Adopting Zero Trust: The Illusion of Passwordless

Aug 10, 2023

The podcast discusses the illusion of passwordless technology and how it is not a new concept. It emphasizes the importance of multifactor authentication for successful cybersecurity. The guest, Derek Hanson, shares insights on passwordless concepts, passkeys, and the split between identification and authentication. The podcast also delves into the significance of physical devices and certificates in security practices, explores vulnerabilities of using MFA through smartphones, and highlights the need to move away from SMS OTP for better security.

Ask episode

Chapters

Transcript

Episode notes

Introduction

00:00 • 3min

Introduction to UBECO and the Focus on Passwordless Multi-Factor Authentication

02:33 • 2min

Journey in IT and Identity: Making Sign-Ins Easy and Secure

04:14 • 4min

Physical Devices vs Digital Devices for Zero Trust and Authentication

08:31 • 5min

Offline Authentication and Vulnerabilities of MFA through Smartphones

13:43 • 31min

Moving Away from SMS OTP for Better Security

44:16 • 7min

The illusion of going passwordless with Derek Hanson, Vice President Solutions Architecture and Alliances at Yubico. You can read the show notes here.

True or False: The concept of passwordless is new. False.

This is shocking, we know.

Considering the amount of hype around the concept, it certainly can feel like a new concept since the masses are becoming more familiar with it; however, the message is a bit jumbled.

For ages, we’ve used things like biometrics (fingerprints or iris scans) and even a PIN to access money on a debit card, but more recently, there has been an increase in misrepresentations about how secure passwordless technology is, simply because there is not a password involved. As cybersecurity practitioners, we know that the simple removal of passwords alone won’t prevent a successful phishing attack, which means multifactor authentication needs to play a role in getting us closer to the Zero Trust concept.

Fortunately, we have a guest this week who is well-equipped to help us navigate the ins and outs of passwordless concepts, passkeys, and the split between identification and authentication. Derek Hanson is the Vice President of Solutions Architecture and Alliances at Yubico, who has spent the last 8 years contributing to the shaping of a physical piece of hardware, Yubikeys, designed to improve authentication. Prior to that, he worked at Costco, focusing on identification and IAM. But first, let’s improve your personal security stack…

Giveaway - Yubikeys!

If you already have a Yubikey, you already know there is always an opportunity for one more in your stack. If you’re new to Yubico’s offering, this is the perfect time for you to grab your very own YubiKey 5C NFC and gain phishing-resistant MFA. It even works with most password managers, too.

To enter, we’ve given you a bunch of options on how you can increase your odds of winning one of two keys. You must be based in the US, though.

[**Enter the giveaway here](https://www.rafflecopter.com/rafl/display/c9435e741/?).**

We’ll close the giveaway in about two weeks and announce it in our next episode.