Millions of customers trust Intuit with their most sensitive financial information. With that in mind, Intuit recently rolled out FIDO Authentication on its mobile apps to provide additional layers of security while simultaneously making the user experience more convenient. In this webinar, Marcio Mello, director & head of Product Management – Intuit Identity & Profile Platform, presents Intuit’s approach to enable FIDO Authentication, including:
Intuit’s priorities in choosing a mobile strong authentication solution
--The steps Intuit took to evaluate strong authentication solutions that met its security and usability requirements
--Intuit’s evaluation of FIDO authentication vendors and solution chosen
--The steps Intuit took to roll out FIDO Authentication, challenges faced and how they were overcome
--Intuits login time and security results after deploying FIDO
--Intuit’s advice for other service providers deploying FIDO
Speakers:
Marcio Mello, Director & Head of Product Management – Intuit Identity & Profile Platform
Andrew Shikiar, Executive Director & CMO, FIDO Alliance
6. Intuit’s Identity & Authentication Priorities
Mobile First Strategy
User
experience
SecurityMFA -
Passwordless
7. Finding the Right Security and Usability Balance:
Benefits of standards
• Future proof
• Scalability
• Lower operational costs
Better User Experience
• Passwordless
• Fingerprint/Facial biometrics
Better Security
• Public Key Cryptography
• Privacy/No trackability
• Credentials/Biometrics never
leave device
Why FIDO
8. Rolling Out FIDO Authentication:
Key Steps
Criteria: security, platform
readiness, references
and costs
Nok Nok Labs S3 Platform/
iOS/Android
First platform: TurboTax
User rollout: Upgraded app,
iOS first
Vendor evaluation
Product managers,
engineers, customer care
agents and others
Internal Customer
Education
Registration, sign-in
and settings
Build Out User
Experiences
Phased launch
10. The Results
78% reduction in
sign in times 6% increase in login
success rates
99.9% authentication success vs.
80-85% using SMS OTP
Shorter session times decrease
potential attack surface
12. Consider outsourcing components of the solution as
needed.
Have clear, well-defined goals in terms of reduction
in abuse and improvements in
user experience.
Consider the implications on your current analytics
frameworks, and how a FIDO passwordless sign in
will change the way
you measure conversion.
Have a careful plan to migrate mobile apps
from a local PIN or biometric challenge to
unlock the app to FIDO to sign in.
Advice for Rolling out FIDO
1
2
3
4
5
6
7
8
Educate product managers, engineers, customer
care agents and others within
your organization.
Consider a progressive approach to registration.
Plan a simulation or pre-launch of the new
registration and sign in process to work out any
kinks before rolling out to your wider customer
base.
Pair your FIDO implementation with a plan to
shorten security token lifetimes to realize the full
security benefits .
Plan for scalability, high availability and disaster
recovery, especially if you are moving the service
to the cloud.
13. Andrew Shikiar
Executive Director & CMO
FIDO Alliance
Marcio Mello
Director & Head of Product Management
– Intuit Identity & Profile Platform
14. If we didn’t have time to answer your question, please reach out
to us at help@fidoalliance.org
The webinar recording and slides will be emailed to you and posted on
fidoalliance.org
Please stay on to take the survey at the conclusion of the webinar
User experience. Signing in on a mobile device using a password can be frustrating – it’s easy to make mistakes when typing on a mobile device. Intuit wanted the experience of signing in to the app to be frictionless for users.
Security. In today’s threat landscape, there are so many ways a hacker can take advantage of poor security in mobile devices and apps. While infrequent sign-ins are common, Intuit wanted to make the process so easy they could regularly sign users out and invalidate their tokens to help prevent unauthorized access to accounts without negatively impacting the user experience.
Account Takeover. Intuit is constantly using technology and techniques to minimize account takeover, and needed a solution that would help decrease these types of opportunities for hackers.
Graphic show migration from Unlock app to Sign in to app (somehow)
User experience
Sign in flow