Why FIDO Security Keys & Webauthn are Awesome

on YouTube ↗47m

" summary

FIDO/WebAuthn replaces passwords with public‑key auth: servers store a public key, devices keep a private key and sign server challenges. Hardware comes as USB/NFC/Bluetooth dongles or built‑in secure enclaves with biometrics; protocols are CTAP1 and CTAP2 under WebAuthn. Practical notes: GitHub and Google support keys, SoloKeys and YubiKeys work, server code needs to handle array buffers and a 19‑step verification (an 850‑line example patch), and store credential ID and signature count to detect clones. iOS support is still catching up.

AI-written summary · about

" chapters (17)

1. 0:00Intro
2. 0:35About Jen
3. 2:41Authentication
4. 11:09Public Key Cryptography
5. 12:21Registration Authentication
6. 14:21Hardware
7. 15:28Hardware Enclave
8. 16:36Protocols
9. 19:41Hardware Authenticators
10. 21:37Registration
11. 23:27Gmail
12. 25:45Directory
13. 26:44Security
14. 27:02Client Libraries
15. 28:46Webauthn
16. 29:47Browser API
17. 41:49Lost Keys

" related talks

• 33mNavigating Passwordless Authentication with FIDO2 & WebAuthnJerrod Chong · BSidesSF 2019
• 29mWebAuthn and security keys - unlocking the key to authenticationChristiaan Brand · PasswordsCon 2018 Stockholm
• 01h 14mWebAuthn: Theory and practiceMartin Splitt, Semyon Levenson · HolyJS 2020 Moscow
• 56mPasskeys 101: Technical Principles of FIDODavid Turner · Authenticate 2024
• 33mSimple. Open. Mobile: A Look at the Future of Strong AuthenticationJerrod Chong · BSidesSF 2018
• 29mWhat the Authn? Passkeys Offer a Fresh Take to Authentication DilemmasDerek Hanson · RSA Conference 2023
• 30mHow FIDO U2F Security Keys WorkJen Tong · DevOpsDays Seattle 2018
• 27mWebAuthn, Yubikeys, and You: What we wish we knew before...Alex Toombs · BSidesSF 2023