google case study: strong authentication for employees and consumers

A Google Case StudyStrong authentication for employees and consumers

Christiaan Brand, Google

Largest and most secure infrastructure

Proprietary + Confidential

Mobile UI Application

Network

SoftwareHardware

Google Security Stack

Today we tackle authentication


Protect Yourself And Your UsersIt's easier than you think for someone to steal a password

Password Reuse Phishing Interception

Social MediaBANK


123456Most popular password in 2015

Source: SplashData: https://www.teamsid.com/wor

st-passwords-2015/

password2nd most popular password in 2015


76%of account vulnerabilities were due to weak or stolen passwords

43% success rate for a well designed phishing page

goo.gl/YYDM79


SMS UsabilityCoverage Issues, Delay, User Cost

Device UsabilityOne Per Site,

Expensive, Fragile

User ExperienceUsers find it hard

PhishableOTPs are increasingly

phished

$?

Today: The reality of One Time Passwords


Based on FIDO U2F standardSafe: Protects against phishingEasy: Insert and press buttonCompact: One device, many services

Introducing FIDO U2F

Your Password

Security Key

Account Data

Core idea - Standard public key cryptography

● User's device mints new key pair, gives public key to server● Server asks user's device to sign data to verify the user.● One device, many services, "bring your own device" enabled

Based on Asymmetric Cryptography

https://www.google.com

https://www.goggle.com


Password

goggle.com

google.com

Password

https://www.google.com “I promise a user is here”,“the server challenge was: 337423”,“the origin was: google.com”


Password

goggle.com

google.com

Password

“I promise a user is here”,“the server challenge was: 529402”,“the origin was: goggle.com”

Security Supply ChainBuild from the ground upManufacture our own components

Abuse & Spam Used machine learning to solveToday less than 0.001% spam in your Gmail inbox

Google’s Experience

● Enterprise use case○ Mandated for Google employees○ Corporate SSO (Web)○ SSH○ Forms basis of all authentication

● Consumer use case○ Available as opt-in for Google consumers○ Adopted by other relying parties too: Dropbox, Github

Deployment at Google

Time to authenticate

Security Keys are faster to use than OTPs

"If you've been reading your e-mail" takeaway:

Time to authenticate

Second factor support incidents

Security Keys cause fewer support incidents than OTPs

"If you've been reading your e-mail" takeaway:

Second factor support incidents



We’re not quite done


Does this work with a mobile?

How do we deploy this at scale?

What if they lose their key?

But what about other enterprises?


Making progress towards stronger authenticationProductizing FIDO U2F


DemoDemo: Bootstrapping account



How can you get started?


Resources● To use with Google

Enable 2-Step Verification on your accountGo to: https://security.google.com Click: 2-Step VerificationClick on the Security Keys tab

● Also use with GitHub, Dropbox, SalesForce

● And / or play with some code https://github.com/google/u2f-ref-code https://developers.yubico.com/U2F/Libraries/List_of_libraries.html

https://security.google.com

https://github.com/google/u2f-ref-code

https://developers.yubico.com/U2F/Libraries/List_of_libraries.html


Questions?

google case study: strong authentication for employees and consumers

Technology