Latest / Modularity Podcast / Stop Sharing Passwords: A Practical Path to Passkeys

Transcript

Stop Sharing Passwords: A Practical Path to Passkeys · Modularity Podcast

• 0:00
  If your team is still passing around logins for vendor portals or client management
• 0:04
  systems using a master spreadsheet or a pinned Slack message,
• 0:08
  you are running on borrowed time.
• 0:11
  I mean it.
• 0:12
  Oh, absolutely.
• 0:13
  It is, it is the classic small business trap, right?
• 0:17
  You start out, there are three of you, somebody puts the QuickBooks password on a
• 0:22
  sticky note or in a shared doc, and it works fine.
• 0:26
  Until, well, until somebody leaves the company and you realize you have to reset
• 0:31
  forty different logins on a Friday afternoon.
• 0:34
  Or worse, you don't reset them.
• 0:36
  You forget three of those accounts, and an ex employee still has complete access to
• 0:41
  your customer billing database or your medical records portal six months later.
• 0:46
  Yeah, exactly.
• 0:47
  And then the second part of that trap is people think, well,
• 0:50
  we put text message code verification on the account, so we are totally secure,
• 0:55
  right?
• 0:56
  But SMS two factor is, honestly, it is an illusion at this point.
• 1:01
  Cybercriminals can SIM swap your phone number in ten minutes,
• 1:05
  or they set up a dummy login page that grabs your password and that six digit text
• 1:11
  code in real time while you type it in.
• 1:14
  Right, it, it proxies the code straight to the actual site before it even expires.
• 1:19
  That is why cyber insurance carriers now are coming down hard on this.
• 1:25
  They are literally writing into policies that you need phishing resistant
• 1:29
  authentication, like FIDO2 passkeys, especially for anyone with admin access.
• 1:34
  But when you say passkeys to a business owner, their eyes just roll into the back of
• 1:39
  their head.
• 1:40
  They think it is some overwhelming cryptographic headache that is going to break
• 1:44
  their whole workflow.
• 1:45
  Yeah, but it is actually way simpler than a password when you break it down.
• 1:50
  According to practical guidance from cybersecurity experts at Bitwarden,
• 1:55
  the best way to understand passkeys is to skip the math and just picture a digital
• 1:59
  car key.
• 2:00
  It is not something you remember and type out.
• 2:03
  It is a physical key that lives inside your hardware, like your smartphone or inside
• 2:07
  a team password manager like 1Password or Bitwarden.
• 2:11
  Right.
• 2:11
  So when you log in, you just tap your finger or use Face ID.
• 2:14
  The key on your device talks directly to the server.
• 2:17
  And here is the magic part, a fake phishing website cannot steal it because the
• 2:23
  passkey is mathematically tied to the actual domain name.
• 2:27
  If you are on login dot fake site dot com instead of login dot your software dot
• 2:34
  com, your device just refuses to hand over the key.
• 2:38
  It literally cannot be phished.
• 2:40
  I mean, think about how much daily friction that cuts out.
• 2:44
  Dave, how many times this month have you locked yourself out of a developer tool or
• 2:48
  a portal because you forgot a character?
• 2:52
  Man, we don't talk about that...
• 2:54
  Shifting from what a human tries to remember to a secure key a device holds,
• 3:00
  it just eliminates that whole layer of human error.
• 3:02
  So if an owner wants to actually pull this off without their staff threatening to
• 3:06
  quit, where do they start?
• 3:08
  Because if you just drop new security tools on people without a plan,
• 3:12
  it turns into pure chaos.
• 3:13
  The number one rollout killer, hands down, is the browser conflict.
• 3:18
  Research from IT deployment guides over at iFeeltech shows that if you do not turn
• 3:22
  off built in browser password saving in Google Chrome or Microsoft Edge before
• 3:27
  bringing in a real password manager, your staff gets hit with double pop ups every
• 3:32
  single time they log into anything.
• 3:34
  Chrome asks to save it, the manager asks to save it, people get confused,
• 3:38
  and your internal helpdesk gets flooded with panic tickets on day one.
• 3:42
  So step zero is literally toggle off save passwords in Chrome and Edge across your
• 3:48
  managed computers before you send out a single invite.
• 3:51
  Step zero, every time.
• 3:53
  Once that is turned off, you use a three stage rollout.
• 3:57
  Stage one is a two week pilot.
• 4:00
  Grab three to five people on your team who are comfortable with technology,
• 4:04
  put them on the business password manager, set up passkeys for your main apps,
• 4:08
  and let them find where the friction points are.
• 4:11
  Right, get the kinks worked out with your power users first.
• 4:14
  Then stage two, you roll it out department by department.
• 4:18
  Finance first, then operations, then sales.
• 4:22
  Give each group a dedicated week to migrate their daily logins into shared team
• 4:27
  vaults.
• 4:27
  And stage three is setting a hard cutoff date.
• 4:31
  You tell the team, look, as of Friday the fifteenth, the shared spreadsheet is
• 4:35
  getting deleted, the Slack notes are wiped, and all official business credentials
• 4:40
  live inside the manager.
• 4:42
  If it is not in the vault, it does not exist.
• 4:44
  And the payoff on the administrative side when you do this is unbelievable.
• 4:48
  Think about departure day for an employee.
• 4:51
  In the old world, you are spending three hours logging into fifteen different vendor
• 4:57
  portals trying to change passwords before they walk out the door.
• 5:01
  With a centralized business password manager, you open your admin console,
• 5:05
  click revoke on their account, and instantly their access to every shared vault is
• 5:10
  cut off in a single tap.
• 5:12
  Their permissions disappear, the shared logins auto reassign,
• 5:16
  and you do not have to scramble to change a single password manually.
• 5:20
  It turns offboarding from a high stress nightmare into a two second admin task.
• 5:26
  Exactly.
• 5:27
  So if you want a quick win this week, sit down and audit where your team's
• 5:31
  credentials actually live right now.
• 5:33
  Find the spreadsheets, find the sticky notes.
• 5:35
  And then turn on passkey login for your primary admin account on Google Workspace or
• 5:40
  Microsoft 365 just to feel how smooth it is.
• 5:44
  And if you want a team that can step in and help you map out and implement these
• 5:49
  exact security frameworks for your business, head over to modularity dot us.
• 5:54
  Good chatting, Dave.
• 5:55
  Talk soon, Ryan.