Stina Ehrensvard

Yubico’s Vision for Secure Online Identities

Wired Magazine recently announced that Google is working on a new online authentication protocol as an alternative to legacy username/password login. Yubico and NXP are co-creators of this protocol, designed to be integrated across a wide range of devices, including SIM cards, YubiKey NEOs, or a ring you carry on your finger, and to solve some of the fundamental problems with online identity. And these are problems we need to fix soon. Very soon. Or billions of people, along with the great creation named the Internet, will be in serious trouble.

At this stage we cannot say which route we will choose to ensure mass adoption of this new security protocol. But we can say that Yubico has decided to engage in the project as we believe it could be a game changer.

And this is the vision: 

Imagine that you have one single key and one single password to securely access all your Internet life. 

The key would not be issued, controlled or hosted by a government or a service provider. Instead, you would buy this key at your retail store, such as 7-Eleven or, similar to a gift card or pre-paid phone card.

The key would remain in your own full control, guarding your privacy. And you may even choose to have multiple keys and identities, enabling you to protect your digital identity while remaining anonymous.

From your computer or mobile device, you would be able to instantly, with no required software installed, connect your key to any number of online services. Placed in the USB-port or tapped to your NFC phone/tablet/laptop you would replace all your multiple, long, painful passwords with a simple touch. Combined with a simple PIN or password, you would then securely access your email, bank, healthcare records or any online account.

With built-in support for platforms and browsers, the key would offer superior security, protecting against man-in-the-middle and phishing – but with no drivers or client software needed.

With an open source approach and a clever ecosystem, there would be no fees for service providers, and the costly Certificate Authority model associated with traditional smart cards could be eliminated. But more importantly, there would be no single token or service provider who would control your digital identity or any cryptographic secrets.

Yes, there are a few obstacles to overcome, including aligning influential thought-leaders and global stake holders on the same page. But if enough people want to, it would be possible to create a new, really simple, secure and affordable online identity solution as outlined above.

Bring it out – click – go!

PS. Please find additional comments on this topic in the Future of Authentication FAQ 

22 responses to “Yubico’s Vision for Secure Online Identities”

  1. Chad says:

    What a perfect pairing of companies. Good to see you are currently working with Google to make this a reality.

  2. S. Guy says:

    Awesome! I’ve been waiting for something like this for a while now!

  3. Kurt Marko says:

    I like the vision and hope it, or something similar comes to pass, although there are so many unknowns it’s unclear how open and interoperable it will turn out. Having someone like Google on board is critical however since the big thing holding back 2FA adoption is services that natively support it. LastPass is a great start, but it’s really a stopgap since you’re still falling back on a weak standard; e.g. username/password. Plus mobile support is lacking (only ability to filter based on MACs). I am now convinced (I was originally a skeptic) that NFC is a good mobile interface for devices without USB HID support, however you’ll still need a solution for the 100M+ iOS devices in circulation (not sure how reliable and secure the audio interface really is, perhaps something usine Lightning. )

    I’m glad Yubico is continuing to push the vision.

  4. M. Cramblet says:

    I, too, have been waiting for this. Google/Gmail is the only site that I don’t use my UbiKey in conjunction with LastPass. Sign me up!

  5. Ben Ellis says:

    Would this be similar to LastPass meeting Federated security?

    In the UK, the government scrapped the ID card system as the general public were very against ID cards. My view is that ID cards aren’t much different from what is described here.

    I’m strongly for ID cards and better security, but think there are a lot of cultural barriers as well as technical ones before it would become common enough to scrap passwords.

    I look forward to following these developments and hope for a game changer! Good luck yubico & Google!

  6. Hak Mett says:

    this one is a no brainer, whenever that key is available our company is in. We are planing to switch to google apps and this would be another great benefit when implemented right within the google ecosystem.

  7. James says:

    I agree–NFC is extremely promising and has so much potential. It’s a shame that Apple has dropped the ball with the previous few iOS devices and left out NFC. I’m thinking (hoping) that by the middle of this year, it will be a standard feature on all phones.

    Congrats to Yubico for working with Google, this is very exciting!

  8. Mark says:

    I first heard about Yubico and the Yubikey via “Security Now” when Steve Gibson introduced it to the audience of that podcast. I bought 2 shortly afterward and have been a happy customer ever since.
    I’m looking forward to the whole password nonsense in the corporate and government world to change. This is one area where change is greatly needed.
    Remembering dozens of complex passwords and never getting locked out of resources needed to work and function on networks gets harder every day.
    Yubico FTW

  9. Stina Ehrensvard Stina Ehrensvard says:

    In summary, it can be described as “smart card technology for the mass consumer market”. The current National ID cards initiative offers great security, but suffers from the cost and complexity of client software, smart card readers and CAs. With a new approach, we could remove these barriers and flip the business model; Instead of a having your government or service provider controlling it, you would buy and control your own digital identities. For some identities you may choose to be secure and anonymous. For services requiring a higher level of identity assurance, you would bring your identity token, along with your Passport or driver licence, to a place which would tie your token to your real identity.

