Windows 10: W3C & FIDO Alliance Finalize Web Standard Secure, Passwordless Logins

Brink · Mar 4, 2019

The World Wide Web Consortium (W3C) and the FIDO Alliance today announced the Web Authentication (WebAuthn) specification is now an official web standard. This advancement is a major step forward in making the web more secure— and usable—for users around the world.

W3C's WebAuthn Recommendation, a core component of the FIDO Alliance's FIDO2 set of specifications, is a browser/platform standard for simpler and stronger authentication. It is already supported in Windows 10, Android, and Google Chrome, Mozilla Firefox, Microsoft Edge and Apple Safari (preview) Web browsers. WebAuthn allows users to log into their internet accounts using their preferred device. Web services and apps can — and should—turn on this functionality to give their users the option to log in more easily via biometrics, mobile devices and/or FIDO security keys, and with much higher security over passwords alone.

“Now is the time for web services and businesses to adopt WebAuthn to move beyond vulnerable passwords and help web users improve the security of their online experiences,” said Jeff Jaffe, W3C CEO. “W3C's Recommendation establishes web-wide interoperability guidance, setting consistent expectations for web users and the sites they visit. W3C is working to implement this best practice on its own site.”

A user-friendly solution to password theft, phishing and replay attacks

It's common knowledge that passwords have outlived their efficacy. Not only are stolen, weak or default passwords behind 81 percent of data breaches, they are a drain of time and resources. According to a recent Yubico study, users spend 10.9 hours per year entering and/or resetting passwords, which costs companies an average of $5.2 million annually. While traditional multi-factor authentication (MFA) solutions like SMS one-time codes add another layer of security, they are still vulnerable to phishing attacks, aren’t simple to use and suffer from low opt-in rates.

With FIDO2 and WebAuthn, the global technology community has come together to provide a shared solution to the shared password problem. FIDO2 addresses all of the issues with traditional authentication:

Security: FIDO2 cryptographic login credentials are unique across every website, biometrics or other secrets like passwords never leave the user’s device and are never stored on a server. This security model eliminates the risks of phishing, all forms of password theft and replay attacks.

Convenience: Users log in with convenient methods such as fingerprint readers, cameras, FIDO security keys, or their personal mobile device.

Privacy: Because FIDO keys are unique for each Internet site, they cannot be used to track you across sites.

Scalability: websites can enable FIDO2 via simple API call across all supported browsers and platforms on billions of devices consumers use every day.

“Web Authentication as an official web standard is the pinnacle of many years of industry collaboration to develop a practical solution for stronger authentication on the web,” said Brett McDowell, executive director of the FIDO Alliance. “With this milestone, we're moving into a new era of ubiquitous, hardware-backed FIDO Authentication protection for everyone using the internet.”

Getting started

For services providers and vendors ready to get started with FIDO2 specifications and browser/platform support, the FIDO Alliance has provided testing tools and launched a certification program. Currently, there are many FIDO2 Certified solutions available to support a wide variety of use cases, including FIDO Certified Universal Servers that support FIDO2 and all prior UAF and U2F devices for full backward compatibility with the full range of certified FIDO authenticators.

Visit the FIDO Alliance website for more information on FIDO2, including resources for developers and product vendors interested in taking part in the FIDO Certified program.
Click to expand...

Source: https://www.w3.org/2019/03/pressrele...hn-rec.html.en

:)

Brink · Mar 4, 2019

Introducing Web Authentication in Microsoft Edge

Today, we are happy to introduce support for the Web Authentication specification in Microsoft Edge, enabling better, more secure user experiences and a passwordless experience on the web.

With Web Authentication, Microsoft Edge users can sign in with their face, fingerprint, PIN, or portable FIDO2 devices, leveraging strong public-key credentials instead of passwords.

A web without passwords

Staying secure on the web is more important than ever. We trust web sites to process credit card numbers, save addresses and personal information, and even to handle sensitive records like medical information. All this data is protected by an ancient security model—the password. But passwords are difficult to remember, and are fundamentally insecure—often re-used, and vulnerable to phishing and cracking.

For these reasons, Microsoft has been leading the charge towards a world without passwords, with innovations like Windows Hello biometrics and pioneering work with the FIDO Alliance to create an open standard for passwordless authentication – Web Authentication.

We started this journey in 2016, when we shipped the industry’s first preview implementation of the Web Authentication API in Microsoft Edge. Since then, we have been updating our implementation to as we worked with other vendors and the FIDO alliance to develop the standard. In March, the FIDO Alliance announced that the Web Authentication APIs have reached Candidate Recommendation (CR) status in the W3C, a major milestone for the maturity and interoperability of the specification.

