◇ OpenCyber Academy
Master's · Chapter 2 · English

Chapter 2 — Identity and access management: advanced seminar

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Identity and access management: advanced seminar

Lesson map

Lesson 02 published. Map, example, EX008.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Authentication assurance"]
  N2["2.2 How passkeys work"]
  N3["2.3 Federation and single sign-on"]
  N4["2.4 What research says"]
  N5["2.5 Recovery remains"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX008"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Authentication assurance"]
  N2["2.2 How passkeys work"]
  N3["2.3 Federation and single sign-on"]
  N4["2.4 What research says"]
  N5["2.5 Recovery remains"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX008"]

[Learning outcomes]
    |
    v
[2.1 Authentication assurance]
    |
    v
[2.2 How passkeys work]
    |
    v
[2.3 Federation and single sign-on]
    |
    v
[2.4 What research says]
    |
    v
[2.5 Recovery remains]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX008]

Learning outcomes

You will (1) explain authentication assurance and phishing resistance; (2) describe how passkeys and federation work; (3) relate research findings to Halyard's plan.

2.1 Authentication assurance

NIST SP 800-63B-4 describes authentication assurance levels, which express how confident a system can be that the person signing in controls the authenticator bound to the account. Higher levels require multiple factors and stronger protections. The guidelines also describe phishing resistance: an authenticator resists phishing when it will not release a usable secret to a site that is impersonating the real one. One-time codes typed by the user do not have this property, because a user can be tricked into typing them into a fake page that relays them. Jonah uses these definitions to describe Halyard's current and planned methods precisely.

2.2 How passkeys work

With WebAuthn, a device or security key creates a key pair for each site. The private key stays on the device; the site stores only the public key. To sign in, the site sends a challenge, and the device signs it after the user unlocks it, often with a fingerprint or device PIN. The signature is bound to the site's origin, so a look-alike site receives nothing it can use at the real one. There is no shared secret for the user to forget or reveal, which is why passkeys may remove many reasons for password resets.

2.3 Federation and single sign-on

Halyard staff sign in once to an identity provider, which then vouches for them to many applications. Older applications use SAML 2.0, an OASIS standard in which the provider sends signed assertions; newer ones use OpenID Connect, built on OAuth 2.0, in which the provider issues signed ID tokens. Because applications trust the provider, strengthening sign-in at the provider strengthens it everywhere at once. That makes the provider the right place to introduce passkeys, and it also means a fault there affects every application, which Jonah must consider when measuring sign-in success.

2.4 What research says

Bonneau, Herley, van Oorschot and Stajano (2012) evaluated many alternatives to passwords against usability, deployability and security benefits and found that none dominated passwords on all of them. Their framework helps Jonah ask which benefits passkeys offer Halyard and which costs remain, such as device loss and recovery. Herley (2009) warned that security advice users find costly will be rationally ignored. Passkeys may succeed partly because they reduce effort rather than adding it. Jonah notes that most published evidence comes from consumer settings, so workplace evidence such as his is a useful addition.

2.5 Recovery remains

Passkeys do not eliminate account recovery. Staff lose phones, replace laptops and forget device PINs. If recovery falls back to a weak method, such as a desk agent resetting access after a phone call, attackers will target that path instead. NIST SP 800-63B-4 discusses authenticator loss and recovery as part of the lifecycle. Jonah therefore records recovery requests separately from password resets, and notes Halyard's recovery procedure, which requires an in-person or video identity check. Measuring only password resets could show an improvement while hiding a shift of risk into recovery.

Worked example

Jonah describes Halyard's move from password plus one-time code to passkeys at the identity provider, using assurance levels, phishing resistance and the federation path, and plans to track recovery separately.

Synthetic case. Halyard's systems are synthetic; the standards and papers cited are real.

Errors and limits

Treating any multi-factor method as phishing-resistant ignores that typed one-time codes can be relayed by a fake site.

Exercises

Synthesis

Passkeys bind sign-in to the real site and remove shared secrets, but recovery must be measured, because risk can move there.

Continue studying — chapter 02 of 08

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →