Removing the password.
WHAT IT MEANS
Authenticating without a shared secret the user must remember.
WHAT APPROACHES EXIST
Public key credentials held by a device Links sent to a verified channel Codes sent to a verified channel Biometric unlock of a stored credential
WHAT THE STRONGEST APPROACH IS
Public key credentials bound to the site.
HOW IT WORKS
The device holds a private key and proves possession, without transmitting anything reusable.
WHAT THAT ELIMINATES
Passwords to steal Credentials to reuse elsewhere Phishing, since the proof is site-specific
WHAT SYNCHRONISED CREDENTIALS PROVIDE
Availability across a user's devices.
WHAT THAT TRADES
Some security, for recoverability.
WHAT THE HARD PROBLEM IS
Recovery when every device is lost.
WHY
There is no password to reset.
WHAT TO PROVIDE
A recovery method established in advance, and tested.
WHAT TO AVOID
Recovery that is weaker than the primary method.
WHY
Attackers target the weakest route, always.
WHAT TO PLAN FOR
A transition period supporting both, since not every device and user is ready.
