Okta FastPass: Phishing-resistant MFA

Security practitioners worldwide face the same challenge: provide robust security and enhanced user experience. In a landscape of continued change and evolution, knowing all of our options becomes difficult. The seemingly elusive solution is to provide our end users with a seamless experience while requiring them to perform powerful, phishing-resistant multi-factor authentication (MFA).

While traditional MFA options, such as one-time passwords (OTP), are a step up from password-only authentication, they’ve proven increasingly inadequate in the modern world. It’s now fairly easy for bad actors to intercept OTPs sent via email or SMS.

Hardware tokens, while secure, severely impact the user experience and are more prone to loss and damage. These downfalls highlight the need for a more resilient solution that confronts these weaknesses.

Okta FastPass addresses these challenges head-on using a multi-layered approach to authentication through a single flow that provides:

1. Possession factor 
   • FastPass authentication requests use a signed nonce to irrefutably verify the possession of a registered device that has been cryptographically bound to a user's account.
2. Inherence (or knowledge) factors within the same flow
   • Inherence — FastPass uses a device's built-in biometric capabilities, such as fingerprint or facial recognition.
   • Knowledge — For devices without biometrics, FastPass retains the option to fall back on a secure knowledge factor that is unique to the device like a PIN or local password.

Why FastPass is technically superior to traditional MFA

FastPass offers a compelling alternative to traditional MFA solutions because it provides enhanced security and compliance benefits. One such benefit is a phishing-resistant design that leverages signed nonce mechanisms and domain verification to ensure that, even if a user’s credentials remain secure, even if they fall victim to a phishing attack. 

The dual-factor authentication process, requiring possession of a physical authenticator and a linked biometric or secret, adds an extra layer of assurance, helping mitigate the risk of unauthorized access. FastPass's alignment with NIST SP800-63B AAL2 requirements makes it an ideal choice for organizations aligning with industry standards and best practices. (Note: FastPass can also be deployed to attest at AAL3, depending on device configuration. Reach out to the TAM team for guidance.) 

Ultimately, FastPass presents a robust and user-friendly authentication solution that addresses the key concerns of business leaders — offering enhanced security, compliance, and ease of use.

FastPass technical implementation 

FastPass's technical implementation is designed with security and flexibility in mind, offering Identity practitioners a robust and customizable authentication solution. The device registration process securely binds a user's device to their identity, establishing a strong foundation for subsequent authentication. 

The authentication flow is seamless and transparent, involving a secure exchange of signed nonces between the Okta platform and the Okta Verify app on the user's device. This exchange ensures the user is in possession of the registered device and the authentication request is legitimate. 

Additionally, configuring granular policies empowers admins to tailor authentication policies to their organization's specific security needs, enforcing requirements like biometric authentication or minimum operating system versions for registered devices. This combination of security, flexibility, and ease of use makes FastPass a compelling choice for modern Identity and Access Management.

Benefits of FastPass in a nutshell

Okta FastPass allows customers to address the cumbersome nature of traditional MFA methods and provides a strong line of defense against phishing attacks. It’s a two-factor method because it combines inherence and possession in the same flow. 

The silent push of a signed nonce provides phishing-resistant confirmation of possession and inherence through biometric verification into a single, user-friendly authentication flow. Okta FastPass is a strong and scalable two-factor authentication solution. 

Here are some tips on how to implement FastPass today 

• Enable and configure: Activate FastPass in your Okta admin console and configure settings like user verification options (biometrics or device passcode).
• Enroll users: Guide users through the enrollment process, ensuring they have the Okta Verify app installed and set up on their devices.
• Secure device registration: Initiate the secure device registration process, creating a cryptographic binding for each user's device.
• Customize policy configuration: Tailor FastPass to your organization's specific needs by configuring granular policies for factors like biometrics and minimum OS versions.
• Prioritize phishing resistance: Leverage FastPass's signed nonce mechanism and domain verification to safeguard against phishing and fatigue attacks.
• Ensure strong assurance: Implement dual-factor authentication with FastPass, combining possession of a physical device with a biometric or secret for robust user verification.
• Experience seamless authentication: Familiarize yourself and your users with the streamlined authentication flow, which silently verifies user possession and authenticity of the request.
• Align with best practices: If NIST SP800-63B compliance is a priority, you can rest assured that FastPass's AAL2 alignment satisfies those requirements.

These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments nor all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials.  Information regarding Okta's contractual assurances to its customers can be found at okta.com/agreements.