WebAuthn: Theory and practice
summary
WebAuthn (FIDO2) gets implemented end-to-end: registration with navigator.credentials.create and authentication with navigator.credentials.get, storing public keys on the server and using signature challenges; demos show platform authenticators (Touch ID / Windows Hello) and USB security keys working and a browser-only demo app (PetsGram) that mostly signs up and signs in but hits cross‑browser quirks like attestation counter=0 (Safari) and occasional UX fallbacks. SMS/OTP weaknesses and SIM‑swap phishing are measured against true hardware keys; passwordless with resident keys appears feasible.
AI-written summary · about
chapters (15)
- 0:00Start
- 13:55Multi-Factor Authentication
- 15:27Security Key
- 16:30Sim Duplication Method
- 19:06Web Authentication Api
- 19:55Authenticator
- 20:58Relying Party
- 25:48Authentication
- 32:56User Verification
- 35:51Does this Pose the Same Risk as an Email
- 41:55What Is the Advantages of the Current Approach
- 44:49Otp Based on Time
- 49:36Implement Bypassing
- 1:01:29Server Errors
- 1:05:34Demo
related talks
40mWebAuthn 201: How to FIDO
42mBeyond Passwords: How WebAuthn Actually Works
33mNavigating Passwordless Authentication with FIDO2 & WebAuthn
29mWebAuthn and security keys - unlocking the key to authentication
30mWebAuthn Rocks! Stop authenticating as if it were the 60s
45mSecure your application with WebAuthn
27mSay Goodbye to Passwords and Hello to WebAuthn
47mWhy FIDO Security Keys & Webauthn are Awesome