Windows 10: Passwordless FIDO2 verification on Android for Google Accounts

Brink · Aug 12, 2019

Passwords, combined with Google's automated protections, help secure billions of users around the world. But, new security technologies are surpassing passwords in terms of both strength and convenience. With this in mind, we are happy to announce that you can verify your identity by using your fingerprint or screen lock instead of a password when visiting certain Google services. The feature is available today on Pixel devices and coming to all Android 7+ devices over the next few days.

Simpler authentication experience when viewing your saved password for a website on passwords.google.com

These enhancements are built using the FIDO2 standards, W3C WebAuthn and FIDO CTAP, and are designed to provide simpler and more secure authentication experiences. They are a result of years of collaboration between Google and many other organizations in the FIDO Alliance and the W3C.

An important benefit of using FIDO2 versus interacting with the native fingerprint APIs on Android is that these biometric capabilities are now, for the first time, available on the web, allowing the same credentials be used by both native apps and web services. This means that a user only has to register their fingerprint with a service once and then the fingerprint will work for both the native application and the web service.

Note that your fingerprint is never sent to Google’s servers - it is securely stored on your device, and only a cryptographic proof that you’ve correctly scanned it is sent to Google’s servers. This is a fundamental part of the FIDO2 design.

Here is how it works

Google is using the FIDO2 capability on Android to register a platform-bound FIDO credential. We remember the credential for that specific Android device. Now, when the user visits a compatible service, such as passwords.google.com, we issue a WebAuthn “Get” call, passing in the credentialId that we got when creating the credential. The result is a valid FIDO2 signature.

High-level architecture of using fingerprint or screen lock on Android devices to verify a user’s identity without a password

Please follow the instructions below if you’d like to try it out.

Prerequisites

Phone is running Android 7.0 (Nougat) or later

Your personal Google Account is added to your Android device

Valid screen lock is set up on your Android device

To try it

Open the Chrome app on your Android device

Navigate to https://passwords.google.com

Choose a site to view or manage a saved password

Follow the instructions to confirm that it’s you trying signing in

You can find more detailed instructions here.

For additional security

Remember, Google's automated defenses securely block the overwhelming majority of sign-in attempts even if an attacker has your username or password. Further, you can protect your accounts with two-step verification (2SV), including Titan Security Keys and Android phone’s built-in security key.

Both security keys and local user verification based on biometrics use the FIDO2 standards. However, these two protections address different use cases. Security keys are used for bootstrapping a new device as a second factor as part of 2SV in order to make sure it’s the right owner of the account accessing it. Local user verification based on biometrics comes after bootstrapping a device and can be used for re-authentication during step-up flows to verify the identity of the already signed-in user.

What’s next

This new capability marks another step on our journey to making authentication safer and easier for everyone to use. As we continue to embrace the FIDO2 standard, you will start seeing more places where local alternatives to passwords are accepted as an authentication mechanism for Google and Google Cloud services. Check out this presentation to get an early glimpse of the use cases that we are working to enable next.

[youtube]fsFxbC543n8[/youtube]
Click to expand...

Source: https://security.googleblog.com/2019...r-with_12.html

:)

Brink · Aug 12, 2019

Windows Hello FIDO2 certification gets you closer to passwordless

With the FIDO2 certification of Windows Hello, Microsoft is putting the 800 million people who use Windows 10 one step closer to a world without passwords.

No one likes passwords (except hackers). People don’t like passwords because we have to remember them. As a result, we often create passwords that are easy to guess—which makes them the first target for hackers trying to access your computer or network at work.

Since 2015, Microsoft has been building a path to a secure and passwordless world with Windows Hello, enabling Windows 10 users everywhere to sign in to their devices using biometrics or a PIN and leave the world of passwords behind. Continuing this momentum, Microsoft announced in November of 2018 the ability to use Windows Hello or a FIDO2 security key to securely sign in to your Microsoft account on the web, without a password!

Today, the FIDO Alliance that, with the upcoming release of Windows 10, version 1903, Windows Hello is a FIDO2 Certified authenticator. FIDO2 enables developers to leverage standards-based protocols and devices to provide users easy authentication to online services—in both mobile and desktop environments. Microsoft is a leading member of the FIDO Alliance and is working closely with alliance members to enable passwordless login for websites supporting FIDO2 authentication. Collectively, these standards enable users to more easily and securely login to online services with FIDO2-compliant security keys and Windows Hello.

Every month, more than 800 million people use a Microsoft account to access email, play a game, or access files in the cloud. That’s why, in addition to FIDO2 certification, Windows 10, version 1903 will enable users of the latest version of Mozilla Firefox to log in to their Microsoft account or other FIDO-supporting websites. Chromium-based browsers, including Microsoft Edge on Chromium, will support the same capability soon.

We encourage companies and software developers to adopt a strategy for achieving a passwordless future and start today by supporting password alternatives—such as Windows Hello—for their users. For more details on deploying Windows Hello, see www.aka.ms/whfb.

To support secure authentication on shared Windows 10 PCs, such as those used by Firstline Workers, FIDO2 compliant Microsoft-compatible security keys offer a portable solution that enables users to log in to Windows 10 without a password. Learn more about this scenario by reading Windows Hello and FIDO2 Security Keys enable secure and easy authentication for shared devices.

Finally, Microsoft Authenticator can enable users to authenticate their Microsoft accounts using their mobile phones. Built on secure technology similar to Windows Hello, Microsoft Authenticator packages authentication into a simple app on your mobile device.

