks of password leaks and emphasizes the vulnerabilities in existing password management systems, making a case for transitioning to a more secure authentication model. Pavl introduces passkeys, a modern solution that leverages asymmetric cryptography for seamless and secure user authentication, providing a better user experience while mitigating the risks of phishing and credential theft.

[Music] hi everyone uh my name is Nigel Douglas I'm hosting today's session but we will I'm happy to introduce um pavl he's going to speak about passwordless security I'm going to add that to the stage now so um everyone can see what he's presenting and with that I'm going to let pavl take over um take the stage thank you Nigel so hi everyone Thanks for tuning in

to security and architecture track on Cyber WIS Con Europe I'm pav and I'm here today to share with you my vision of Internet without using passwords before I start a few words about me I live in Poland just 200 kilometers from vus I have been in it for about 15 or 16 years on my daily basis I am a developer and I work on web application mostly

using C and Net stock you may wonder why developer talk about security uh it's about uh I believe that uh every develop ER on this his daily work should have Security in mind I have seen a lot of grim situation lot of terrible code a lot of unsecure code and I'm sure that uh we can do something about it we cannot leave security only Engineers so but

let's go back to this topic to main topic of this talk start with uh what is problem with password because we are using password for many years and they are reason they work reasonably well so what's wrong and well there are plenty of issues first it's how to create strong password how many characters should have strong password eight maybe 10 is 20 enough or maybe go to

30 should we use all the possible characters so uppercase lower case digits special characters or maybe with a long password we can use on the letters what about what about long password with only with letters for instance long phrases part of book on or lyric of a song If it's secure password or not and uh what about non-latin characters because in many countries we have some country

specific uh signs can we use them in password or not well I haven't found one good uh rule how security password should look like and another problem is need to create unique password at first it might seem like a nuisance but over time it begin more and more of a pain and that's why most of us don't do that H there are statistic from Chrome password manager

which says that average user of this manager uh use same most popular password on 20% of pages So 20% of pages or of accounts of this person is secure on with the same password if this password Leck all those pages become vulnerable and what more uh other pages are also secured with non unique password and this is why most people use really simple password and in this

worldcloud you can see password password that appeared in collections made public in 2021 those uh collections were from uh English based websites so as you see the most common password are really simple you have 1 2 3 4 5 6 1 2 3 4 5 6 78 or even nine you had password you have a cubert uh and those a bit less uh common password are also

simple those are mostly name uh name of people name associated to pads uh dictionary phrases Brands pop culture reference and if you see something that looks like complicated password it's usually a phrase that it easy to write on your keyboard like for instance qw RTI this is just a first throw on your keyboard and uh if we create strong password and buy some miracle we remember it

then unfortunately we are expected to change this password frequently if this is not our as users initiative we are forced to do it and wise people say that we should not require uh frequent change password from our users this is what Microsoft say this is what oasp say this is what American National Standard for uh National Institute for standard and Technology all those well-known uh companies and

organization says that you should not enforce frequent change password from your users while idea is good then it ends up really bad because if you force user to change password every 30 on the or every 90 days you should start to create easy password or they simply add one on the end of the password and then during every change simply increment it or if your users are

a bit more concerned about security they will not add only a number or they will add uh name of season or number of year and well it doesn't make your password more secure because if this password leaked then criminals will say see this number at the age or name of season and understand that you need to only to increment it few times and and uh find a

valid password and even as developers do not follow this rule to change password frequently because I know a lot of people who are keep adding just one to their password some of them even brag that they work so long in one company that they have 45 or 90 something at the end of their password but uh before I go further one remark we can force user to

change password uh under some cases and for instance when there are evidence or suspicion that password may be compromised then it's okay to force user to change password but in many cases usually we should keep keep them with passwords another problem is uh how to manage those password because uh remembering things is hard you probably know a lot of people who have their pin code written on

a credit card and pin code is only four digits and password is longer there are a lot of password so those password end up on posted notes which are glued to to uh to table on the wall to your screen or under your and it's hard to find good stats how many password have average P person so I take a look on my accounts and uh it

appears that today I have 193 accounts for personal use and 44 accounts for my professional business use so totally more than 200 passwords and by no mean I'm able to remember it I think I remember maybe 10 or 15 passwords but I use but for most password the only solution is to use password manager and password manager are fine if you use product that is well known

