Ars Technica is reporting that Microsoft has joined the FIDO alliance. The FIDO, Fast IDentity Online, alliance is an industry group that is developing protocols to replace the passwords for access to Web sites. The idea is to use public key cryptography to replace the current password system. The macro view is that you would have a public/private key pair for each site you visit. The site would hold the public key and you would hold the private key. When you log onto a site, they would send you a random message, which you would sign with your private key. The site would check the signature and, if legitimate, sign you on.
Notice how this solves several problems with the current system. The three major problems with passwords are:
- Users choose weak passwords
- Users reuse passwords
- Sites don’t properly hash the stored passwords
The public key cryptography solves the first problem because the user doesn’t choose a password and the keys are secure by construction. The password reuse problem also goes away because the site generates the key pairs so, again, the user doesn’t have an opportunity to do the wrong thing. Finally, even if a bad guy is able to recover the public keys from a site they can’t recover the private keys to gain access to the site. After all, in public key cryptography the public keys are available to anyone through the key servers.
The Ars post has some of the details on how the protocol is envisioned to work. As you’d expect, getting the details right is the hard part. The system has to be easy for users and site operators alike. FIDO’s plans call for submitting the result of their research to a body such as the IETF for standardization.