In this two part series we compare Keyless’ biometric authentication platform with two popular passwordless authentication technologies, FaceID and YubiKey.

As instances of leaked passwords and credentials continue to skyrocket – wreaking havoc in the workplace and with consumers alike – passwordless solutions – 

like Apple's Face ID and the workforce security token, YubiKey

 – are becoming increasingly popular to mitigate cases of fraud and identity theft. But how effective are they?

In this piece we introduce some of the core issues with modern passwordless solutions that rely on local authentication technology, by looking at the two aforementioned popular solutions. But first, let's explain what local authentication is. 

Local authentication relies on hardware technology – essentially devices, whether they be a users smart phone or a portable USB – to authenticate users. With local authentication, there is an area within the device where a user’s login information (or 'secret') is stored. A “secret” can be anything used to authenticate the user – from passwords to private cryptographic keys, to biometric samples.

All kinds of hardware devices can be turned into instruments for local authentication. For example smartphones, laptops, swipe cards and portable USB sticks are all examples of devices that are being used today to authenticate people all over the world. 

Solutions that require users to login using a trusted device tend to be more secure and easy to use than those that rely on. Those that don’t make it easier for malicious attackers to break into a user’s accounts, either by stealing the hardware device itself and using it on another device, or stealing information about the hardware device and replicating it to create an unauthorized duplicate.

Systems that use local authentication usually combine another method of authentication, like passwords, PINS or biometrics to provide strong MFA.

Security issues with local authentication

Local authentication systems store private information in a secure part of the hardware device. The security issue with storing private information on portable hardware devices is that they can easily be stolen or lost. In that case, to bypass local authentication, the only security barrier a hacker needs to break into is the hardware device’s internal system.

While this is generally enough to deter non-professional hackers, strategies and technology used by professional cybercriminals are evolving to keep apace with the most sophisticated security systems. Generally the longer an attacker has with the hardware device, whether that be someone’s phone or USB, the more chances they have of breaking into it to steal private information.

User experience issues with local authentication

Reliance on hardware devices for authentication can pose significant disruptions to the user experience, which can easily frustrate users. For example, if a USB authenticator or smart phone is accidentally left at home, a user can be locked out of all their accounts.

Other issues with user experience are when the user has to jump between multiple devices in order to authenticate themselves; this can be extremely tiresome for users when they need to repeatedly do this throughout the day.

Besides the security risks of storing private data within the hardware device’s internal systems, many local authentication systems also use centralized storage systems to store user login credentials, or “secrets”, so that they can verify a match at the time of authentication.

Centralized storage systems are frequently targeted in sophisticated cyber attacks — putting user accounts at higher risk of being compromised.

Examples of local authentication: FaceID and YubiKey

There are a number of different security systems that leverage local authentication. Some of the most well known are Apple’s Face ID — which is used to access and make payments with compatible iOS devices and third party apps.

Another example is YubiKey, a portable USB stick that provides a second factor of authentication by giving user’s a one-time password (OTP) that they use along with their usual password, adding a layer of security when accessing their private keys and digital wallets.

Face ID – a user’s mobile, tablet or laptop is used for local authentication.

Apple’s FaceID utilises local authentication to provide a biometric MFA solution that combines a user’s biometrics with their registered — or “trusted” — device. Apple securely stores a user’s biometric data within the “Secure Enclave”. This encrypted part of the iOS chip is designed to securely store sensitive user data, including a user’s sensitive biometric templates.

While Face ID offers a high degree of security, it’s actually possible for an attacker to bypass the secure enclave.

The more sophisticated the attack, the greater the likelihood they’ll break into a user’s accounts. The FBI famously worked out how to bypass Apple’s internal security systems, breaking into suspects’ phones and accounts — all without any cooperation from the suspects or Apple.

Since users often delay reporting lost and stolen devices in the hopes that they will be returned, cybercriminals may have the luxury to perform sophisticated attacks, similar to those launched by the FBI, in order to breach a user’s accounts.

This security flaw jeopardizes user privacy — as private information stored within the internal systems of an Apple device, or in the Secure Enclave, is vulnerable to malicious attacks performed by hackers.

If Apple didn’t store sensitive information locally on the device, then losing access to one’s device would not be a privacy or security threat.

Another common issue with local authentication, and in particular with Face ID, is that these solutions are developed to only work with specific systems. For example, Face ID is only compatible with iOS devices — which means that it discludes those who do not have an Apple device, and cannot be used at large scale for organizations and governments that rely on other software systems.