which was product that is uh checked by other developers and organization if you don't use some some really unique uh brand new approach then password managers should be fine but still password managers are far from perfect be why because password manager is is another system you have a desktop application you have a mobile application you have uh some cloud account you have a mechanism to synchronize those

password between your devices and you also have a browser extension which will integrate with your browser and to make it all easy to use and as you see there's a lot of places when something can go wrong and eventually will go wrong for instance two year ago last pass was hacked I'm not sure if uh password leaked I'm sure that the they were they were encrypted but

some of uh nodes or private data stored in this uh manager could be exposed and it's not only case with last pass because a few years ago this is linked to article from 2017 the portal Hacker News examined nine popular managers and found vulnerabilities in every single mentioned password manager of course exploiting that vulnerabilities sometimes really challenging it's not just making an simply HTTP request or or

fedlink with HTTP headers but eventually all password manager is vulnerable to some degree and unfortunately even if we create secure strong unique password and remember it it still might be not safe and this is not our fault as as users because password keep leaking from Services we use and this is mostly due to developer carelessness because some developers still use md5 algorithm to Hash passwords some still

use sha one algorithm uh lot of uh systems I work with didn't use ER Sal to secure the uh in many cases uh during creating new account user were given default password and user were not forced to change those password so those default password it can be used for many years and what is more maybe not funny what is more uh scary this uh default password was

were uh keeped for for all users and they were also written in manual so you just can if you want to if you want to attack some other account you just need to know email because with a with a lot of chance this user will still use this his default password and also uh lot of lot of uh service at websites store their passwords in plain text

few years ago I made an audit on an application when all password well keep in plain text I reported that problem and this is response I got from Chief Architect blah blah blah there is no need to encrypt user password because database and server are secure I leave it without the comment because what what much I can say and even if we Store password in a hashed

manner uh are we sure that password are not lecking on any site channel for instance Facebook few years ago H had an issue when password were St in logs of course in plain text because password were part of HTTP request and uh there were not a lot of password when thinking about the uh scale of Facebook there are about 10 or 20,000 of password but still how

many of developers are sure that their that password are not leaking through logs through some analytics or maybe through backups I think not many of them can be sure and this is why password lick out but uh it not really lick out like doson picture those leaks look more like this those are massive leaks of 100 thousand of even million of passwords uh Forge rock this is

a company which work in identity and access management ER estimated that in 2021 uh more a bit less than two billion of password were exposed two billion of password in just one year and I think we can trust them probably many of you know this website have been P when we can check if our credential was exposed and this is screen from yesterday H as we see

this website contain more than 13 billion of uh credentials for accounts 13 billions is roughly two credentials for every single human being on Earth so it's quite a lot and uh I also was affected by one of Leakes because my credential were were exposed from a Dropbox Dropbox account and what can I do about it pretty much nothing uh it was good that I had uh I

had unique passwords so this didn't uh this didn't make a lot of impact for me but many users still have this uh ER password which are used on many website and of course there are a lot of other problems like for instance fishing and fishing uh now it's uh I think it's one number one security problem most of statistic most of uh reports about attack say that

uh uh attacks start from fishing even those more complicated ones first attackers sent uh email or uh or write a message on some kind of some kind of Communicator then get access to system and only then use those fancy complicated techniques to to escalate their privileges Verizon said that in 2019 one in every 99 emails is was an fishing attempt I'm not sure if this is valid

because I think it was more than one but maybe 80 from those 99 was a simple spam Theo says that 91% of data breaches happen because of fishing semantic also says that uh uh most of targeted attack start with uh spare fishing so spare fishing is a uh fishing but aimed for for specific group users and even if we look at smaller scale this is uh data

from Poland where I live uh third Poland is an most important civilian uh emergency response team in Poland and they uh publish their reports every year and uh in the last report they say that in 2023 more than 51% of all unique incidents ER were were fishing and those 51% when we count them in this was 41,000 of incident 41,000 of fishing attempts and what is more

frightening those 41,000 comparing to previous year uh means that there was a rise of 61% so and uh if you look at uh even more uh old reports we see that the number of fishing attempts of fishing attack still is growing and some of you may say that uh fishing is not a problem because we already covered it we have two Factor Authentication and this this solves

