Using FIDO authentication to defend against account takeover
summary
A simple Node.js/HTML app moves from username/password to WebAuthn/FIDO2 using an OIDC-based passwordless SDK, client ID/secret and a back-end passwordless service; registration creates a device-bound private key, the app stores the public key and then verifies signed challenges for login. A runtime risk-based registration check blocks a tampered demo browser until disabled; after that biometric registration and passwordless login complete successfully. Notes include passkeys synced across vendor clouds and a cited rollout target of 200 million users across 160 countries.
AI-written summary · about
chapters (9)
- 0:00Introduction to Fido
- 1:26The user lifecycle and risks
- 4:47Fido standards and architecture
- 7:22How Fido authentication works
- 10:30Registration and login process
- 14:02Introduction to passkeys
- 15:56Best practices for passwordless
- 25:24Passwordless implementation demo
- 35:53Adoption and final thoughts
related talks
01h 14mWebAuthn: Theory and practice
33mNavigating Passwordless Authentication with FIDO2 & WebAuthn
43mPasswordless: a story of risk, protection and excellent UX
40mWebAuthn 201: How to FIDO
31mWeb Authentication - Imagine a World Without Passwords
38mJourney to passwordless
34mPasswordless: a story of risk, protection & excellent UX
47mPasswordless Web