Research on web and mobile technology
This post is joint work with Sukhi Chuhan and Pema Selden. This post is an interim report on version v5 of a live demonstration of a multi-purpose driver's license credential. The demonstration is live and a step-by-step description of how to run it is provided below. The code of seven Node.js servers used in the Continue reading "On-demand cross-device replication of a driver s license…
Update after the workshop. I made the presentation in Session 2 / Day 1 / Room L and the audience was able to run the demo while I was showing the slides. Philip Quinlan pointed out that a dynamic QR code would be displayed on a small screen, and the driver would have to come Continue reading "A driver’s license credential usable for website registration and traffic stops"
A recent survey by the FIDO Alliance shows that passkeys have still not reached widespread adoption. The survey has found that, among users who have used passkeys, only "38% report enabling them whenever possible." This means that users who are familiar with passkeys do not think they are secure enough or convenient enough. A passkey Continue reading "Unlocking passkey adoption with a more secure…
From the very beginning of the web, browsers have been used as credential wallets to store and present cryptographic credentials, which makes sense since the browser is the user's agent on the web. But only TLS certificates have so far been supported, and proof of possession is inconveniently provided, during the TLS handshake, to transport-layer Continue reading "Using a browser as a credential…
December 1, 2024: updated to make corrections as shown. The proposed alternative definition of special soundness has not been changed, but its wording has been clarified. I am co-authoring a book on the Foundations of Cryptographic Authentication with Sukhi Chuhan and Veronica Wojnas, where Chapter 3 is concerned with traditional credentials (as opposed to verifiable Continue reading "A Definition…
Two weeks ago I gave a talk about the mobile driver's license standard at IIW XXXVII, the 37th meeting of the Internet Identity Workshop, which took place as usual at the Computer History Museum in Mountain View. One of the great things about IIW is that the agenda is created each day. That makes it Continue reading "Overview of ISO/IEC 18013-5: Innovations and Vulnerabilities in the mDL Standard"
THE STREAMLINED PROCESS IS NO LONGER AVAILABLE. PLEASE WRITE TO US THROUGH THE CONTACT PAGE IF YOU WOULD LIKE TO LICENSE THE PATENT Two-factor authentication with a fusion credential, demonstrated in this GitHub repository, overcomes the UX obstacles that are impeding large scale adoption of cryptographic authentication, by making it possible to add protection against Continue reading "A…
I have just published a GitHub repository demonstrating a method of two-factor cryptographic authentication with a fusion credential, which provides the same user experience as traditional authentication with username and password, but with strong security. Developers with an Amazon AWS account can use a script provided in the repository to install the demo on an Continue reading "A Demonstration…
Updated August 8 2023 I have just revamped the cryptographic authentication page of the Pomcor site to reflect two major changes that are happening in internet identity and authentication: It is now clear that traditional MFA is vulnerable to MITM phishing attacks and cryptographic authentication is the solution. But the technology that the industry has Continue reading "A Brief Overview of…
March 18, 2023: The preprint referenced below has been updated to add a patent disclosure. FIDO2 and WebAuthn have momentum. They are supported on all browsers. Apple, Google and Microsoft are busy developing or releasing initial versions of passkey syncing. NIST now requires resistance to phishing attacks at Authentication Assurance Level 3 of the Initial Continue reading "FIDO2 and WebAuthn have…