Is FIDO2 Passwordless Authentication a Hype or for Real?: A Position Paper

Kemal Bicakci; Yusuf Uzunay

doi:10.1109/ISCTURKEY56345.2022.9931832

Is FIDO2 Passwordless Authentication a Hype or for Real? A Position Paper

Kemal Bicakci, Yusuf Uzunay

Bilişim Enstitüsü

Securify Information Tech. and Security Training Consulting Ltd.

Araştırma sonucu: Kitap/Rapor/Konferans Bildirisinde Bölüm › Konferans katkısı › bilirkişi

10 Atıf (Scopus)

Özet

Operating system and browser support that comes with the FIDO2 standard and the biometric user verification options increasingly available on smart phones has excited everyone, especially big tech companies, about the passwordless future. Does a dream come true, are we finally totally getting rid of passwords? In this position paper, we argue that although passwordless authentication may be preferable in certain situations, it will be still not possible to eliminate passwords on the web in the foreseeable future. We defend our position with five main reasons, supported either by the results from the recent literature or by our own technical and business experience. We believe our discussion could also serve as a research agenda comprising promising future work directions on (passwordless) user authentication.

Orijinal dil	İngilizce
Ana bilgisayar yayını başlığı	15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings
Editörler	Ferruh Ozbudak, Seref Sagiroglu, Ali Aydin Selcuk
Yayınlayan	Institute of Electrical and Electronics Engineers Inc.
Sayfalar	68-73
Sayfa sayısı	6
ISBN (Elektronik)	9781665456036
DOI'lar	https://doi.org/10.1109/ISCTURKEY56345.2022.9931832
Yayın durumu	Yayınlandı - 2022
Etkinlik	15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Ankara, Turkey Süre: 19 Eki 2022 → 20 Eki 2022

Yayın serisi

Adı	15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings

???event.eventtypes.event.conference???

???event.eventtypes.event.conference???	15th International Conference on Information Security and Cryptography, ISCTURKEY 2022
Ülke/Bölge	Turkey
Şehir	Ankara
Periyot	19/10/22 → 20/10/22

Bibliyografik not

Publisher Copyright:
© 2022 IEEE.

Finansman

This research is funded by TUBITAK (The Scientific and Technological Research Council of Turkey) under the grants No: 3211046 and No:3200184.

Finansörler	Finansör numarası
Türkiye Bilimsel ve Teknolojik Araştırma Kurumu	3211046

Belgeye Erişim

10.1109/ISCTURKEY56345.2022.9931832

Diğer Dosyalar ve Linkler

Link to publication in Scopus

Alıntı Yap

Bicakci, K., & Uzunay, Y. (2022). Is FIDO2 Passwordless Authentication a Hype or for Real? A Position Paper. In F. Ozbudak, S. Sagiroglu, & A. A. Selcuk (Eds.), 15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings (pp. 68-73). (15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/ISCTURKEY56345.2022.9931832

Bicakci, Kemal ; Uzunay, Yusuf. / Is FIDO2 Passwordless Authentication a Hype or for Real? A Position Paper. 15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings. editör / Ferruh Ozbudak ; Seref Sagiroglu ; Ali Aydin Selcuk. Institute of Electrical and Electronics Engineers Inc., 2022. pp. 68-73 (15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings).

@inproceedings{7cf4134519d74d6aa99cfcdcd124f870,

title = "Is FIDO2 Passwordless Authentication a Hype or for Real?: A Position Paper",

abstract = "Operating system and browser support that comes with the FIDO2 standard and the biometric user verification options increasingly available on smart phones has excited everyone, especially big tech companies, about the passwordless future. Does a dream come true, are we finally totally getting rid of passwords? In this position paper, we argue that although passwordless authentication may be preferable in certain situations, it will be still not possible to eliminate passwords on the web in the foreseeable future. We defend our position with five main reasons, supported either by the results from the recent literature or by our own technical and business experience. We believe our discussion could also serve as a research agenda comprising promising future work directions on (passwordless) user authentication.",

