Microsoft joins the FIDO Alliance With the use of passwords coming under increased scrutiny, Microsoft is taking steps to move beyond them in Windows 10. Its biggest move: Joining the FIDO (Fast Identity Online) Alliance and adding support for the biometrics technology in the upcoming upgrade of the OS, which has been slated to ship this year.“Transitioning away from passwords and to a stronger form of identity is one of the great challenges that we face in online computing, and we believe FIDO authentication, which is the subject of great discussion here at the White House [cybersecurity] summit, is the pathway to success,” said Microsoft’s Dustin Ingalls, in a blog post late last week.With Windows 10, Windows devices and Microsoft-owned and partner SaaS services supported by Azure Active Directory authentication can be accessed via an enterprise-grade two-factor authentication solution — without a password, Ingalls said. Windows 10 will include Active Directory integration for on-premise scenarios and Microsoft Account integration for consumer services like Outlook.com and OneDrive. Ingalls said that Microsoft has contributed design inputs to the FIDO Alliance that will be incorporated into the FIDO 2.0 specification. “This new standard for security devices and browser plug-ins will allow any website or cloud application to interface with a broad variety of existing and future FIDO-enabled devices that the user has for online security,” the FIDO Alliance site states. FIDO specifications cite a password-less experience, with FIDO protocols leveraging public key cryptography and resistance to phishing. The subject of passwords was the focus of a panel discussion at the White House Summit on Cyber Security and Consumer Protection last week at Stanford University, with Lorrie Cranor, a faculty member at Carnegie Mellon University, discussing the university’s research in the area. CMU found obstacles with authentication methodologies, and having users change passwords frequently means passwords get weaker and weaker, she said. Cranor even wore a dress festooned with the 500 most-common passwords, such as “tinkerbell.”CMU also has looked at smartphone biometrics, including facial recognition. “We found a lot of usability problems with face recognition, which basically doesn’t work in the dark,” Cranor said. Related content news Top cybersecurity product news of the week New product and service announcements from Coro, Descope, Genetec, Varonis, Cloudbrink, Databarracks, and Security Journey By CSO staff Dec 07, 2023 22 mins Generative AI Generative AI Machine Learning news analysis Attackers breach US government agencies through ColdFusion flaw Both incidents targeted outdated and unpatched ColdFusion servers and exploited a known vulnerability. By Lucian Constantin Dec 06, 2023 5 mins Advanced Persistent Threats Cyberattacks Vulnerabilities news BSIMM 14 finds rapid growth in automated security technology Embrace of a "shift everywhere" philosophy is driving a demand for automated, event-driven software security testing. By John P. Mello Jr. Dec 06, 2023 4 mins Application Security Network Security news Almost 50% of organizations plan to reduce cybersecurity headcounts: Survey While organizations are realizing the need for knowledgeable teams to address unknown threats, they are also looking to reduce their security headcount and infrastructure spending. By Gagandeep Kaur Dec 06, 2023 4 mins IT Jobs Security Practices Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe