WebAuthn: The Revival of Authentication
summary
Explains how passwordless authentication becomes practical with asymmetric cryptography: the server issues a challenge, an authenticator signs it with a private key, and the server verifies with a stored public key. Covers the WebAuthn API and CTAP, platform authenticators (Windows/Android) and roaming ones (USB/Bluetooth/NFC), required ArrayBuffer-to-base64 conversion, handling multiple credentials per user, progressive browser support (Chrome often behind a flag), and affordable hardware keys (~€15–60) that prevent phishing and replay attacks.
AI-written summary · about
chapters (13)
- 0:00Modern auth intro
- 1:18Auth vs authorization
- 2:43Three auth factors
- 3:43Current auth problems
- 5:07WebAuthn origins and flow
- 7:18User registration demo
- 9:27Server security and data
- 10:54Client setup and limits
- 13:03WebAuthn login process
- 15:30Anti-phishing and attacks
- 16:57Server validation checks
- 17:39Authenticator types
- 18:42WebAuthn adoption
related talks
30mWebAuthn Rocks! Stop authenticating as if it were the 60s
18mA Developers Guide to WebAuthn
26mWebAuthn 101 - Demystifying WebAuthn
42mBeyond Passwords: How WebAuthn Actually Works
44mWebAuthn: Strong Authentication vs Privacy vs Convenience
01h 14mWebAuthn: Theory and practice
45mSecure your application with WebAuthn
27mSay Goodbye to Passwords and Hello to WebAuthn