YubiKey – a USB key is used for local authentication.

YubiKey is another example of local authentication. YubiKeys are USB sticks that act like physical keys that users plug into their computer when they want to login to their accounts. They then present a one time password that can be used with a normal password to unlock access to the user’s accounts.

As an external hardware device, YubiKeys are at risk of being lost, stolen or misplaced. One of the biggest risks with YubiKeys are that they can easily fall into the wrong hands without the original owner realizing for an extended period of time.

To make things more complicated, YubiKeys do not need to be registered to a user’s trusted devices. Without this layer of protection, an intelligent attacker who came upon a user’s YubiKey could potentially use it to break into the owner’s accounts through another device.

Not requiring trusted devices also allows malicious attackers the opportunity to execute more sophisticated attacks. For example, a clever attacker could supply an unsuspecting user with a fake or tampered YubiKey. Once the victim registered their online services using the tampered device, the attacker could impersonate them and gain access to their accounts from an unregistered device.

 trust the person or business they purchase the YubiKey from, as well as any other centralized systems that they may share their YubiKey password with — like centralized cryptocurrency exchanges.

YubiKeys are disruptive to the user experience as they require the user to plug in a secondary USB device to unlock their accounts. While the user may not mind doing this to unlock access to certain accounts, using a YubiKey to access every single account would be too disruptive to the daily user experience.

The YubiKeys size and portability means they are also at greater risk of being lost. Misplacing a YubiKey can cause frustrating disruptions to the user experience — especially when a user may have just left the device at home.

For the enterprise, the YubiKey is an expensive MFA solution; not only must YubiKeys be purchased upfront and distributed to all users or employees, these small devices must also be continually replaced, placing unnecessary financial burden on either the user or the organization.

Today’s standard of authentication: FIDO (Fast Identity Online)

Fast Identification Online (FIDO) is a best-practices protocol for local authentication, in particular for biometric authentication.

With FIDO a user’s “secrets” are stored on registered devices. To unlock access to their accounts, a user must present a biometric sample that matches those stored within the device — if it’s a match, the user will gain access to their accounts and personal information.

FIDO’s framework reduces instances of phishing and man in the middle attacks, however it cannot guarantee that breaches won’t occur; since a user’s “secrets” or private information is always stored on a hardware device with local authentication, they are always at risk of being compromised.

By leveraging a distributed network — rather than hardware devices or centralized storage systems — to store a user’s private authentication data, Keyless makes it much easier to guarantee privacy and security than local authentication solutions.

In the next part of this series we explain in further detail how Keyless’ platform greatly improves security, privacy and usability standards in authentication — in particular with safeguarding sensitive biometric data — which should be protected with much more robust security technology than what local authentication solutions can offer today.

Local Authentication vs Keyless pt. 1: FaceID and YubiKey

Introducing Keyless, a deeptech cybersecurity company building the world’s first, truly private, biometric authentication and personal identity management platform that combines multi-modal biometrics with advanced cryptography.

Hi and welcome to the official Keyless blog!

It’s been an incredibly busy, intense and exciting first year! We can’t wait to share more about the problem we’re solving, our breakthrough technology and the unique solutions we are pioneering!

But first, we’d like to start by introducing ourselves — Andrea Carmignani, Fabian Eberle, Dr. Giuseppe Ateniese and Dr. Paolo Gasti — and how we’ve come together with our dream team who will be contributing to this blog.

Andrea has a long-standing curiosity and interest in emerging technologies, which can be traced back to his childhood, where as an eight year old child, his father taught him how to assemble PCs and code — the early days of the internet, with DOS and HTML, services like Napster, and TCP/IP and DNS protocols.

By the time he celebrated his sixteenth birthday, Andrea had already started organizing major music festivals in Rome. He soon became an angel investor — funding startups in the tech space all the way into his early twenties.

Before founding Keyless, Andrea sold and managed multi-million digital transformation projects in Europe and the Middle East, while working as a Strategy Consultant for Accenture and Roland Berger.

In his MBA motivation letters, he mentioned how Bill Gates and Steve Jobs legacies had a tremendous impact on his life, motivating him to do something different. Real innovation. What we do at Keyless today.

Like Andrea, Fabian has always been interested in emerging technologies and their potential to transform the way businesses and people interact across continents and cultures.

As a young boy, he loved spending time playing computer games, ordering various parts to build and optimize his PCs so that they were built for gaming specifically. His decision to study Business Informatics came as no big surprise to his friends and family.

