Trust at Scale: Lessons Learned from a Decade of Engineering for Identity

Trust at Scale: Lessons Learned from a Decade of Engineering for Identity

Speakers: Frederic Rivain, CTO, Dashlane

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=Ygw7RFrIDwU

Overview

In his BSides NYC talk, "Trust at Scale: Lessons Learned from a Decade of Engineering for Identity," Frederic Rivain, CTO of Dashlane, offered a candid and insightful retrospective on the challenges and triumphs of building and scaling a security-focused product over nearly ten years. Rivain emphasized that trust, particularly for a "secret product" like a password manager, is not merely a technical construct but a multifaceted outcome influenced by technology, company culture, and organizational leadership. The presentation delved into Dashlane's evolution from a consumer-focused password manager to an enterprise-grade credential security platform, serving millions of users and 25,000 businesses.

Rivain's talk is particularly relevant in today's cybersecurity landscape, where identity and access management are paramount, and the demand for robust, user-friendly security solutions is ever-increasing. By sharing Dashlane's journey—including its early missteps, strategic pivots, and continuous innovation—he provided valuable lessons for any organization striving to build and maintain customer trust in a rapidly evolving threat environment. The narrative highlights the delicate balance between uncompromising security, user convenience, and business sustainability, offering practical takeaways for engineers, product managers, and security leaders alike.

Background

▶ Watch: Introduction and overview of Dashlane and trust (0:00)

Dashlane's journey began in the early 2010s, a period characterized by nascent web technologies and a nascent understanding of digital identity security. Initially launched as a free consumer product, the company quickly learned that a premium model was essential for establishing credibility and trust. As Rivain noted, "if the product is free... you're sort of the product." Early external validation, such as a 2013 New York Times article by David Pogue, further cemented its market presence.

However, the early years were not without significant hurdles. The decision to build native applications for Windows, macOS, iOS, and Android was a necessity due to the immaturity of browser capabilities at the time, particularly for features requiring deep platform integration like autofill and local encryption. This approach, while initially effective, led to what Rivain termed the "iOS data loss disaster" in 2014. During an iOS upgrade, if a device lacked sufficient storage, the OS would delete and reinstall applications, inadvertently wiping locally encrypted user vaults. This catastrophic event underscored the critical importance of a robust update mechanism as part of a product's overall threat model, equating its reliability to that of authentication.

Another early strategic bet was the acquisition of Pasmatic in 2014, which powered Dashlane's "password changer" feature. This tool, promising one-click password changes across multiple websites, was a powerful marketing differentiator but proved incredibly difficult to scale reliably due to the dynamic nature of web environments, CAPTCHAs, and constantly changing website structures. Despite its marketing appeal, the feature was eventually sunsetted, illustrating the necessity of knowing when to retire features that, while innovative, are unsustainable. The foundational principle that emerged from these early experiences, and which has guided Dashlane ever since, is its zero-knowledge architecture. This design philosophy ensures that Dashlane never has access to customer data, master passwords, or encryption keys, with all encryption and decryption occurring locally on the user's device. While adding significant engineering complexity and complicating troubleshooting, this commitment to privacy became a cornerstone of trust, reducing both customer exposure and Dashlane's liability.

Key Findings

▶ Watch: Three dimensions for scaling trust: technology, culture, choices (2:00)

Frederic Rivain's decade-long experience at Dashlane revealed several key findings about building and maintaining trust at scale, transcending purely technical considerations. He emphasized that trust is a three-dimensional challenge encompassing technology, culture, and organizational choices.

Firstly, the technological foundation, particularly a zero-knowledge architecture, is non-negotiable for a product handling sensitive data. This commitment, while increasing engineering complexity and design constraints, fundamentally reduces customer risk and establishes a strong security posture by design. However, technology is not static; continuous adaptation to evolving platforms (e.g., browser extensions, mobile OS updates) and cryptographic standards (e.g., migrating from PBKDF2 to Argon2) is crucial to stay ahead of adversaries.

Secondly, organizational culture and leadership play a pivotal role in shaping security decisions and trade-offs. Rivain highlighted the importance of establishing robust engineering practices early on, such as Git for version control, continuous integration, test automation, and mandatory code review processes, which were critical for scaling efficiently without accumulating excessive technical debt. The talk also revealed that sometimes, over-engineering for "perfect" security can introduce unnecessary complexity, as seen with Dashlane's initial sharing feature.

