Have I Been Pwned - A Passkey Journey
summary
Have I Been Pwned implements WebAuthn passkeys as a faster replacement for magic links, using ASP.NET Core backend, TypeScript client code and GitHub Copilot assistance, plus OnePassword for credential storage. The service stores 959 breaches, ~17.5 billion breach records and ~6 billion unique emails; password hashes exceed 1 billion. Measured results show median login time drops from ~30 seconds with email links to 3 seconds with passkeys. Early issues include missing signature verification, improper user-handle choices and the need to keep magic links as initial/fallback auth; unit tests and fixes are added before rollout.
AI-written summary · about
chapters (12)
- 0:00Have I Been Pwned intro
- 9:55Replace magic links with passkeys
- 11:20How passkeys work
- 14:31Passkey demo
- 18:04Passkey registration details
- 21:58Passkey authentication flow
- 23:20Developing passkeys with AI
- 27:10AI security pitfalls
- 35:13Passkey performance metrics
- 36:57Passkey availability
- 38:20Passkey journey lessons
- 43:16Q&A
related talks
47mPasswordless Web
50mHave I Been Pwned?
53mGoing Passwordless - A Practical Guide to Passkeys in ASP.NET Core
56mGoing Passwordless - A Practical Guide to Passkeys in ASP.NET Core
52mPasswords are Dead, Long live Passkeys!
17mGoing Beyond Passwords: The Future of User Authentication
45mPast Time for Passkeys
30mThe State of Passwordless Auth on the Web