DevOps and Passwordless Cybersecurity with 1Password’s Anna Pobletts

This is Textron tv. Hey guys, thanks for the throw. We're here with Anna Blitz, who is head of password lists for one password and we're gonna be talking about, well, the role developers play in along with that DevOps in moving to this brand new future of no passwords that we're all hoping to get to.

And I think it's a journey, but we'll see where we are. Anna, welcome to show. Thanks Mike.

Happy to be here. We've been talking about this and there's a lot of different flavors of it and it's not clear to me that everybody kind of understands what it is we're trying to achieve here. 'cause I think we all agree we don't like username and passwords and we also know that they get hacked, but we're not quite clear.

What do we gotta do to get from where we are and how are developers supposed to make all this happen? Yeah, I think it makes sense to start with like exactly what you said. Where are we hoping to get, right?

I think the biggest problem with passwords, and there are a lot, but I think the pointed one for this conversation is that they leave a lot of the burden on being secure to the users themselves. Right? You as a user have to think up a good password, remember it, not write it down, not fall for a phishing attack.

With passkey, the goal is to remove all of that burden from you as a user, uh, to logging in, right? It should happen automatically. It should be built into the technology.

And so it looks and feels to you like you're just using your touch ID or your windows, hello. But behind the scenes you're getting this really great secure experience with a frictionless, convenient experience of touch id. And so that's where we're trying to get, right?

That's kind of the goal. Now, there are a lot of things that need to happen for that to be a reality, right? Um, passwords have been around for decades, maybe like 50 years, maybe more.

And so we have a long way to go, even just getting normal people more comfortable with a new technology. So I think that's one side of things, right? And then there's the developer side of this where apps and websites have to actually build this technology into their websites in a way that feels easy for users and can build this like really complex technology, uh, in a way that that's easy for developers to build, maintain, um, all that kind of stuff.

And what is the challenge with that? Because we've been as developers working around quote unquote secrets and username and passwords for a while. So what are we asking developers to do exactly to move beyond that?

Yeah. There's a few things I think are challenging about pass keys and one is that you suddenly have this model of a single user will have multiple devices and credentials floating out there with a password. You have one password and that moves between all your devices because it's in your head or it's in your password manager, right?

And so you're authenticating the exact same way no matter where you are in the world or what device you're on with pasky, that changes. And it's really dependent on what device you're on, um, where you're storing your pass keys. If it's in say your Google account or your one password account or maybe on a hardware key like UB key, that can change the experience a lot that you're having on the website.

And so there's just a lot more like edge cases and user flows you have to think about, right? Like, yes, you have to use the APIs and developers are smart and they can do all of that. It's also the like designing a good user flow and like what does that look like?

And there's just not a lot of information out there right now on that. And that's something that like us at One Password and Passage have been thinking about that the Fido Alliance has been thinking a lot about like helping, uh, companies and developers like design a really good intuitive user flow based on all the years of research that we've been doing. And that sounds like the trick because a lot of times users will complain when you change anything and then they'll complain when you don't change anything because their username and passwords have been stolen.

So, um, how does the developer figure out what is the most natural workflow for shifting to that kind of passkey model? Uh, is it trial and error? Are there best practices you can point to classes?

How do we get there? Yeah, there's a little bit of everything. Um, and something I think has been getting a lot better over the last couple months.

I think early on, maybe like a year ago when we last talked, a lot of the guidance was really around here's Passkey 1 0 1, right? Here's what a passkey is, here's how to use it. It wasn't really the nitty gritty of like, here are problems your users might encounter when they go to use a pass key.

And like, what do you do in that case? Like what if they don't have a pass key? Um, now we're really shifting to a lot of the guidance and the tooling and the technology is more around giving these like completed user flows and giving companies and developers more like flexibility in how they, they offer passkey.

One thing that I've really noticed in the last year of adoption, you've had all these like huge companies add passkey, right? Google, TikTok, like household names. I think Target was just a couple days ago, uh, released Passkey, which is really incredible, but they're typically not, they're doing it in a way that is like adding Passkey as an option for their login, right?