Finally, strategic agility and the ability to pivot are vital for long-term survival and growth. Dashlane's decision to sunset native desktop applications in favor of browser-centric solutions in 2019, driven by browser maturity and cost-efficiency, exemplified this. The pivot from a primarily B2C focus to a stronger B2B emphasis after the costly Super Bowl ad mistake in 2020 demonstrated a willingness to realign business strategy for sustainable growth. Most significantly, the company's proactive embrace of passkeys and the FIDO Alliance in 2022, transforming a potential existential threat into an opportunity to shape industry standards, underscores the importance of innovation and adaptability in the face of disruptive technological shifts. Rivain concluded by stressing that security and usability are "two sides of the necessary coin," advocating for solutions that balance robust protection with user convenience to drive adoption and trust.

Technical Deep Dive

▶ Watch: Early days: Paid model brought credibility and trust (3:30)

Dashlane's commitment to a zero-knowledge architecture forms the bedrock of its technical security. This design principle ensures that at no point does Dashlane have access to user data in cleartext, nor does it possess the user's master password or main encryption key. All encryption and decryption processes occur locally on the user's device. This approach, while fundamentally secure by design, introduces significant engineering challenges. Developing features like secure credential sharing between parties, for instance, requires intricate cryptographic designs to facilitate the exchange without Dashlane ever decrypting the data. Furthermore, troubleshooting user issues becomes inherently more complex when engineers cannot directly inspect encrypted data.

Scaling this architecture across diverse platforms presented its own set of technical hurdles. In its early days, Dashlane supported a wide array of native applications across Windows, macOS, iOS, Android, and various browser extensions, including the now-defunct Internet Explorer. This fragmentation led to considerable maintenance overhead, disparate technical stacks, and varied security exposures. By 2019, Dashlane made the strategic decision to sunset its desktop native applications for Windows and macOS, shifting its focus primarily to browser extensions and mobile apps. This move, enabled by the increasing maturity of browser technologies, significantly reduced the organizational cost and security surface area.

The autofill engine, a core component of any password manager, has undergone multiple technical transformations. Originally implemented in C++ within native applications, requiring complex inter-process communication with browsers, it was eventually rewritten in JavaScript to enable standalone operation directly within browser environments. This iterative development highlights the continuous effort required to optimize core functionalities for performance, reliability, and platform compatibility.

Dashlane's engineering team also had to navigate the dynamic and often unpredictable nature of major platform ecosystems. Rivain cited examples such as Firefox's stringent extension submission rules and Google Chrome's migration from Manifest V2 to Manifest V3 for extensions. This latter change, a significant architectural overhaul, posed a "nightmare" for deeply integrated extensions like Dashlane's, requiring substantial re-engineering efforts to comply with new security and privacy models imposed by the browser vendor. These external dependencies necessitate not only technical adaptation but also active engagement and lobbying within industry bodies like the W3C to influence future standards.

A critical aspect of maintaining security at scale involves staying ahead of cryptographic advancements and attacker capabilities. Dashlane proactively upgraded its key derivation function from PBKDF2 to Argon2, even before Argon2 achieved standardization. This migration was a complex, three-year process across all platforms, meticulously engineered to ensure no users were locked out or experienced data loss—a direct lesson learned from the infamous iOS data loss incident.

More recently, Dashlane has embraced confidential computing to extend its zero-knowledge principles to cloud environments. For enterprise SSO (Single Sign-On) integrations, early versions required customers to host a backend component in their own infrastructure to manage encryption keys. By leveraging hardware secure enclaves in the cloud, Dashlane can now securely store and process keys in a more convenient, cloud-native fashion, enabling encryption in use. This technology is particularly relevant for organizations handling highly sensitive data in sectors like health tech or edtech, providing a robust solution for protecting data during processing.

The advent of passkeys in 2022, championed by the FIDO Alliance and major tech players like Google, Apple, and Microsoft, presented a potential existential threat to password managers. Dashlane, however, chose to embrace this shift, joining the FIDO Alliance board to actively shape the future of identity. They were among the first password managers to support passkeys across all platforms, even developing a master password-less account creation option. They also contributed to the development of the credential exchange standard, facilitating the import and export of credentials between providers.

Finally, innovation from within the organization, often originating from initiatives like hackathons, has driven new security features. Dashlane developed browser-based credential risk detection that identifies weak or compromised passwords typed manually by employees, alerting both the user and the security team. Furthermore, in response to the dramatic increase in AI phishing attacks (a reported 4,000% increase with a 50% success rate since the rise of tools like ChatGPT), Dashlane deployed models within the browser to detect phishing websites, providing real-time protection against sophisticated social engineering threats.

