Beyond Passwords: How WebAuthn Actually Works
summary
Explains how WebAuthn + CTAP (FIDO2) uses per-site public/private key pairs, shows real JavaScript calls like navigator.credentials.create and navigator.credentials.get, and details the server-generated nonce and relying-party origin check that prevent phishing. Covers hardware token internals (secure crypto coprocessor, non-exportable private keys), the key wrapping optimization, and cloud-synced passkeys.io style stores (Google/Apple/Microsoft) with QR-based cross-device unlocks, tradeoffs in security, UX, and needed backend libraries.
AI-written summary · about
chapters (7)
- 0:00Introduction to WebAuthn
- 1:32How WebAuthn works
- 7:19Registration implementation
- 16:24Authentication implementation
- 19:04Hardware tokens and usability
- 27:16Passkeys and cloud sync
- 36:49The future of passwordless
related talks
27mSay Goodbye to Passwords and Hello to WebAuthn
01h 14mWebAuthn: Theory and practice
20mWebAuthn: The Revival of Authentication
56mPasskeys 101: Technical Principles of FIDO
45mPasswords Are So 1990
18mA Developers Guide to WebAuthn
33mNavigating Passwordless Authentication with FIDO2 & WebAuthn
40mWebAuthn 201: How to FIDO