China’s online giant Alibaba endorses FIDO authentication

Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInEmail this to someonePrint this page

(Editor’s note. A con­sor­tium of 150 com­pa­nies called the FIDO Alliance is push­ing for adop­tion of a new tech­ni­cal spec­i­fi­ca­tion that could be the basis for bio­met­ric sen­sors, and oth­er devices, to begin to wide­ly replace pass­words for access­ing online accounts and ser­vices. FIDO stands for Fast IDen­ti­ty Online. The alliance is led by Pay­Pal, Sam­sung, Leno­vo, Google and Mas­ter­Card. In this guest essay, Ramesh Kesanu­pal­li, founder of Nok Nok Labs, out­lines the sig­nif­i­cance of Aliba­ba recent­ly embrac­ing FIDO.)

 by Ramesh Kesanu­pal­li, Spe­cial to ThirdCertainty

Recent events have made the secu­ri­ty short­com­ings of pass­words painful­ly clear. Not only are pass­words eas­i­ly stolen, phished and guessed, they can also be hard to remem­ber and dif­fi­cult to type on mobile devices. And because peo­ple often use the same pass­word for mul­ti­ple accounts, a sin­gle attack can com­pro­mise sev­er­al sites or applications.

For rough­ly the past two years, the FIDO Alliance has been mak­ing progress on a solu­tion for the long haul. FIDO refers to a new tech­ni­cal spec­i­fi­ca­tion for strong authen­ti­ca­tion that is more secure, pri­vate and eas­i­er-to-use than pass­words. FIDO stan­dards lever­age the unique char­ac­ter­is­tics stored on a secu­ri­ty chip, bio­met­ric sen­sor or hard­ware device to authen­ti­cate the iden­ti­ty of an individual.

Kesanupalli
Kesanu­pal­li

FIDO could pave the way for wider use of a vari­ety of bio­met­ric sys­tems to affirm one’s iden­ti­ty. Last Feb­ru­ary, FIDO con­sor­tium mem­bers Pay­Pal, Sam­sung, Synap­tics, and Nok Nok Labs intro­duced an inno­v­a­tive ser­vice that shows the promise of this new approach. Synap­tics incor­po­rat­ed its FIDO Ready™ bio­met­ric fin­ger­print sen­sors in Samsung’s lat­est line of mobile devices. And Pay­Pal stepped for­ward to became the first com­pa­ny to imple­ment secure pay­ments using FIDO authen­ti­ca­tion with Nok Nok Labs servers. This ser­vice is avail­able to Pay­Pal users on a range of Sam­sung devices, start­ing with the Galaxy S5.

Last week marked anoth­er major advance in FIDO adop­tion. China’s Aliba­ba Group joined the FIDO Alliance, fol­low­ing the pre­vi­ous announce­ment that Ali­pay; an Aliba­ba group com­pa­ny, had launched a pio­neer­ing FIDO authen­ti­ca­tion service.

Ali­pay is one of the world’s largest online mar­kets, and will lever­age Nok Nok Labs’ FIDO Ready solu­tion to deploy secure pay­ments, based on FIDO authen­ti­ca­tion, to 600 mil­lion users.

Aliba­ba rec­og­nizes the oppor­tu­ni­ty to ush­er in the next evo­lu­tion of Inter­net com­merce, mov­ing beyond the inse­cu­ri­ty of pass­words that threat­en to impede the adop­tion of online and mobile platforms.

This is a major mile­stone. It sig­ni­fies Asia’s awak­en­ing to the val­ue of stan­dards-based strong authen­ti­ca­tion, and it is a val­i­da­tion of the crit­i­cal need for FIDO authentication.

The realms requir­ing user authen­ti­ca­tion are rapid­ly expand­ing – from Inter­net to mobile and POS, (Point of Sale) and on to smart build­ings and the Inter­net of Things. FIDO authen­ti­ca­tion is ready for the inter­op­er­a­ble future of authen­ti­ca­tion that must accom­mo­date a ver­i­ta­ble world of user choice and con­text-aware security.

Com­pa­nies pre­pared with FIDO authen­ti­ca­tion are poised to take advan­tage of future authen­ti­ca­tion mech­a­nisms, new devices and oppor­tu­ni­ties with­out under­tak­ing the pain of deploy­ing new authen­ti­ca­tion infrastructure.

Already, two of the world’s fore­most pay­ments providers – Pay­Pal and Ali­pay – are demon­strat­ing how to take advan­tage of vast FIDO capa­bil­i­ties already avail­able in the marketplace.

There are hun­dreds of mil­lions of FIDO Ready user devices and prod­ucts in the mar­ket­place, ., includ­ing face, voice, or fin­ger­print bio­met­rics and hard­ware tokens, all ready to be lever­aged to elim­i­nate the pain and inse­cu­ri­ty of tra­di­tion­al passwords.

It will be fas­ci­nat­ing to see who becomes the next to move beyond pass­words to imple­ment FIDO authentication?

NOTE: The FIDO Alliance will be in Asia for the first time, host­ing sem­i­nars for prospec­tive mem­bers in Seoul, Korea and Tokyo, Japan on Octo­ber 6th and 10th  respectively.

More on emerg­ing best practices

3 steps for fig­ur­ing out if your busi­ness is secure

Encryp­tion rules ease retail­ers’ burden

Track­ing priv­i­leged accounts can thwart hackers

Impen­e­tra­ble encryp­tion locks down Inter­net of Things

 

 

 


Posted in Cybersecurity, Data Security, Guest Essays