Tutorial: Passkeys to the People: Building a Modern MFA Application with Open Source...
summary
Claim: passkeys replace passwords and provide phishing‑resistant, origin‑bound authentication. The session builds a working example app using Spring Boot + Yubico library, Keycloak + MySQL, a React client and Docker deployment, demonstrates registration and assertion flows (Touch ID, security key, virtual authenticator), and shows APIs, DB schema storing only public keys, and invalidating one‑time challenges. Demo registers and authenticates accounts successfully; guidance covers resident vs copyable passkeys, attestation/assertion payloads, and practical recovery/backup tradeoffs.
AI-written summary · about
chapters (19)
- 0:00Passkeys and modern MFA
- 1:43Deploying passkey app
- 3:10What passkeys are
- 8:49How passkeys work
- 13:23Copyable vs device-bound passkeys
- 13:44Passkey app architecture
- 17:37Relying party and identity provider
- 19:46Passkey registration flow
- 22:10Passkey authentication flow
- 23:14Passkey management API
- 24:37WebAuthn API options
- 30:53Passkey storage security
- 37:14Passkey storage schema
- 41:08Client implementation
- 47:51Autofill vs button auth
- 50:22Live demo: registration
- 55:18Live demo: authentication
- 57:48Passkey resources
- 58:50Closing and Q&A
related talks
51mA Passwordless Future! Passkeys for Java Developers
52mA Passwordless Future! Passkeys for Java Developers
43mPasskeys in practice: implementing passwordless apps
37mA Passwordless Future! Passkeys for Java Developers
16mThe end of forgotten passwords - Biometric Authentication
28mPasskeys: Goodbye Passwords, Hello Frictionless Security!
39mNo passwords, no problem: move beyond passwords with webauthn and passkeys
55mYou Shall Not Password: Modern Authentication for Web Apps