Beyond Identity Offers Free Version of Its Passwordless Technology

https://www.darkreading.com/application-security/startup-offers-free-version-of-its-passwordless-technology-/d/d-id/1339974

by dpelevator • 5 years ago

44 27 5 years ago

darkreading.com

intotheabyss• 5 years ago

There's already a passwordless technology; it's called Ethereum and Metamask. Store your private key on a hardware wallet, and boom, you have a very secure account controlled by the user where no password or login required to interact with applications. It's also free

jtbayly• 5 years ago

Who is giving out free hardware wallets? I'd like one.

CharlesW5• 5 years ago

Point us to anything showing that Metamask supports WebAuthn for this passwordless login use case.

zackify• 5 years ago

Uhhh the free version of passwordless technology is called “webauthn”

CharlesW5• 5 years ago

WebAuthn is a framework. A quick search shows that Beyond Identity uses WebAuthn, FIDO, and other identity management flows and standards.

dandanua2• 5 years ago

Asymmetric cryptography under the tonnes of bullshit marketing.

CharlesW5• 5 years ago

This is the first I've heard of the product, but remind me why building cryptography products and then marketing them is bad?

yjftsjthsd-h• 5 years ago

I don't know that it is bad per se, just pointing out that this is a fairly simple existing technology and not some new thing

ng122• 5 years ago

Bullshit marketing is what CTOs buy. Who cares if the core principles are simple or not, if they're selling a useful service (especially one that can help secure our data) good on them.

ancharm• 5 years ago

I want my private keys stored on my iPhone / Apple Watch, in Secure Enclave memory, with two-factor biometric authentication (FaceID and Fingerprint). No more passwords.

CharlesW5• 5 years ago

I thought this was supported as of Safari 14, but I haven't heard if Google and Firefox intend to support this as well.

https://developer.apple.com/videos/play/wwdc2020/10670/

dheera2• 5 years ago

I don't. I don't want to have to carry a stupid phone around everywhere to get things done. I should only have to move my body between the places I go, and the various 24"+ screens I encounter, mostly at home and the office, should become my UI, and none of that should depend on carrying a stupid 6 inch device.

I like passwords + a YubiKey left permanently plugged into every device.

Shebanator• 5 years ago

That's fine for many applications, but for someone like me who has a Continuous Glucose Monitor having my phone/watch be with me at all times is a fact of life. I look forward to the day when my CGM interfaces directly with my watch so I don't have to carry the phone all the time.

TYPE_FASTER• 5 years ago

Having my watch unlock my MBP, and Touch ID for authenticating and authorizing access to credentials, has been pretty awesome.

kryogen1c• 5 years ago

two-factor biometric authentication (FaceID and Fingerprint)

this is not two factor. that is two of the same factor.

the whole point of the factors is that they are fundamentally different, otherwise we'd just make people use two passwords and obscure feedback about which is wrong or right.

olah_1• 5 years ago

“Passwordless technology” is just giving users their own keys.

How to provide a good onboarding and UX around that process is another story. It requires educating the user to a different mindset.

I advise looking into Argent[1] (Loopring is the same) or BrightID[2] as just a few examples of how this can work well.

If you have no friends for social recovery, Argent provides their own service that links to your email or phone for recovery. So it’s more like a typical account recovery that users are accustomed to today.

Similarly, ZenGo[3] provides just that email/phone recovery service alone but it feels intuitive and safe depending on your threat vector. The cool thing about them is that it also uses facial recognition.

[1] https://www.argent.xyz/

[2] https://www.brightid.org/

[3] https://zengo.com/

holtalanm• 5 years ago

I'm tempted to suggest the linked article be changed to: https://www.beyondidentity.com/blog/why-we-made-passwordless...

the actual blog post from Beyond Identity.

was really frustrated when the first link in the darkreading article just linked out to _another_ darkreading article. Like....wtf?

joncp• 5 years ago

And the original doesn't render unless you let it use js.

motohagiography• 5 years ago

Good of them to do this as if it's useful, we will find out pretty fast. If they have a Vault integration, that would be helpful as well. Solving IAM/IAA problems and designing products are orthogonal concerns, and to me that they're building a product around just managing asymmetric key pairs is a positive note.

An authentication scheme is only ever as secure as its recovery process, so that's going to be where the magic happens.

decentralbanker• 5 years ago

interesting. i wonder if it supports linux? How is this different from Yubikey? We use FIDO keys and HYPR at my office - https://www.hypr.com/

InfoSecPatriot• 5 years ago

We use HYPR as well at our org. Has been a pretty great experience and everyone seems to like it so far

acatsdream• 5 years ago

I think it's useful to keep passwords and to learn new techniques on how to make and remember them. Instead of storing them.

Beyond Identity Offers Free Version of Its Passwordless Technology

Related Stories