Next-Gen Account Security with Christiaan Brand
Easy Prey22 Jan 2025

Next-Gen Account Security with Christiaan Brand

With phishing and password breaches on the rise, passkeys could offer a more secure, user-friendly solution that could reshape how we protect our online identities. Today's guest is Christiaan Brand. Christiaan is the co-founder of Entersekt, a financial services security firm and a key player at Google in their security and identity teams.

A respected voice in cybersecurity, Christian co-chairs the FIDO2 technical working group focusing on standardizing robust online security protocols in advancing the use of passkeys. He has been at the forefront of the shift toward more secure, password-free systems. We'll hear his insights on the challenges and opportunities of implementing passkeys to create safer online environments for users and organizations.

Show Notes:
  • [00:52] - Christiaan is part of the security team for Google accounts. He's been with Google for 9 years. Prior to that he had a startup.
  • [01:30] - He joined the FIDO Alliance around the same time Google joined in 2013. When he joined Google, he was able to continue with the same type of work.
  • [02:35] - Each of the big tech companies represents a portion of the market when it comes to how we interact with the web and apps.
  • [04:06] - He became interested in security when he started thinking about what could go wrong with new technology solutions. He wanted users to be able to access their financial information in a safe and secure way.
  • [05:06] - 2FA began gaining traction with Google in 2011. It coincided with the launch of Google Authenticator. 2FA was also used by a gaming company.
  • [07:54] - Usability is important, that's why having an app that displays the codes was one of the first forays into making the technology more accessible.
  • [08:34] - Passkeys allow us to move beyond passwords, leaving the extra hassle of traditional multi-factor authentication behind.
  • [11:05] - Key fobs were one of the earlier ways to try and bring usability to security. Now the technology is being moved to smartphones.
  • [12:33] - Passkeys are a replacement for a password manager.
  • [13:35] - Passkeys are extremely long and asymmetric in nature. You and the site you're going to both have the passkey.
  • [14:27] - The service will have the public part of the passkey, and you'll have the private part. Even if the public part leaks out, your passkey will still be secure. Passkeys can never be revealed to phishing sites.
  • [15:47] - FIDO brings the second authentication step in. The service also has to identify themselves.
  • [20:04] - Password managers try to balance security and convenience. Logging in or accessing a passkey is a unique challenge for providers.
  • [22:20] - Phone numbers are a way to get users back into their accounts.
  • [25:19] - Single device users have extra challenges.
  • [26:08] - There are pros and cons to external sources of identity.
  • [29:44] - The FIDO website has many certified solutions.
  • [33:21] - To get passkeys into daily users' lives, we need to start using them on daily applications where we log in frequently.
  • [35:49] - Hopefully this passkey solution will stand the test of time.
  • [37:34] - Attacks are beginning to shift to session hijacking.
  • [38:24] - DBSC or device-based session credentials is a new standard parallel to FIDO.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.

Links and Resources:

Avsnitt(321)

Art Heists

Art Heists

The world of art theft looks glamorous in the movies, but the reality is far more complicated. From multi-million dollar forgery schemes to undercover FBI operations recovering stolen national treasur...

29 Apr 37min

The Power of Prediction

The Power of Prediction

We make predictions all the time including about the weather, about traffic, about what someone is going to say next. It feels natural, even rational. But when algorithms start making predictions abou...

22 Apr 39min

Privacy vs Reality

Privacy vs Reality

Online security advice often sounds simple until you actually try to follow it. Between password managers, privacy settings, and data brokers, protecting yourself can start to feel like a full-time jo...

15 Apr 58min

Wired to Trust

Wired to Trust

It's easy to think scams only work when someone misses something obvious. In reality, most of them don't look obvious at the start. They show up as normal situations with just enough friction to notic...

8 Apr 41min

Intimate Partner Fraud

Intimate Partner Fraud

Most scams leave a digital trail. A fake email, a spoofed number, a fraudulent website. You can trace them, report them, sometimes even reverse them. But what happens when the scam has no digital trai...

1 Apr 45min

Identity without Passwords

Identity without Passwords

Every day, employees at hotels, restaurants, and resorts across the country are doing exactly what they were hired to do: being warm, responsive, and eager to help. It's what makes hospitality work. I...

25 Mars 38min

When Cybercrime Gets Personal

When Cybercrime Gets Personal

Most security breaches don't begin with sophisticated code or elaborate technical exploits. They begin with a phone call, a convincing email, or someone at a help desk who just wanted to be helpful. T...

18 Mars 45min

Stopping Phone Scams

Stopping Phone Scams

Phone scams get dismissed as background noise or just annoying interruptions and unknown numbers with robotic voices we learn to ignore. But behind that noise is an industry built on psychology, autom...

11 Mars 45min

Populärt inom Politik & nyheter

aftonbladet-krim
rss-krimstad
p3-krim
svenska-fall
spar
aftonbladet-daily
flashback-forever
politiken
rss-sanning-konsekvens
rss-expressen-dok
motiv
rss-vad-fan-hande
rss-krimreportrarna
blenda-2
ett-rent-noje
grans
kungligt
rss-aftonbladet-krim
svd-ledarredaktionen
rss-frandfors-horna