The state of passwordless auth on the web
summary
Passwords remain brittle: surveys show 52% reuse sometimes, 13% reuse always and only 24% use a password manager, so credential stuffing keeps working. The web now offers concrete alternatives: WebAuthn and the Credential Management API (use navigator.credentials.get / .store for passwords and OTPs), WebOTP for SMS autofill, and synced passkeys (platform authenticators + Apple/Google sync) with QR fallbacks — implement passkeys first, keep password+2FA as fallback, and offer multiple keys per account.
AI-written summary · about
chapters (12)
- 0:00Passwordless authentication intro
- 8:28Passwords security and UX failure
- 13:01Credential Management API
- 17:58Two-factor authentication limits
- 22:51Improving 2FA with OTP autofill
- 27:44Security keys and WebAuthn
- 33:26Magic links friction
- 35:32Passkeys future of auth
- 41:19Passkeys across devices
- 45:15Passkey adoption challenges
- 48:30Implementing passkeys today
- 50:18Q&A
