Navigating Passwordless Authentication with FIDO2 & WebAuthn
summary
Explains how FIDO2/WebAuthn replaces passwords with per-site public‑key credentials and hardware or built‑in authenticators (USB/NFC/BLE/platform), already supported in Chrome, Edge, Android and Safari Technology Preview 72, enabling YubiKeys or platform biometrics to register and authenticate with a challenge that includes the origin, blocking phishing. Demonstrates bootstrapping a phone from a roaming key, recommends registering multiple authenticators (two to three minimum), and describes simple server flows (create/authenticate) and transports to implement passwordless at scale.
AI-written summary · about
chapters (14)
- 0:00Introduction and passwordless motivation
- 6:47Why phishing attacks succeed
- 8:55FIDO2 and WebAuthn foundation
- 10:20WebAuthn becomes W3C standard
- 11:44Browser and platform support
- 14:15Live demo of passwordless login
- 17:55How WebAuthn works under the hood
- 21:11Registration and authentication flows
- 24:03Resources and developer tools
- 25:01Q&A: Internal vs external authenticators
- 26:52Q&A: Iframes and WebAuthn
- 27:40Q&A: Common implementation pitfalls
- 29:46Q&A: Can websites eliminate passwords?
- 32:11Summary and privacy benefits
related talks
33mSimple. Open. Mobile: A Look at the Future of Strong Authentication
38mJourney to passwordless
40mWebAuthn 201: How to FIDO
01h 14mWebAuthn: Theory and practice
47mWhy FIDO Security Keys & Webauthn are Awesome
18mA path to a world without passwords
27mSay Goodbye to Passwords and Hello to WebAuthn
45mPasswords Are So 1990