1Password’s Anna Pobletts on Passkey Technology

hi I'm James Maguire and on today's video we're talking about passwords and password security certainly a subject that is at the very heart of cyber security today and it's also a subject that offers plenty of challenges and pitfalls to provide guidance I'm joined by a major industry expert with me is Anna poblet engineering director at one password and very good to have you with us today thanks James I'm excited to be here so I want to talk about P ke technology I've got some great questions but before we get to that I think it'd be interesting to talk about your career you've had an interesting career you've played a founding role and talk about that a little bit if you would yeah I'd love to so my background is mostly in security especially product Security application security identity things like that and so I've worked in a number of different roles around that but I think one that was really impactful was working in consulting or like pen testing where you kind of find security vulnerabilities you tell your clients about them and help them fix it and really often we would report issues around passwords right that's super common in applications and websites so we would tell them you know you need longer passwords or you need MFA or you need people make people log in more frequently things like that and honestly usually they would just say no like we're not going to change that we accept that risk and the reason for that is because it affects their bottom line like if you think especially about like e-commerce companies or something like that it's it's pretty bad for business if you're making people like struggle to log in and so this was something that my co-founder Cole and I talked about all the time it's kind of frustrating but there also was never really a better option than just suggesting longer passwords or MFA so we were tracking a lot of new technology coming out in this space um in particular something called webo then which is the underlying protocol behind pass keys and we realized that this could be an opportunity to actually like solve the password problem in a way that didn't hurt a business right it could actually help them with conversions or reduce friction rather than just adding more layers on top and so uh we started passage to do exactly that to help businesses do that and then about a year and a half ago passage was acquired by one password um and we've continued to kind of do the same Mission um just as part of one password now that's great or you've been a business founder and a business owner I would imagine that there have been some we wouldn't get too deep into this but I think it's interesting you probably had some challenges just in cases of you know growing the business and all the things that go into that certainly it was um it was my first time as a founder and I learned so much in a very short amount of time um it was a it's a really special experience for sure that's great all right let's talk about uh Pass Key technology you know what exactly is Pass Key technology and what's wrong with simply using good oldfashioned passwords hopefully you'll quickly learn a lot of things are wrong with passwords I'm sure everyone knows no one really likes them them but I think it's just what people are used to right and so I think that is a big burden here so pass keys are essentially a new way to log into Apps and websites that's passwordless so it's meant to be more secure and more userfriendly than passwords when you what it looks and feels like to users is really something like your touch ID your face ID whatever biometric is already built into your device that's what it's going to feel like when you use a pass key to log in um which is great that's really easy that's something we're all familiar with behind the scenes it's using um public key cryptography which has been around for a really long time it's the basis for a lot of other Technologies like SSH and things like that um and so when a user creates an account on a website we're going to create a unique key pair that and the public key is sent to the website and the private key stays on the user's device so the private key never leaves the user's device and it can be used to like cryptographically sign uh challenges that the website can then verify the important thing here is that that private key is totally random securely generated and stays on your device and the website only has the public key so before I go into some security benefits I do want to touch on your sort of like why not passwords right like why don't we just make them better Wonder right exactly and I think we all like don't love passwords but there's no better alternative really until now and so I think the the best way I can frame it is that it really comes down to passwords putting all of the burden on the user to be secure right it is you on you as a user to think up a good password remember a good password not fall for a fishing attack things along those lines the goal with pass Keys is to remove that human error from logging in right we're going to build the security directly into the technology we're going to make it really easy make it something you can't mess up right like people are busy they're tired you just shouldn't have to think about logging into a website that hard and so that is really the motivation behind pass keys um the only other sorry I was going to say you used the word biometric at one point and and so you're saying at the root of this is is a biometric approach yeah so um interestingly like it looks and feels like a biometric to a user but there's actually no none of your biometric data is getting sent to a website or anything like that and I think that's really important to know from a privacy perspective in particular what you're doing is you're using the Biometrics that are built into your device to essentially unlock access to your private key that is stored securely on say your iPhone or something like that right and so you're getting all the benefits of Biometrics which is that it's really easy but you're not like really concerned about the privacy or like security aspects where someone's going to like chop your finger off to use it on something right like that doesn't become quite as as relevant and so from a security perspective we're saying okay there's no secrets stored on the website anymore that could be stolen you know we have these huge data breaches with just like millions of credentials that attack doesn't really exist here uh pasis are resistant to fishing attacks which is another huge swath of really common easy to execute attacks and lastly to anything that's like a credential based attack so brute forcing credential stuffing things like that pass keys are resistant to all of those and so yes there will be attacks against pass keys that come out you know nothing is going to be totally infallible but you're raising the bar so much from this Baseline of really easy to execute across a network style of attacks that exist now against passwords all right so some real advantages what are the challenges with Pas key it seems like with all those advantages they should be everywhere why why aren't they everywhere then I'm hoping they will be soon um but I think it's reasonable that there's a lot of inertia moving away from passwords right like authentication especially for consumers probably hasn't meaningfully changed in like the last 50 years right and so people don't really like passwords but they know them and they understand them and they know exactly how to register for a new website when they see one so I think there's two sides of the challenge one is for consumers Pas keys are new it doesn't necessarily have consistent support or interfaces across different platforms and different websites if you were to go use a password on a couple different websites maybe across different platforms even like on an Android and an iPhone you're probably going to have a kind of different experience experience like you may not even recognize that you're using the same technology in some cases and so the flip side of that challenge is for businesses like this is hard to implement not just from uh like an API perspective because all these platforms are a little bit different but also from a userflow perspective how do you communicate to users how do you tell them this is a pass key and like here's your fallback method and here's how to do it across different devices there's a lot of complexity there and that leads to these inconsistent implement ations