this problem and uh well that's not true um I will show you an example here you see the flow using uh using second Factor authentication we have our user server user ask server to create onetime password and send it using site channel mobile application and then users send both password and this onetime password to the server looks fine but if ER if some malicious actor work uh

on live during our during our session he can simply uh do kind man of the middle attack and simply ask our user to send this onetime password to to this criminal and then criminals use this password and onetime password to the cloud it is a bit more difficult flow but it's still uh possible and it's really common during during attack for instance uh for bank or for

bank accounts or uh e-commerce platform and uh there are also other ideas how to uh how to EXP Loy those uh authentication uh for instance there is something called uh MFA bombing attack if you set a lot of uh lot of uh uh authentication request to user at some point the user will become unkno because his mile phone will be ringing for all the time and for

eventually user will accept those uh request uh this this kind of attack happened for instance uh it was done by lapsus group and which in which attack this group sent a lot of authentication request for one of the Uber employees and then called this employee and say hey we have some problem just accept one of those request and everything will be fine so yber employee accepted request

and criminals have access to to yber infrastructure ructure of course there is one more solution which may secure us before fishing and I'm talking about uh security Keys security Hardware keys but uh they they have their own problems security keys are expensive you need to pay at least 25 for UB Kei and you need two UB so is at least ubikes so 50 and you won't convince

your user to pay 50 for think to improve them security user believe that is our developer job to secure our their accounts and well they're right and even if you use UB keys I'm not sure if you see that on this screen but uh this is not a stock photo this is my collection of UB keys I ended up with six devices and you need to remember

when you put them you need to you need to remember to do backups you need to uh not to confuse your UB keis with some other UB keys and you need to care to not to damage them yes it is possible so there are lot of other problems and uh eventually recap adding additional layers to password but this mechanism is fundamentally broken this is still uh analog

mechanism that we keep using in our digital world and if you think about yourself because I presume if you are here you are it professional do you follow all good practices regarding password do you you use password manager do you use second uh second Factor Authentication multiactor authentication or security key whenever possible I think not by I do not blame you security is hard and for the

from the perspective of uh ordinary user is harder so what we can do about it we as developers since passwords are not the best approach what alternatives we have you can authentic at yourself in three ways buy something you know like password buy something you have like security key or byy something you are Biometrics or you can use combination of those three means and we came to

the point of this talk to the mechanism called pasis you probably heard about it there are a lot of Buzz about this idea last year in this year it's a bit less hot because pasis are not a revolution they are based on well-known technology but the biggest difference is that they offer a much better user experience user experience for end user that will use those pass Keys

If ultimately P GE are just a customer friendly implementation of 52 standard and web authentication uh standard it is uh I once heard that the initial name of pask is what discoverable web authentication slf credential but APLE company decide that well you won't be able to promote technology with such name so they go with pasis and how it works you need to do three things first you

need some device that can handle cryptography that can store data and verify user and this device don't have to be brand new because all protocols like f and situp were known for at least five or six years so I bet you have already such device a unit fairly modern version of operation system so it can be chromos it can be Macos it can be Windows uh it

doesn't fit well but in with Linux but you can still use it I will talk about a bit later and third thing you need is uh up to-date browser and this browser need to be based on Firefox on Chrome or in Chrome or in Safar it doesn't need to be exactly Chrome or Firefox but every uh browser based on this should Works quite fine and uh when

we look at those three requirements I bet you already have set of these uh things uh on on your desk how it look on detail this is compatibility chart this screen was taken yesterday it is a bit misleading because uh Chrome OS and windows are marked as planted but they already support pasis but not in every in every scenario but you can still use this pasis on

device with Chrome OS or Windows even Windows 10 which I will show later on the demo only Linux users are a bit behind you can still use uh uh use pass keys on your computer using Linux but you need to another device which with uh Mac OS on or Android on it I will also cover this a bit later well but how this uh how this uh

all work together answer is simple this is just an asymmetric cryptography also known as the public cryptography H I don't want to dig deep in this uh uh idea of uh cryptography this is not a place for academic speech so let's go to example we will start with few workflows and the first one will be registration new account or on some website we have uh our device

that we will use to authenticate we will have our browser and we will have some server when we want to register your account we'll send send request to server saying hello my name is Jane I want to create new account then web server creates some data some uh storage for this uh account and create challenge challenge is challenge is just array of bite that we will need