Windows Hello, FIDO2 security keys, and the mobile Microsoft Authenticator app are great alternatives to passwords. To truly create a world without passwords; however, we need interoperable solutions that work across all industry platforms and browsers. We will continue to invest in this space and look forward to sharing future updates. In the meantime, if you’re a developer, you can help by supporting FIDO2 authentication in your web services and applications today.
Click to expand...

Source: Windows Hello FIDO2 certification gets you closer to passwordless - Microsoft Tech Community - 534592

Tweet

— Twitter API (@User) View on Twiiter

Brink · Aug 12, 2019

Advancing Windows 10 as a passwordless platform

Passwords can be frustrating, difficult to remember, and easily hacked or stolen. That’s why our vision for Windows is one of a passwordless platform—a world where users don’t have to deal with the pains of a password.

With the release of Windows 10, version 1903, we’re bringing Windows 10 closer to delivering our passwordless user and security promises, with new features that we’re excited for you to try out:

Adding a passwordless phone number Microsoft account to Windows.

Passwordless sign-in to Windows for the first time with the Microsoft Authenticator app.

Windows Hello certified as a FIDO2 authenticator for passwordless sign-in on the web.

Streamlined Windows Hello PIN recovery above the lock screen.

Figure 1. Passwordless Windows Hello sign-in to Windows 10.

Adding a passwordless phone number Microsoft account to Windows

A passwordless phone number Microsoft account is exactly what it sounds like—a Microsoft account that can be created with just your phone number in mobile Office apps like Word, OneNote, or Outlook on your iOS or Android device. It unlocks all the benefits of a Microsoft account, and most importantly, it doesn’t require a password.

Figure 2. Creating a passwordless phone number Microsoft account for Word Mobile on an iOS device.

Now for the first time ever, you can go to Settings and add a passwordless phone number Microsoft account to your device and use the Microsoft Authenticator app, or an SMS code roundtrip, to sign in for the first time—no password needed! This is enabled with an added web sign-in capability on the Windows lock screen. After that, Windows Hello is set up for an end-to-end passwordless experience.

Figure 3. Adding a Microsoft account to Windows through the Settings app.

Passwordless sign-in to Windows for the first time with the Microsoft Authenticator app

In addition to supporting passwordless phone number Microsoft account sign-in, the web sign-in capability can be used with any Microsoft account—even if it’s just a regular email account. You can try it out by adding a Microsoft account to Windows, signing in for the first time with the Microsoft Authenticator app (make sure it’s already set up for your Microsoft account), and setting up Windows Hello face, fingerprint, or PIN for later sign-ins—all without a password!

Figure 4. First time Microsoft account sign-in to Windows with the Microsoft Authenticator app.

Windows Hello certified as a FIDO2 authenticator for passwordless sign-in on the web

In November 2018, we announced the ability to use Windows Hello and FIDO2 compliant Microsoft-compatible security keys for passwordless sign-in on the web with a Microsoft account. Additionally, the FIDO Alliance recently announced that with Windows 10, version 1903, Windows Hello is a FIDO2 certified authenticator.

With this announcement, you can use Windows Hello or FIDO2 compliant Microsoft-compatible security keys for sign-in to the web on Windows 10. This is available on Mozilla Firefox version 66 and above and will soon be supported on Chromium-based browsers, including Microsoft Edge on Chromium, when signing in to a Microsoft account and other websites supporting FIDO authentication.

Figure 5. Using Windows Hello to sign in to a Microsoft account on Firefox.

To learn how to enable FIDO authentication, watch Enabling your application and services to use passwordless authentication and read Windows Hello FIDO2 certification gets you closer to passwordless.

Streamlined Windows Hello PIN recovery above the lock screen

We know that users occasionally forget their Windows Hello PIN, so we wanted to provide our Microsoft account users with a revamped “I forgot my PIN” experience above the Windows lock screen with the same look and feel as signing in on the web. Just like first time sign-in, you can use the Microsoft Authenticator app instead of a password to reset your PIN when signing in.

Figure 6: Streamlined Windows Hello PIN recovery experience above lock.

Let us know what you think

While there’s still a ways to go in our passwordless platform journey, we’re excited for you to try these new features and let us know what you think. Comments, questions, and feedback are all welcome! You can reach out to us at L: [email protected] or by posting in the Windows 10 Feedback Hub app.
Click to expand...

Source: https://www.microsoft.com/security/b...less-platform/

TheMailMan78 · Aug 12, 2019

email account hacked. please help

Also now yahoo offers "Step two verification"
Click to expand...

Then I suggest you use it.

Windows 10: Passwordless FIDO2 verification on Android for Google Accounts

Passwordless FIDO2 verification on Android for Google Accounts

Passwordless FIDO2 verification on Android for Google Accounts

Passwordless FIDO2 verification on Android for Google Accounts

Passwordless FIDO2 verification on Android for Google Accounts - Similar Threads - Passwordless FIDO2 verification

Problem with Passwordless account

Problem with Passwordless account

Passwordless Account with Remote Desktop

Passwordless Account!!!

Passwordless Account!!!

Problems activating passwordless account

FIDO2 BLE Bluetooth Communication problem with Android / iOS

Google strengthening 2-Step Verification for Google account

Windows Hello FIDO2 certification gets you closer to passwordless