The Web Authentication API - Imagine a World Without Passwords
summary
Demo shows a website summoning Windows Hello to register a keypair and log a user in, the integration already rolling out to millions. Concrete numbers from Duo Insight matter: 31% click 17% submit on phishing tests. Code-level details include calling navigator.credentials.create and CBOR-decoding attestation to extract the public key; backend verification is nontrivial (spec lists a 17‑point registration procedure). Device loss, attestation checks and key transport are the remaining engineering problems.
AI-written summary · about
chapters (9)
- 0:00Start
- 3:13Fernando Corbato
- 6:13The Morris Worm
- 13:11Glossary
- 13:54Strong
- 14:24Scoped
- 19:14Reading the credential data
- 27:07The server verifies the assertion
- 31:42HACKERS
related talks
31mWeb Authentication - Imagine a World Without Passwords
21mPasswords are so 1990
44mWebAuthn: Strong Authentication vs Privacy vs Convenience
30mThe State of Passwordless Auth on the Web
39mPasswords are so 1990 - Sam Bellen - PHP UK 2022
47mPasswords are so 1990
25mMove over passwords, passkeys are my new best friend!
45mPasswords Are So 1990