Passwords are so 1990 - Sam Bellen - PHP UK 2022
summary
Claims passwordless login replaces passwords using public/private keys, demonstrates registration and login with a Web Authentication API flow (JS calls like navigator.credentials.create and get), and shows actual hardware auth with a YubiKey and Touch/Face ID working against a demo backend. Demos use the webauthn.me debugger, store only public keys, prove phishing resistance and credential verification, and surface real limits: poor credential management, no easy cross‑device key transfer, and the need for backup/fallback authentication.
AI-written summary · about
chapters (9)
- 0:00Start
- 11:17TIPS FOR A GOOD PASSWORD Use a reasonably long password Don't use personal data Don't re-use passwords
- 14:44RELIES ON A SHARED SECRET BETWEEN THE APP AND AUTHENTICATION SERVICE
- 17:05HARDWARE AUTHENTICATOR
- 28:32RESIDENT CREDENTIALS
- 31:28PHISHING RESISTANT
- 32:43USER CREDENTIAL MANAGEMENT
- 33:24CROSS DEVICE CREDENTIALS
- 33:59LOST/STOLEN AUTHENTICATOR DEVICE RECOVERY