keywords = "authentication, passwords, security, standards, usable security",

author = "Kemal Bicakci and Yusuf Uzunay",

note = "Publisher Copyright: {\textcopyright} 2022 IEEE.; 15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 ; Conference date: 19-10-2022 Through 20-10-2022",

year = "2022",

doi = "10.1109/ISCTURKEY56345.2022.9931832",

language = "English",

series = "15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "68--73",

editor = "Ferruh Ozbudak and Seref Sagiroglu and Selcuk, {Ali Aydin}",

booktitle = "15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings",

address = "United States",

}

Bicakci, K & Uzunay, Y 2022, Is FIDO2 Passwordless Authentication a Hype or for Real? A Position Paper. in F Ozbudak, S Sagiroglu & AA Selcuk (eds), 15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings. 15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings, Institute of Electrical and Electronics Engineers Inc., pp. 68-73, 15th International Conference on Information Security and Cryptography, ISCTURKEY 2022, Ankara, Turkey, 19/10/22. https://doi.org/10.1109/ISCTURKEY56345.2022.9931832

Is FIDO2 Passwordless Authentication a Hype or for Real? A Position Paper. / Bicakci, Kemal; Uzunay, Yusuf.
15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings. ed. / Ferruh Ozbudak; Seref Sagiroglu; Ali Aydin Selcuk. Institute of Electrical and Electronics Engineers Inc., 2022. p. 68-73 (15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings).

Araştırma sonucu: Kitap/Rapor/Konferans Bildirisinde Bölüm › Konferans katkısı › bilirkişi

TY - GEN

T1 - Is FIDO2 Passwordless Authentication a Hype or for Real?

T2 - 15th International Conference on Information Security and Cryptography, ISCTURKEY 2022

AU - Bicakci, Kemal

AU - Uzunay, Yusuf

PY - 2022

Y1 - 2022

N2 - Operating system and browser support that comes with the FIDO2 standard and the biometric user verification options increasingly available on smart phones has excited everyone, especially big tech companies, about the passwordless future. Does a dream come true, are we finally totally getting rid of passwords? In this position paper, we argue that although passwordless authentication may be preferable in certain situations, it will be still not possible to eliminate passwords on the web in the foreseeable future. We defend our position with five main reasons, supported either by the results from the recent literature or by our own technical and business experience. We believe our discussion could also serve as a research agenda comprising promising future work directions on (passwordless) user authentication.

AB - Operating system and browser support that comes with the FIDO2 standard and the biometric user verification options increasingly available on smart phones has excited everyone, especially big tech companies, about the passwordless future. Does a dream come true, are we finally totally getting rid of passwords? In this position paper, we argue that although passwordless authentication may be preferable in certain situations, it will be still not possible to eliminate passwords on the web in the foreseeable future. We defend our position with five main reasons, supported either by the results from the recent literature or by our own technical and business experience. We believe our discussion could also serve as a research agenda comprising promising future work directions on (passwordless) user authentication.

KW - authentication

KW - passwords

KW - security

KW - standards

KW - usable security

UR - http://www.scopus.com/inward/record.url?scp=85142842790&partnerID=8YFLogxK

U2 - 10.1109/ISCTURKEY56345.2022.9931832

DO - 10.1109/ISCTURKEY56345.2022.9931832

M3 - Conference contribution

AN - SCOPUS:85142842790

T3 - 15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings

SP - 68

EP - 73

BT - 15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings

A2 - Ozbudak, Ferruh

A2 - Sagiroglu, Seref

A2 - Selcuk, Ali Aydin

PB - Institute of Electrical and Electronics Engineers Inc.

Y2 - 19 October 2022 through 20 October 2022

ER -

Bicakci K, Uzunay Y. Is FIDO2 Passwordless Authentication a Hype or for Real? A Position Paper. In Ozbudak F, Sagiroglu S, Selcuk AA, editörler, 15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings. Institute of Electrical and Electronics Engineers Inc. 2022. p. 68-73. (15th International Conference on Information Security and Cryptography, ISCTURKEY 2022 - Proceedings). doi: 10.1109/ISCTURKEY56345.2022.9931832