Ready for Passwordless – Michael Kosak, LastPass

This is Textron tv. Uh, the great pleasure being joined by Mike, Mike Kosack. Mike is Senior principal intelligent Analyst with LastPass.

I love that title. Welcome, Mike. Good to be chatting.

Thank you very much, Mitch. Thanks for having me. Really appreciate the opportunity.

You bet. I'm glad you're on. 'cause this talking about, uh, passkey and Passwordless, and this is a great topic.

I think a lot of people are interested. How do I get there? Um, and I know that you partnered with the, uh, Fido Alliance to, uh, invest in creating this, uh, report and, uh, just launched actually this week.

Great to see it out there. Maybe, maybe we should start just with by why is Passwordless, why is Pasky, why, why, why are you doing this with the Fido Alliance? Sure.

Absolutely. So, you know, I don't think it's any surprise to anybody that the passwords are, you know, highly desired by threat actors. Um, we still see a lot of bad habits with passwords that leave people vulnerable, a lot of password reuse.

Um, and it, it causes problems. And, and, you know, there's better technology out there now. And, and so what we wanted to do was take this opportunity to work with the Fido Alliance, um, and highlight that and kind of, you know, evangelize this new technology and, and help its adoption, um, with this report, which as you said, just, just dropped, uh, this week.

Um, and there's some really great, uh, findings in it, some really surprising findings in it that I think will help kind of drive, you know, drive the adoption forward. Excellent. Excellent.

Well, well let's jump right into it. 'cause I think everyone's kind of wondering how do I, what should I be adopting this now? Where are others?

Am I behind? Do I do, what do I do to keep up? So, tell us a little bit about, um, the report, what you were wanting to learn or what the alliance and you were wanting to learn and maybe touch on a few of the things that you did learn, maybe even a few surprises, if there were any.

Sure, yeah. You know, it, it's really, we wanted to get a sense of, of kind of what the understanding was out there and, and, and where are we at. And if you think about the technology adoption lifecycle, where are we sort of in that process?

Um, and there were really three big takeaways that we were pretty excited about. So, one, and, and this is really cool, the world is moving to Passwordless. Um, you know, when you think about awareness of passwordless, um, 92% of the respondents, uh, either have a plan to move or are already using passwordless to some degree in their environments.

That's great news. And we really, you know, we hope to see that adoption increase. Um, another really interesting data point around that 89% of of the respondents either, uh, are planning to use this, uh, and, and have their password use down to, uh, accounting for only 25% of their logins within the next five years.

Mm-hmm. Um, again, great news. That's exactly what we wanna see is that we're on this path and it'll take a while, but we'll get there.

Um, number two was that really the biggest impediment that we see right now is education. Um, you know, people wanna learn more and get more comfortable with passwordless, uh, technology. 55% for the respondents noted this as kind of the biggest obstacle for them, um, and adoption in their organizations.

Another 31% said they wanted to check on, uh, you know, compatibility and, and how could they use it with their existing technology. Um, so that's, you know, that was an interesting data point as well, especially considering this is fundamentally based on cryptographic key pairs, which is, you know, well-established, well-known technology. So, um, you know, that's, that's good.

You know, we, we know where we have our work to do now. And then number three was that there are some other benefits out there that, that, you know, people are already talking about beyond what people might just associate with Passwordless. So not just, it's easier to log in, but there are other benefits as well.

93% of the respondents noted that it would probably give them better, uh, uh, better visibility into their infrastructure as they sort of, you know, consolidate their passwordless keys into one place. You know, you get an opportunity to sort of au audit your tech stack. Uh, so really some, some really exciting and interesting findings that, uh, that we were really pleased to see.

You know, one of the sort of, I dunno if it was intended or not, but it, it avoids the whole problem of here's my yellow sticky with all my passwords on. It's sort of the writing it down problem. 'cause you're not gonna write down a crypto key.

Right? Absolutely. The I key.

So it, it's, it, it is not that it forces you to do it the other way, but you actually can't do it the other way. And it's much more convenient doing that as well. Mm-hmm.

Um, it's great to hear that. I mean, it, it sounds like there's a so much momentum behind this already, and I have to imagine, you know, we're all looking for how do we solve this problem of our passwords getting stolen, our ID IDs and credentials? And it seems like the biometrics is one of the things that's helped us get here, because the mere fact that we have a phone and we're biometrically logging onto our phones, that alone, you know, sets up that kind of two factor, if you will, this two biometrics.