  10. Stefano says:

    If I buy a Yubikey NEO now should I be able to use it when the “Google Protocol” is finalised?

  11. Brian says:

    Great idea. Have Yubikey now and love it. Marketing idea. Start lining up deals with movie characters, comic books, etc. I want a green Matrix one

  12. Stina Ehrensvard Stina Ehrensvard says:

    Though the YubiKey NEO is designed to work with the “Google protocol”, the NEOs we sell on our web store today do not currently support this.

  13. Stina Ehrensvard Stina Ehrensvard says:

    Thanks for great marketing ideas! The YubiKey NEO name refers to “new”, but was also inspired by Neo in the Matrix; the hacker hero fighting the bad guys.

  14. Sean OBrien says:

    Passwords aren’t broken that badly, it’s password recovery which is badly broken. The same is true for any 2-factor authentication.

    What happens when I lose my key? How do I securely enter the system to register my new key? Key recovery has the same dangers as password recovery.

  15. Stina Ehrensvard Stina Ehrensvard says:

    Authentication systems that only rely on static information are broken, including legacy username/password login. Agree that there are also many recovery systems with poor security. Later this this year, we will present a high security recovery system for the YubiKey NEO and bigger vision. Stay tuned!

  16. shchang says:

    Nice to hear….Google + Yubico will change the world,can’t wait to own it…Stay Tuned!!!

  17. This is a wonderful idea, although I am sceptical that it will work as beautifully as it sounds. There are to many companies and governments with vested interests in controlling identity and this just sounds to utopian to work without some of these vested interests muscling in. Still though I love the idea and I hope it happens sooner rather than later.

    The downside is I was literally just about to buy a second YubiKey just now, before I read this post. Now I am thinking of holding off until a YubiKey with Google Protocol support is available. Is there any rough timeline on when that will be, are we talking months or years here. Also where else can we read about Google’s proposed protocol, I haven’t found anything about after a quick web search.

  18. Stina Ehrensvard Stina Ehrensvard says:

    Only a decade ago, the leading encyclopedias were all owned by commercial players. When the concept of an open source web-based online encyclopedia was introduced, few people could imagine it would become the most powerful encyclopedia of all time. But it works, because millions of people around the world want it to work. A truly open identity system as outlined in this blog holds similar challenges and potential; If enough people want it to happen, it will happen.

    We cannot say when the YubiKey NEO with “Google protocol” will be available, but for sure not the coming months.

  19. Niall says:

    This is not Identity. This is authentication.

    The concern here is that Google would now be slip streamed in as the sole provider for authentication on the internet, and that can’t be a good thing. As a facilitator for secure authentication to Google services, it’s a worthy goal, and worth pursuing for that reason alone, but Stina’s intro refers to ‘your whole internet life’ which for most people extends to services outside Google.

    With enough critical mass Googs becomes the internet authentication gateway and that means as a data aggregation business they will be able to ( not necessarily will ) track your authentication path across the web. That is of value to them.

    Anyone who’s here from Security Now will know of Steve Gibson’s adage about TNO. This is not that.

    As has been mentioned, getting all service providers to consolidate on one authentication standard has been problematic in the past.

  20. Stina Ehrensvard Stina Ehrensvard says:

    I agree that this is authentication. But I named it “identity vision” as it also includes user identification. I also totally agree with Steve Gibson that a TRUST NO ONE approach is essential. What has been created, successfully proven with real users and explained above is not a solution that Google would own or control. In this open eco-system token providers will be invited to compete with Yubico, and the service providers who supports it will only control the secrets for their service. If your bank supports it and gets hacked, the security is not broken for any of the other service providers.

    And yes, it is not an easy task to align key players to support a new standard. However, from the feedback we have got from many of the leading cloud and financial services, I am absolute convinced that it can happen.

  21. Martijn says:

    First off, I love Yubikey as a concept. However, I find a potential flaw with the idea of buying your key just anywhere.

    Assuming the key would still work with AES in an essentially unchanged version as the current keys… who would keep the secret? Just one company? What would happen if you decide you no longer like that company? Move your secret? Create a new one? How would you invalidate the old secret because you no longer trust the old provider?

    Or would I simply change the secret with some self-service application like now, automatically invalidating old secrets?

  22. Stina Ehrensvard Stina Ehrensvard says:

    With the “Yubico identity vision” and the “Google protocol”, based on public key cryptography (PKI, asymmetric encryption), there will be no single service provider hosting the secrets. Every service provider can be their own identity/authentication provider, and do not need to share token secrets for their users with any other service provider.

    In parallel, Yubico will continue to offer Yubikeys with AES (symmetric encryption) .This is easier to implement, but does not allow token secrets to be securely shared between multiple identity/authentication providers.