From Passwords to Passkeys: Exploring the Future of Authentication with Massi Gori

In this enlightening episode of Nerding Out with Viktor, Viktor Petersson welcomes authentication expert Massi Gori to delve deep into the ever-evolving world of digital identity and security. Massi, a seasoned product manager at Canonical, brings over 17 years of experience in identity management, from foundational protocols like LDAP and Kerberos to the latest advancements in passkeys and zero-trust models.

The conversation begins with a historical journey through the evolution of authentication technologies, highlighting the pivotal roles of LDAP and Kerberos, which laid the groundwork for modern identity verification. Massi reflects on the shift from SAML to OAuth and OpenID, underscoring how these standards set the stage for today's Single Sign-On (SSO) systems and federated identity management.

Viktor and Massi explore the crucial distinction between authentication (verifying who you are) and authorization (determining what you can access), unraveling the often-complex concepts behind identity management. Massi emphasizes the importance of user management and identity governance, illustrating how each plays a vital role in securing enterprise environments. They also cover the rising significance of Multi-Factor Authentication (MFA) and the progression from hardware tokens to modern soft tokens, which have simplified yet bolstered the security framework for millions.

The discussion transitions to FIDO2 and WebAuthn standards, a major leap toward a passwordless future. Massi shares insights into the mechanics behind these protocols and how FIDO2’s architecture enhances security against adversaries-in-the-middle and other sophisticated attacks. He also addresses the role of biometrics, behavioral metrics, and device-based security as essential components of the zero-trust framework, shedding light on why continuous verification is more important than ever in the digital age.

Towards the end, Viktor and Massi discuss passkeys—the new generation of passwordless authentication. Massi explains how passkeys combine the security of FIDO2 with the convenience of cloud sync, making it easier for users to recover credentials without sacrificing security. The duo addresses the trade-offs between using traditional hardware tokens like YubiKeys and the cloud-based flexibility of passkeys, giving listeners a comprehensive look at the future of authentication.

This episode is a must-listen for tech enthusiasts and professionals alike, offering a thorough understanding of where digital identity is headed and what companies can do to stay ahead in securing user access.