They still typically have a password and then the user could go add a password or passkey in their profile, um, and then start to use that going forward. And what we're finding is companies wanna do that to help make their users more comfortable to understand what's working well for them. And so we need to give people these developers tools to actually build that way if that's the way they prefer to build over, you know, going all in on PA keys upfront, right?

And I think that's just a more realistic way you can do really great like AB testing and understand the value you're getting from PA Keys and like migrate over time. So for example, at One Password, you know, we have a product called Passage that is all about making it easy. It's like a toolkit for developers to implement pass keys.

And originally we were really all about this, like all in on pass passwordless methods, uh, for logging in no passwords. And what we've learned is that people need to be able to use our product alongside of whatever their existing authentication system is. So we created a product for that to make it easier for them to kind of slowly add pass passkey over time to have really well informed user flows.

Like that is the thing that people need and, and businesses need in order to be successful here and really drive not just, you know, the existence of Passkey login on their website, but end users actually using that, right? That's what's really important is that the end users are using the technology. Do we need to go in and quote unquote modernize that authentication experience for all our existing applications?

Or are we just drawing a line in the sand and saying all new stuff from here will be like this and we'll just keep this old stuff around for as long as we can, or until we just can't tolerate it anymore. I really wish it could be the second one and just kind of say everything in 2024 uses pass keys, right? Like, I would love that for that to be the reality, but I just don't think it's super realistic.

I what I'm seeing is that, uh, there are a set of companies that are really excited to go fully passwordless and they're using pass keys and then maybe something like, uh, an OTP code or a, uh, magic link as a fallback option. So there's no no password involved at all, right? I'm seeing like a set of companies that are excited about that and then I'm seeing a set of companies that maybe there's have like a really complex authentication infrastructure and it's a pretty big lift to sort of change everything.

So they're just adding pass keys as this option. And I actually think that's a really reasonable good way to introduce this to their end users. You can start to prompt users at certain points in their, uh, usage of the app, like, Hey, we noticed you went to reset your password, would you like to instead make a passkey?

Right? And like that's gonna be a better experience, especially when you just forgot your password and had to go through that whole process. And so I think we have to be able to support both.

Even if I would love to really lean into a passkey only world, I just don't think it's realistic. And so we have to support the targets and the Googles and the tiktoks of the world in the way that they're building and setting that example for other companies. And I get to the point where maybe AI will save us from ourselves and I just want something to pop up and says, would you like these credentials to be magically transformed into a set of passwordless keys?

Can I get there? Yeah. We actually have been talking about something sort of like that in the Fido Alliance, which is like a group of companies working to make passwordless authentication a reality.

And we've been talking about how do we do better onboarding of pass keys? Like can we automatically create pass keys for people on websites and then let them know they're available or is that something that, you know, one password in Google and Apple could do? Um, and so we've been talking a lot about how to make like really driving specifically end user adoption more so even than than website or business adoption, making sure the websites that do have it, their end users are really seeing it, they're able to enroll past keys, they want to use the technology.

And so we're looking at like better ways to do that. To exactly your point, Do you think the bad guys are kind of slightly bemused as they look at a struggle with all this stuff? Because we have so many username and password combos on the dark web, I often wonder are there more username and passwords on the dark web than there are actively being used by humans?

Quite possibly. Honestly, I think, you know what I'm seeing, obviously there are big security benefits to passkey. Getting rid of passwords is a really big deal for preventing phishing attacks, any of these credential stuffing type type of attacks that you see.

But I think in the short term, what's really happening is more about the convenience and the user experience. As an example, if you have, you know, password login and a passkey login to a website like Target, you're not actually like meaningfully improving your security, right? You still have a password that can access your account.

That password could still be leaked or brute force or any number of other things, but we're getting people comfortable with the convenience and the like frictionless experience of passkey. We're giving businesses the benefits around like fast sign-ins, better conversions, and then I think the security benefits will come later as we start to actually drop passwords from those accounts completely. So it's sort of like a short term convenience, um, business benefits around conversion.