to process and then server send to browser name of domain information about user so his ID Challenge and this challenge to sign when we look at code it looks like that we have this challenge this is just an uh array we have information about server RP is abbreviation of uh riant party and information about server is domain which will which will be used to check credential and

there is also a name which will be displayed for user we also have information about user so we have this ID and we have some name that will be displayed and some other configuration things this information was received from a browser and then it is sent to think that will authenticate those uh uh those account this thing can be your mobile phone so all this uh all

this part is on your mobile phone or this thing can be for instance UB key so uh so browser will run on laptop and authentication will be done on UB key so here your browser sent to authenticator all the data that was server and browser also include the name domain from uh from your uh which was uh this name which was um resolved by browser you may

ask why do we need uh uh this domain name two times and answer is simple to avoid fishing attacks I will talk about it a so authenticator will create your would create your credentials with some ID with create private key and this private key will not leave this device we'll save additional information that is domain name and information about user and authenticator ask user to unlock the

device it's required for this authenticator to have some mean to check user so for instance in cell phone you need to unlock your screen in in window you need to use Windows hello uh if you use security key hardware key then there will be a notification on screen of this of of your computer to put your PIN so we need to authenticate not only verify your presence

not only to push button but also uh provide some verification that you are really you it doesn't matter how this verification will look like it can be pin code it can be H Biometrics it can be camera it can be uh uh uh some shape you need to draw on your phone but there must be some way to authenticate our user if this go go uh okay

then authentication sent to our server credential ID to simple know how to access these credentials later public key that was created and just a signature of this challenge so this signature is this challenge encrypted using this private key browser send this data to the server check if if this uh signature can be increased can be decrypted using public key and in in result we got this challenge

if yes then we create a user account we restore credential ID to later known know how to access this user restore public key we remove challenge because challenge is not uh needed later this is only used for one time for every every authentication process so we end up with uh would State like this we have our user data on server with credential ID and public key and

we have the same credential ID on the device but here we have private key and this private key will never leave device and public key alone is not enough to perform our authentication while this may look a bit complicated let's go to demo soorry not a demo but for another process how to log in we start with the end uh uh end uh state of uh previous

uh previous uh previous case so now Ser users want to in user want to authenticate send his username for instance then Server create a challenge send this challenge credential ID from here and domain name to the browser browser send this back and also added name this uh this code in JavaScript would look like that so again we have our CH challenge we have ID of our server

and some data about uh uh about user and about uh uh about setting of authentication now authenticator uh get those data check check if domain name fits check if you know this credential ID if yes then ask user again to unlock the device if device is unlocked then this challenge is uh encrypted using private key and only this signed challenge so signature was sent back to server

and server check if this challenge can be encrypted using public key if yes and if this encrypted challenge is equal to this CH that was sent then everything is fine and user is logged in to prove the that it works I will show a demo uh and this demo will be just a part of screen because as you probably know there are a lot of the lot

demos tend to fail so we will I'll always show screens this is made using his website called pasy org you can go to this website and try this flow on your own uh I want to create a new account so will I will write my my login then I will choose option sign in with pasy and then I got a notification from my phone if you want

to create a new account uh I will choose option to continue then I need to unlock my phone again and boom everything is fine I just created my new account no no thinking about password everything went done on Backstage uh if you want to create our account on a different device when there we need to create another pair of keys if you want to log in again

I just go to web page put my username uh use uh sign in then I got notification hey do you want to use pasy I I unlock my phone and boom I'm I'm already logged in everything works almost seamlessly you just need to unlock your phone and I bet you do this 100 time a day where are those credentials stored if you go to settings of your

phone this is screen from Android device you see in your password manager you can see that we have this credential for p.org website uh if you go to the details you can see the options edit and delete uh I cannot uh do a screenshot of this option but if you try to edit you can just only addit metadata so this data which is shown for user you

cannot change the details you cannot your private uh private uh key and you're not able to retrieve this private key this is uh this is what uh specification said user are not able to extract those uh credentials on their own uh this procedure will look quite similar on your laptop you probably just have this a bit different interface because it depends uh on your operational system uh

but if what if you want to log in on your account but using different device without this uh this key well there are a few options uh there is thing called Crow device authentication I went to the same page using uh Windows computer and uh raldi browser and I want to sign in uh and I have two options I can either use Windows hello or security key

so things that can be connected with our our computer by by cable uh or use additional device like uh phone or tablet or security key if I choose uh security key or UB key I just got notification hey uh put inside your uh connect your UB key and uh authenticate uh so press this button and uh uh fill your PIN code and again you're you're logged in

but uh if you want to log in using your mobile phone then browser will show you this QR code you need to take off your phone scan this code and this this is how it looks on your cell phone you need you you see that there is some kind of weird we weird URL this is how it look when copy pasted from device and what you can

do without it there are two options uh you can copy it which I'll did to show you this code and you can open it in browser when you open it in browser you're asked to turn on your Bluetooth why use Bluetooth also SEC security against fishing uh this cross device authentication Works only if your uh computer and your and your mobile phone can connect via Bluetooth so

there are no there is impossible to send you this uh QR code through internet and use this authentication from some remote fishing Bluetooth uh make sure that both devices are in some proximity just a few meters if those devices can connect then I'm asked if you really want to connect using this Pass Key then you unlock your phone and boom I am now logged in on my

on my PC and what is most interesting credential was not sent from those private key was not sent from uh uh from my phone to my computer my credential are still on my phone only this signed signature was sent to my to my computer so this this signature cannot be sent to to log in again but remember that this computer store your session uh session token or

cookie so you should not authenticate on devices that you're not sure if are safe because your security may be exposed by on a bit different layer and this is how this secure against fishing and uh talking about fishing there are lot of thing that can be done here because uh What uh what can attacker do to to Fisher account those inform those credentials are stoned in the

stored in device and cannot be read from device even if somehow this part even if attacker have access to real server and create malicious server for instance not ak.com but a.com if the attacker know all the data from the real server that's still they cannot uh Force us to do authentication because our authenticator will see that domain say uh read by by browser and those fake domain

sent by sent by attacker do not match so simply changing domain do not do not uh do not expose us to fishing and what about uh using multiple device because I show example of this chrom uh cross device authentication but what if you have uh uh desktop desktop laptop tablet or or mobile phone where there are some uh Solutions if you use uh Apple or Google device

then your passy is stored on your account Google or IPA account and it's secured inside this ecosystem uh in theory it can be it could be sh with Windows ecosystem but uh providers are not willing to make it easier okay so it sound a bit weird because my data need to be put on someone else Cloud which sounds suspicious if you are not really exposing your accounts

to other companies then you can use password manager because at least do eight password managers can work with pasis but if you use password manager then your pass pass are not store in Enclave or TPM are store a in a bit less secure Manner and uh some of those uh password managers can be self-hosted so in case of any problem you own old the infrastructure okay but

there is another problem uh as I mentioned before the password are leaking even from password managers so there's a danger that your credential m C even from password manager then you can still use your UB keys or any other uh security device which support F2 F2 standard but uh those uh you need to check if those device check uh work with this uh with this standard and

there are small issue UB ke can store only 22 pasy on device so if I had more than 200 device then need about 9 to 10 pair of ubikes so about 20 ubis that's a lot but everyone can find approach valid to their uh thread model uh let's go a bit uh faster there are a lot of pages that support you pasy right now you you see

this Pages pasy directory uh now there are 55 pages on this list when I done this talk one more ago there was 20 Pages less so this uh is growing you see companies like Adobe LinkedIn Nvidia on lot of big names what I what I saw as a developer py are mostly described as a perfect solution when it's not so simple to implement because specification has 165

pages there are a lot of uh So-Cal sharp Corners you need sorry uh I think we're short on time left as much is there anything you'd like to just quickly close out on or people can still reach out to you directly okay so so just two last two last two last uh sentences implementing password is um harder than I thought this is not just an imp installing

One packages but it's still not uh not much harder than correct implementing of passwords so you need to know person who know what he's doing and someone who is into security but ultimately is not as hard as I thought that it would be ER last slide I I'm sure that many companies won't introduce pasis because how how often do you uh do change your authentication mechanism but

for now there is I think there are no better solution that can be implemented for ordinary users and if you have some question you can always call me ER call me using my uh my social media as I see that we don't have any questions on the chat or do we have no I don't think we do no session was amazing I'm going to have to close

it out but pavl H for those attending feel free to reach out to him directly and I'm looking forward to hearing more about this in the future okay thank you Nigel and I wish you great conference you too thank you everyone for attending bye for now bye