WebAuthn: Strong Authentication vs Privacy vs Convenience
summary
WebAuthn replaces shared passwords with origin‑bound public keys, uses hardware-backed private keys, and requires explicit user consent; server code verifies cryptographic challenges and signatures via navigator.credentials.create/get. Duo reports 31% of users click phishing links and 17% submit passwords, motivating this shift. Attestation modes—AAGUID and attestation—trade privacy for device whitelisting. Integrations already exist (eg YubiKey Touch ID Windows Hello) and demos show palm and biometric logins, but account recovery and lost‑device workflows remain unresolved.
AI-written summary · about
chapters (17)
- 0:00Start
- 10:30Scoped
- 16:25Data retrieved from credential creation
- 17:24attestation Object
- 24:24Accessibility
- 25:07Developer Convenience
- 26:01Privacy
- 26:28User Consent
- 31:49None Attestation
- 32:13Indirect Attestation
- 32:35What can relying Parties do?
- 33:38Transport information
- 34:47Lost Devices
- 35:25Relying Parties can insist on user verification
- 35:47The Lost Device Problem
- 36:06Current FIDO recommendations
- 37:03Various proposals for account recovery
related talks
30mWebAuthn Rocks! Stop authenticating as if it were the 60s
26mWebAuthn 101 - Demystifying WebAuthn
20mWebAuthn: The Revival of Authentication
31mWeb Authentication - Imagine a World Without Passwords
53mUser-friendly, phishing-proof 2FA with WebAuthn
01h 14mWebAuthn: Theory and practice
27mSay Goodbye to Passwords and Hello to WebAuthn
45mSecure your application with WebAuthn