Shift into high gear: Answering common questions to help you get off the starting line
summary
Explains the concrete difference: WebAuthn is the browser API and passkeys are an opinionated, discoverable-credential use of WebAuthn; shows real registration objects from iCloud passkeys and a YubiKey so you can see backup eligibility and backup state change when keys are syncable vs non-exportable. Describes flags to check (UP, UV), why to request attestation, and how to verify AAGUID against the FIDO Metadata Service or the new convenience metadata to enforce or report authenticator capabilities.
AI-written summary · about
chapters (9)
- 0:00Introduction and presenters
- 0:47WebAuthn vs Passkeys explained
- 3:36Key terminology and acronyms
- 7:51Registration object breakdown
- 10:41Developer control in WebAuthn
- 14:15Role of attestation in security
- 18:12Using attestation metadata
- 20:21Metadata service variants
- 21:45Conclusion and Q&A note
related talks
29mWhat the Authn? Passkeys Offer a Fresh Take to Authentication Dilemmas
44mWebAuthn: Strong Authentication vs Privacy vs Convenience
42mBeyond Passwords: How WebAuthn Actually Works
47mWhy FIDO Security Keys & Webauthn are Awesome
33mNavigating Passwordless Authentication with FIDO2 & WebAuthn
31mGetting Started with Passkeys and WebAuthn
01h 14mWebAuthn: Theory and practice
29mWebAuthn and security keys - unlocking the key to authentication