Fabian started his career in enterprise software with SAP at their headquarters in Walldorf, Germany, with stints in New York and Shanghai, while graduating from University of Ludwigshafen am Rhein and Tongji University. He later joined McKinsey in their Business Technology practice, where he led and managed digital strategy and transformation projects across the globe for several years.

In his MBA motivation letters, Fabian wrote about building and leading a technology business that would have a fundamental impact on people’s lives later on in his career, not knowing just how soon we would start with Keyless.

Giuseppe, our third co-founder is ranked among 

the world’s 10 most influential security and privacy scholars

He is a world renowned cryptographer, and currently the Department Chair of Computer Science at Stevens Institute of Technology.

Giuseppe is particularly interested in digital identity and was immediately drawn to the idea for Keyless — seeing it as a novel way to combat shared secrets, fake accounts and stolen identity.

He has devised several innovations in the security and privacy domains throughout his career. These include 

Our fourth co-founder is the renowned scholar Paolo Gasti. Paolo’s areas of expertise span from behavioral biometrics to privacy-preserving biometric authentication and identification, secure multi-party protocols, and network security.

Paolo is passionate about finding new ways to use cryptographic techniques to protect users and their privacy.

As a young boy, Paolo was fascinated with computers and electronic devices. In high school, he could always be found tinkering with computer hardware and building cryptographic schemes with the intention to eventually break into them.

, that goal is to design a future internet network architecture.

Paolo’s work has been sponsored by the 

Defence Advanced Research Projects Agency

 and the National Science Foundation. He previously worked as a research scholar at the University of California, Irvine, and is a Fulbright fellow.

Andrea came up with the idea for Keyless in early 2017 while teaching himself about blockchain technology and its potential to transform digital services.

During a field trip to Israel he learned more about biometric technology, at a time Apple acquired facial recognition capabilities to build FaceID. This sparked the idea to combine this technology with encryption methods — inspired by the power of blockchain and decentralized applications — to create a solution that would allow people to securely store and share any kind of digital asset, content or confidential information, such as personal memories, passwords, digital assets or private keys, with their loved ones at any time in the future.

We — Andrea and Fabian — then met on a pre-MBA trek in Italy just before beginning our Masters of Business Administration at 

 — one of the world’s most renowned business schools. Immediately, the two of us connected over our mutual interests in blockchain and disruptive technologies, with the goal to start up a company together throughout the MBA year.

During our course, we took part in INSEAD’s Venture Competition with the idea to build on Andrea’s original “time-capsule” or “digital vault” product. While working on developing this idea, we quickly realised that the problem to be solved was so much bigger: authentication and identity management are fundamentally broken.

We noticed that the internet was lacking a universal identity layer that, if present, would enable users to maintain control of their personal information and identity.

This architectural flaw jeopardises user’s privacy and security, while also putting businesses at security and compliance risk.

To solve this deeply rooted problem, we set out to create a universal solution that leverages advanced biometric technology to allow anyone to use their own body — or “

” — to authenticate themselves across the digital world.

We soon managed to pitch our idea to Prof. Giuseppe Ateniese, one of the world’s leading cryptographers, who serves as an advisor to a company Andrea previously invested in. Excited by the idea after hearing it over lunch with pizza and pasta at Rome’s Termini Station (

yes, for real, and it couldn’t have been more genuine

), Giuseppe agreed to join the adventure as third co-founder.

Giuseppe then convinced his former PhD student, Dr. Paolo Gasti, to join the team as a fourth co-founder. Paolo had been working at the intersection of biometrics and cryptography for over a decade and had established his own reputation as an expert in privacy technology and biometric authentication.

Excited by the idea of turning their research into tangible technology, some of Paolo and Giuseppe’s former students who worked with them on privacy and security technologies left their jobs to join us early on — recognising the opportunity to fundamentally transform the way people interact with the digital world.

Since then, we have been incredibly busy building a highly experienced team, which is now about 20 people strong, including dozens of high-caliber PhDs and seasoned industry experts specialising in the fields of computer science, cryptography, machine learning and biometrics.

Initially, we are focusing on developing secure privacy-preserving biometric authentication solutions using our proprietary zero-knowledge technology.

We plan to launch our first product to the public early next year — the Keyless Authenticator. Stay tuned for news on our groundbreaking biometric authentication solutions.

We hope you enjoyed this introduction to how Keyless came together. Our team will be making some important announcements in the near future. To stay up to date, please follow us on 