Authenticators in Microsoft Edge

Beginning with build 17723, Microsoft Edge supports the CR version of Web Authentication. Our implementation provides the most complete support for Web Authentication to date, with support for a wider variety of authenticators than other browsers.

Windows Hello allows users to authenticate without a password on any Windows 10 device, using biometrics—face and fingerprint recognition—or a PIN number to sign in to web sites. With Windows Hello face recognition, users can log in to sites that support Web Authentication in seconds, with just a glance.

Users can also use external FIDO2 security keys to authenticate with a removable device and your biometrics or PIN. For websites that are not ready to move to a completely passwordless model, backwards compatibility with FIDO U2F devices can provide a strong second factor in addition to a password.

We’re working with industry partners on lighting up the first passwordless experiences around the web. At RSA 2018, we of how these APIs could be used to approve a payment on the web with your face. Passwordless authentication experiences like this are the foundation of a world without passwords.

M30aZ2cxElo

Getting started

We’re excited to get implementation into the hands of more developers to see what you build. To get started with Web Authentication in Microsoft Edge, check out more information on our implementation in the Web Authentication dev guide, or install Windows Insider Preview build 17723 or higher to try it out for yourself!

– Angelo Liao, Program Manager, Microsoft Edge

– Ibrahim Damlaj, Program Manager, Windows Security
Click to expand...

Source: Introducing Web Authentication in Microsoft Edge - Microsoft Edge Dev Blog

CAPSLOCKSTUCK · Mar 4, 2019

login details sell for just $5.20 on the dark web

A recent report from content marketing agency Fractl has found out just how much your data is worth on the dark web.

For the study, Fractl scoured all the fraud-related listings on the three biggest dark web marketplaces -- Dream, Point and Wall Street Market -- last month, according to MarketWatch.
To do this, they downloaded a Tor client, or a network that grants anonymity to internet browsers, which is required in order to access the dark web.

There, they discovered that Facebook logins are sold for just $5.20 each.

Meanwhile, credentials for other popular services like Gmail, Uber and Grubhub are just as cheap.

Your Gmail username and password is a bargain at just $1, while Uber account logins go for $7 and Grubhub logins sell for $9.

By comparison, the most expensive logins are for PayPal, which can demand up to $247, according to Fractl.

Similarly, a separate study by security research firm Top 10 VPN revealed that your entire online identity can be sold for approximately $1,200.

Top 10 VPN also found that Facebook logins would sell for $5.20 on the dark web.

What's perhaps most concerning is that the firm found that extremely sensitive 'proofs of identity' like passports and selfies or utility bills sell for $62 and $29, respectively.

According to Top 10 VPN, criminals can purchase online banking details for just $160, while all of your financial information can sell for $710.

The firm found that hacked financial details were 'by far' the most commonly listed items, with credit cards being the most valuable.

PayPal accounts were also in high demand, Top 10 VPN noted.

Interestingly, they discovered that other popular listings are often referred to as 'fullz.'
'These bundles of “full” identifying information, sometimes are either packaged with financial details or sold separately,' the firm said.

'We found listings featuring individuals’ name, billing address, mother’s maiden name, social security number, date of birth and other personal data.'

The items that garnered the lowest price tag were online dating logins for sites like Match.com or Plenty of Fish.

Arun B J · Mar 4, 2019

Can't login to new computer w/Windows 10

Hi,

Thank you for your reply.

Are you able to login to Microsoft Account on Web?

Have you installed any language pack?

I suggest you to follow the steps below and check if it helps.

Step 1: I suggest you to select the appropriate language in login screen at the bottom right corner and check if it helps.

Steps 2: Use On-screen keyboard in the login screen to login and check if it helps.

Hope this helps. If the issue remains unresolved, please get back to us and we would be happy to help.

Windows 10: W3C & FIDO Alliance Finalize Web Standard Secure, Passwordless Logins

W3C & FIDO Alliance Finalize Web Standard Secure, Passwordless Logins

W3C & FIDO Alliance Finalize Web Standard Secure, Passwordless Logins

W3C & FIDO Alliance Finalize Web Standard Secure, Passwordless Logins

W3C & FIDO Alliance Finalize Web Standard Secure, Passwordless Logins - Similar Threads - W3C FIDO Alliance

Passwordless?

How to set up passwordless web login in Windows 10

Web security

Standard Security

Security standard hardware

Cannot login after turning on passwordless feature

Final login to Microsoft Store

Wi-Fi Alliance introduces new 802.11ah HaLow standard

Alliance for Wireless Power & Power Matters Alliance Merge