And then longer term we'll start to really see the security benefits from Passkey. What will be the role of the DevOps slash DevSecOps folks in this conversation? Not to mention a few of their, uh, cybersecurity colleagues.

Can they force this issue with developers? How do they kind of put something in place that perhaps gently guides people to the right answer? Yeah, I think, you know, there are obviously a lot of security benefits to PA Keys and I think there's an argument to be made for their sort of, uh, a security angle for why a company might implement PA Keys or there's a, you know, conversion, uh, fast sign in type of reason for adopting PAs keys.

And so I think security, uh, folks, engineers can really influence, uh, product decisions in this case around the benefits of security because you get both, right? You can say like, we want PAs keys for security also, here are all the great other benefits that you're going to get. And so they're able to sort of influence the business in that way.

I think developers in particular are interesting. You know, one of our philosophies is that I think passkey solve an individual problem that we need to then solve at scale, right? Pass keys are great for users because they're secure, they're easy, but that doesn't really matter unless we can scale the past key infrastructure to all of these enormous websites and things that you're using every single day and logging in.

And I think developers and security team members can be really effective at getting new technology into companies. They tend to be very, uh, like technology forward consumers themselves. And so they know about this technology, so they're usually the first adopters of this type of technology, and then they can help bring that into their organizations.

So I think it's super important for like people like One password working on this problem to partner with developers to partner with security DevOps teams to actually give them the support that they need to then vouch for this type of technology in their organization. So how do we get developers more involved in this conversation? Because it's not like I walk down the street and I'm seeing the no more passwords rally.

So, um, how do we kind of get them to go, yeah, this is what we're gonna do, we're all gonna collectively do it together. It seems like it's all a little on the happenstance side set. Yeah, I I've actually seen a lot of progress in the last year and I think that's a really good sign.

This stuff does take time, even if I sometimes wish it could just, you know, I'm like, everyone should know about this by now, and that's not really the reality. But compared to a year ago if I just talked to a developer at sort of a random company, they're more, a lot more likely to know about Pasky than they were a year ago. And I think that's really cool.

I think part of that comes from awareness. Um, and, and like user education, like I said, these like developers, DevOps, security folks tend to be very technology forward. They're using the tools that they're using like one password or GitHub, like when companies like that implement passkey support developers are a lot more likely than maybe my, my mom or like the average person to try out that technology.

And so I think getting them exposure in the places that they're at already can help just build their knowledge about it, their curiosity about it, and give them the tools to say like, this was a really cool thing. I saw that GitHub or One Password did, we should do that here, right? And like kind of meeting them where they're at in that way.

As we get to this brave new thing, we also hear a lot about multifactor authentication and biometrics. Where does that fit in this whole conversation? I mean, are they all forms of a passwordless system and I'm gonna use different ones for different use cases or how will I ultimately orchestrate all that?

I think it'll really depend on the use case. Um, especially, you know, enterprise, uh, use cases might be pretty different than consumer, but I think for most consumer cases you can really think about a passkey as roughly two factors of authentication as we think about it in the traditional sense, you know, it's something you have like a device and, and something you are usually, you have like a touch ID or a face Id prompt as part of that. And so there is a level of two different factors of authentication within a p**i, which can really, we're hoping can really help with those.

Like really high security use cases you might have like a bank or something along those lines. Um, and so, you know, there is a biometric aspect of this in the sense that it all lives on your device, it's just using your touch id. Um, there is a sense of multifactor authentication as well a lot of times.

Um, but for enterprise things like that, we might see PAs keys more as a second factor for a while, you know, in addition to a password or something like that. But I think we'll just like slowly discover what that looks like. I think the consumer market especially has a lower tolerance for friction as users logging in, right?

And so we'll really kind of lean on pass keys in that sense and not want to add a bunch of like additional factors on top of that when they don't necessarily add a lot of security. All right. Well folks, when you think about it, we've been using passwords since the first caveman grunted who goes there and somebody gave the co-sign and it's given the advancements in human society, perhaps it's time to think of some other way to do this.

Hey Anna, thanks for being on the show. Yeah, thanks Mike. All right, back to you guys in the studio.