Web Authentication: From Draft To Product

on YouTube ↗25m

" summary

Duo is rolling WebAuthn to millions within weeks and describes an extendable WebAuthN backend, production JavaScript that parses CBOR attestation objects, and Go/Python reference code from Duo Labs. Integration favors Chrome 70 Touch ID first, uses a decision engine to pick platform vs cross‑platform authenticators, and works around iframe restrictions with a pop-up. Engineering pain points include six attestation formats, CBOR/COSE parsing, many signature algorithms, and incremental rollout by browser, attestation type and algorithm.

AI-written summary · about

" chapters (8)

1. 0:00Introduction
2. 0:29Why Web Authentication
3. 2:30What is Web Authentication
4. 9:28Working with Web Authentication
5. 15:53Public Key Cryptography
6. 18:15TPM
7. 21:37User Experience
8. 22:23Looking Ahead

" related talks

• 44mWebAuthn: Strong Authentication vs Privacy vs ConvenienceSuby Raman · OWASP Global AppSec Amsterdam 2019
• 31mWeb Authentication - Imagine a World Without PasswordsSuby Raman · NodeJs Day 2019
• 01h 14mWebAuthn: Theory and practiceMartin Splitt, Semyon Levenson · HolyJS 2020 Moscow
• 34mThe Web Authentication API - Imagine a World Without PasswordsSuby Raman · Full Stack Fest 2018
• 30mWebAuthn Rocks! Stop authenticating as if it were the 60sRuben Restrepo · revo.js 2019
• 20mWebAuthn: The Revival of AuthenticationThomas Blaisot · DevFest Lille 2019
• 26mWebAuthn 101 - Demystifying WebAuthnChristiaan Brand · Black Hat USA 2019
• 42mBeyond Passwords: How WebAuthn Actually WorksEli Holderness · GOTO Amsterdam 2023