The state of passwordless auth on the web
summary
Passwords are shown as fragile (52% reuse sometimes, only 24% use a manager) and easily leaked; practical fixes covered include HTML autocomplete, the Credential Management API for one‑click stored logins, Web OTP with the SMS line format that ties codes to a domain, and WebAuthn/public‑key passkeys that are phishing‑resistant. Demos include passkeys that sync via iCloud or fall back to a QR cross‑device flow, browser support gaps (Chrome/Safari ready, Firefox lagging), and implementation details and limits.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:10Passwords are bad
- 7:39User experience
- 8:35Password managers
- 10:06Improvements
- 17:07TwoFactor Authentication
- 21:03Autocomplete
- 23:05Web OTP
- 27:33Web Authentication
- 31:55Getting rid of passwords
- 32:18Magic links
- 33:16Passkeys
- 36:25Passkeys code
- 40:52Platform authenticator
- 42:54Browser support