So kind of the timing is right. It seems like that's one of, maybe one of the reasons why this is working so well. Absolutely.

Yeah. And we've been on a journey with that ourselves. I mean, last June we, uh, implemented a passwordless login through LastPass Authenticator, and then just last, uh, I guess two months ago in August of this year, we announced that any FI oh two compatible, um, authenticator is eligible to log into LastPass so people can get access to their passwords.

Um, using, you know, either, like you said, facial ID biometrics or hardware keys. Um, which really, as you said, it gives people a lot more options to, to sort of test the passwordless experience and it becomes a lot easier and frictionless for the user. Mm-hmm.

It, it also, I, I think, creates an even more importance of having a password manager, you know, like LastPass, uh, because especially the, you know, now that the products have come so far and having kind of the business requirements, the enterprise security requirements to being able to manage users accounts, you know, how do you handle when they forget their master key and all that kind of stuff. But now you've got the infrastructure to support it. It's not just, or you go download something and you're on your, on your own enterprise.

Even me, medium and small business can manage this. Mm-hmm. Yeah.

Absolutely. And that was one of the other things that we found, uh, through the, through the research, 69% of respondents said that they planned on using a, a, a password manager, a third party password manager to help 'em with this for precisely that reason. It makes it easier for them.

Yeah, it truly is. And I think just my own opinion, just my own experience implementing these, um, you know, the browser, uh, plugin also makes it a huge, a huge benefit. 'cause it's right there, you know, I With any desktop apps or on your phone, were, were there any surprises?

Like, I didn't expect to see this that high or this low, or this issue came up that, you know, we, we knew was there, but maybe not as prevalent as what you might have thought of? Well, I think y you know, going back to the, the fact that it really does seem like the future, the i, the fact that so many people are already aware of it, and to some degree either planning on implementing it or implementing it to some degree, um, was a great surprise. You know, the, the fact that that awareness is already out there means that a lot of our work is already done in moving this forward.

Um, education being at about 55%, that was a bit of a surprise. You know, again, it just kind of highlights where we kind of need to focus to help drive that adoption. Um, and then the fact, you know, that 93% seeing, uh, passwordless implementation as a way to get better, you know, better, a better understanding of their tech stack, um, was a really interesting sort of second order effect of the implementation of passwordless.

So I think so much of the conversation is just around that ease of access, you know, frictionless experience for users. It's more secure and everything, but sort of those second and third order effects are really interesting and, and kind of call that, you know, call that out. Even you mentioned this earlier, you know, fewer calls to, to, to the IT department when people forget their passwords, when they come back from vacation, that sort of thing.

You know, there's a lot of, there's a lot of those second and third order effects out there that are, that are really great. What's the, what's the IT organization's experience when they decide they want to go passwordless? Sure.

Uh, you know, there is, there's gotta be testing done. Of course, you do wanna make sure that it works with your technology. Um, you know, for us, we do offer a couple of, a couple of ways that we can help, uh, small and medium businesses as they're on that journey.

Journey. We have an authentic, excuse me, adoption, uh, dashboard to kind of help them walk through that process. Um, we offer some training to kind of help users and the IT departments get comfortable with this implementation and, and how it's being, how it's being used, you know, what sort of adoption we're seeing inside the company.

Um, so we kind of offer some help along that, uh, uh, along that road as well. Excellent. And of course, the u it's gotta be easy for end users to adopt it, right?

And it's a, it's gotta be better than typing in your password or a code from your phone. So clearly it's meeting that criteria. Well, where can folks find out more about, of course, LastPass and also, uh, this report?

So we've posted it on our blog. com, uh, Fido Alliance has posted it on their site as well. org, um, prominently displayed in there.

If, if, if you go to those sites, you can find it right there and, and some really interesting highlights and, and some, a lot more you can learn there as well. Excellent. We'll be sure and check that out on the last past com site.

Well, thank you, Mike. It's been a pleasure talking with you. Mike Koze, who is Senior Principal Intelligent Analyst with Last Pass.

Hope you'll come back again soon. Anytime. Thank you, Mitch, for having me.

You bet.