BSidesSF 2019 - Securing Online Identities with Simple, Secure, Open Standards (Stina Ehrensvard)

# Overview Stina Ehrensvard, CEO and founder of Yubico, presents the history and impact of WebAuthn, a web standard for passwordless logins approved by the W3C. She frames the problem: hacked online identities represent the single largest internet security issue, yet most authentication methods remain vulnerable to phishing and password compromise.

# Founding Yubico and the Yubikey Ehrensvard recounts founding Yubico twelve years prior with her husband Jacob, a security engineer, to solve password-based authentication weaknesses. After discovering that smart cards provided strong security but were impractical due to driver and software complexity, they invented the Yubikey—a hardware device that identifies itself as a keyboard, requiring no drivers while generating encrypted passcodes. The product gained traction through Steve Gibson's security podcast after a chance encounter at RSA Conference 2008, then notably caught the attention of Google engineers who began internal deployment.

# U2F, FIDO Alliance, and Standards Development Yubico collaborated with Google to develop U2F (Universal Second Factor), a protocol allowing a single security key to authenticate with multiple services without sharing secrets between them. This represented a fundamental shift from centralized single sign-on models to distributed identity architecture. The technology was contributed to the FIDO Alliance, gaining support from Mozilla, Facebook, Microsoft, and other major platforms. Microsoft subsequently combined U2F with FIDO2 concepts, introducing passwordless and multi-factor options (passwords, PINs, biometrics, touch) that evolved into the W3C WebAuthn standard.

# Technical Architecture WebAuthn leverages public key cryptography to prevent phishing and man-in-the-middle attacks. Key technical features include origin boundaries—the key stores the specific URL of each service to prevent redirection attacks—and user presence requirements, necessitating physical contact with the device. The distributed model eliminates centralized identity databases, enhancing privacy and security at scale.

# Real-World Validation Google conducted a two-year study demonstrating zero account takeovers via phishing with U2F, 92% reduction in support costs, and $17 million in savings. Deployment anecdotes include a university system administrator whose dog ate a Yubikey (which survived) and an entrepreneur who pressured his bank to adopt the standard after experiencing better security at tech companies.

# Current and Future State WebAuthn is on track for support across all leading platforms and browsers including Apple. Hardware implementations range from external keys to built-in chips, smartcards, and rings. Ehrensvard draws parallels to Volvo's three-point seatbelt—a simple, open standard that saved millions of lives—arguing that scaled internet security requires simplicity, functionality, and open standards. Yubico provides free open-source servers, technical support, and reference implementations to accelerate adoption across industries and use cases.