Demo / Proof of Concept

▶ Watch: Initial platform choice: Native apps due to browser immaturity (4:40)

While Frederic Rivain's talk was rich with technical details and strategic insights, it did not feature a live technical demo or proof of concept in the traditional sense. The presentation focused on sharing historical lessons, architectural decisions, and product evolution rather than showcasing specific functionalities in real-time. Rivain did, however, briefly show a clip of a Super Bowl advertisement, which he humorously described as a "massive mistake" due to its timing weeks before the COVID-19 pandemic hit in February 2020. This ad, while a marketing effort, was not a technical demonstration of Dashlane's capabilities. The innovative features discussed, such as credential risk detection and AI phishing detection in the browser, were presented conceptually as outcomes of internal innovation and engineering efforts.

Defensive Implications

▶ Watch: iOS data loss disaster of 2014 and update mechanism lesson (5:20)

The lessons from Dashlane's decade-long journey offer critical defensive implications for both organizations developing security products and those consuming them.

For product developers and security engineers, the paramount takeaway is the non-negotiable value of a zero-knowledge architecture. While technically challenging, it fundamentally shifts the trust model, minimizing the impact of potential breaches on user data. Moreover, investing in robust and secure update mechanisms is as critical as the core product's security, as demonstrated by the iOS data loss disaster. Proactive cryptographic upgrades, like the migration from PBKDF2 to Argon2, are essential to stay ahead of evolving attack techniques and computational power. It's also crucial to understand and adapt to platform ecosystems (e.g., Chrome's Manifest V3), recognizing that these external factors are part of the product's threat model.

For organizations deploying and using identity solutions, Rivain's emphasis on balancing security with usability is key. High-friction security measures, no matter how robust, often lead to user circumvention. Products that integrate seamlessly and offer convenience, such as Dashlane's passkey support and master password-less options, are more likely to achieve widespread adoption and thus enhance overall security posture. The discussion on confidential computing highlights a significant defensive opportunity for companies handling sensitive data, particularly in healthcare or education. Leveraging hardware secure enclaves in the cloud enables "encryption in use," protecting data even during processing, thereby extending the zero-knowledge principle beyond the device.

Furthermore, the talk underscored the importance of fostering internal innovation. Dashlane's credential risk detection and AI phishing detection features, born from hackathons and team initiatives, demonstrate how empowering engineers to explore new solutions can lead to powerful defensive tools. Organizations should create similar "pockets of innovation" to address emerging threats, such as the 4,000% increase in AI phishing attacks with a 50% success rate. Finally, Rivain advocated for embracing "secure by design" principles, urging commitment to initiatives like the CISA secure by design pledge. This involves embedding security considerations from the outset of product development, rather than as an afterthought, and establishing internal risk committees to make informed trade-offs between speed, features, and security, aiming to consistently reduce risk over time.

Key Takeaways

• Trust is Multidimensional: Building and scaling trust in a security product requires attention to technology, company culture, leadership decisions, and organizational integrity, not just cryptographic strength.
• Zero-Knowledge Architecture is Foundational: A commitment to never accessing user data in cleartext is crucial for secret products, even if it adds significant engineering complexity and troubleshooting challenges.
• Adapt to Platform Evolution: Be prepared for continuous re-engineering due to changes in operating systems, browser architectures (e.g., Chrome Manifest V2 to V3), and industry standards; sometimes, sunsetting legacy platforms (e.g., native desktop apps) is a necessary strategic move.
• Proactive Security & Innovation: Stay ahead of the curve with cryptographic upgrades (e.g., PBKDF2 to Argon2), embrace disruptive technologies like passkeys, and foster internal innovation (e.g., hackathons) to develop new defenses against emerging threats like AI phishing attacks.
• Balance Usability and Security: Strive for solutions that offer both strong security and high user convenience, as friction often undermines adoption and overall security effectiveness.
• Strategic Agility is Key: Be willing to make tough decisions, such as pivoting business models (e.g., B2C to B2B) or retiring features that are difficult to scale, to ensure long-term sustainability and focus.

About the Speaker(s)

Frederic Rivain is the Chief Technology Officer (CTO) at Dashlane, where he has been instrumental in shaping the company's technological vision and security architecture for nearly a decade. Prior to his tenure at Dashlane, which he was set to celebrate 10 years at in November, he gained diverse experience across various industries, including online gambling, video games, and e-commerce. Throughout his career, Rivain has consistently focused on the critical importance of trust in product development. At Dashlane, he has led the engineering efforts to scale the product from a consumer password manager to a comprehensive enterprise credential security platform, upholding a strong commitment to zero-knowledge architecture while navigating complex technical challenges and industry shifts. His insights reflect a deep understanding of both the technical intricacies and the broader organizational and cultural aspects of building secure and trusted digital identity solutions.