that then kind of confuse users and so from both sides we just need to give people like a one clear consistent experience that they can understand is the same technology across all of these different websites well does that mean there are inconsistent experiences because they're different providers what what is causing that lack of uniformity I think some of it is like guidance for websites and businesses on the best ways to guide a user through this experience right like it's not even always like a strictly code thing it's even just like a UI or a design of how am I communicating with my users what do I do if they don't have a pass key then what right like how are we handling all of these edge cases and I think that can lead to a almost sometimes worse user experience if it's not done well you mentioned some of the issues are with the users you think the complexity might be like they need to be educated on that issue for sure I think like one password as an example can play a pretty big role in that as can the major platforms because they just have these huge audiences and you can store your pass Keys you know in your Google account or your iCloud account or your one password account for example and so I think everyone plays a role in educating their user base building trust with their user base as people who can as companies who can hold the pass keys and then there's sort of the website side of you know if you're like your Google account or your Amazon account like can educate you on how to set up a pass key on their particular site and so you kind of it'll have to be a little bit of awareness and education from all these different parties working together because if people want pass keys but websites don't Implement them we're never really going to get anywhere and the same is true in the other direction if every website in the world imple adds pass keys to their website but people don't have good ways to use them through you know Google and apple and one password then we're never really going to get anywhere right I get it all right so let's talk about passage which we know is owned by one password I mean how does it help customers with their security efforts yeah so passage is a product by one password that's aimed at solving the business side of these challenges I've been talking about it's a tool that makes it really easy for businesses to add pass keys to their websites like with the goal mostly of reducing friction at signin um increasing conversions things like that I think the best way to think about is kind of like stripe for pass Keys um so there's two different versions the first is called passage complete this is a a complete authentication and user manage management platform that's fully passwordless so we'll manage your users we'll prioritize Pass Key logins but we'll also support other forms of login like social login or magic links if your users say like aren't really ready for pass keys yet or you need account recovery this is a really easy form of Passage to implement it's literally like two lines of code in your front end and we handle all of the user flows all of the communication with your users all the edge cases the other is Pass key uh passage Flex a really big Trend that I've seen with early adopters especially is that they're not really going all in on pass Keys they'll add pass Keys as an option for users to log in but they'll still keep their passwords and so these apps don't really get the security benefits of pass keys because there's still a password behind the scenes but it allows them to like slowly introduce a new technology and you still get some of the user experience benefits of pass keys while like introducing your users to it so that's great but it can be kind of challenging still and so Flex is our answer to that it's more of an like SDK based tool that lets developers add pass keys on top of what you already have you keep your session management your user models all that stuff and you just add pass keys on top so really a user with a password or the using the pass key technology could get into the site so it's it's more flexible in that sense exactly and so um if you think about like Amazon Home Depot eBay all these sites that have Pass Key support for the most part they all every user on that platform still has a password behind the scenes and so those companies if they say like I want to add an option for pass keys they don't want to like totally overhaul their entire authentication to make that happen authentication is so complicated they just want to be able to like add a button that says like if you want to use pass Keys instead of a password you can and so Flex helps us give people that capability but without them having to like change every all their underlying like authentication infrastructure interesting all right yeah well let's look to the the future of password security what do you see in the months end or years ahead and how can companies get ready for that now yeah I would love to say like you know five to 10 years from now there won't be any passwords I don't know if that's totally true I think there may always be some passwords but I would hope that it's a lot less especially in the consumer application space that there is just so much unbelievable benefit to using something like pass keys and so you this is really the first time we've ever had this tradeoff between like security and user experience where it's actually better for both and so I really think we will see like very widespread adoption of pass keys in particularly for consumers in general My Philosophy is that pass keys are great for solving an individual problem and that's kind of where we are now but we need to solve that problem at scale for it to really become a thing right like they're great for users they're easy they're secure but that doesn't really matter unless websites can actually support pasis and they can do it well and they can do it with confidence and so I think that really comes down to developers I think we know how effective developers are at getting new technology adopted by companies and so I think the future of pasis will rely on can we partner with developers can we support them well can we help them bridge this Gap and so for me I think developers are really at the center of it it it does make a lot of sense I mean developers are amazing in terms of their their influence in the in the community really can they can move things forward absolutely I totally agree um and we've always felt that way like get passage it's been like this is a developer tool like yes it serves businesses but if it's not easy to use what's the point right seems like maybe one of the things get in the way of of past key adoption in the years ahead hard to say is there might be users out there that say oh heck I've got a you know log into my bank account I know my password I don't want some system somewhere to like know my password I'm the only one who's going to know the password so you know it's almost like an anxiety issue I would think for some of the users you run into that I think that's definitely where the awareness comes in right like we talked about Biometrics earlier I think people may do a biometric and assume that that data is like your fingerprint data or something is getting sent to a website even though that's not what's happening right so I think there's a lot of awareness and education that platforms can do in particular to just help people get comfortable with the technology I think once you do it once you're like whoa that was awesome I want to do that everywhere but how do we get people that first exposure and that first experience so they can have that kind of aha moment yeah it makes sense it'll happen because I remember it it was a long time ago people did not want to use their credit card on the internet like go I wouldn't enter my credit card there but of course you know what happened to that feeling that's that's pretty well disappeared so it makes sense the past Keys would evolve over time I think so and I think especially if the industry can can make it easy for people and kind of keep educating them I think we can get there and we can get there fast because the benefits are very real anything else you'd like to add about uh passage or or py technology no this has been great we covered so much in such a short amount of time it was really great chatting and a great thank you and then come back and and talk with us again sometime I'd love to

This transcript was generated automatically from the video's captions and may contain errors.