Running your Django WebAuthN service
summary
Demo shows a working passwordless flow: a Django relying party generates one-time challenges stored in a volatile cache, passes options to the browser which uses SimpleWebAuthn (with a Python wrapper called pywebauthn SDK in the demo) to talk to authenticators, then verifies responses and updates the credential and sign count. Sign count is enforced as signCount anti-cloning. Claims: reduces phishing and shared-secret risks; numbers cited—76% of orgs targeted by ransomware in 2022, 64% infected, LastPass leaked 33M accounts; Wingate rolls this to production after teething problems.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:38Agenda
- 1:09Demo
- 2:36Concepts
- 4:17Ceremony
- 11:19Authentication
- 17:35JavaScript
- 19:52Recap
- 20:34Why is it important
- 22:13Better user experience
- 26:20Questions
related talks
21mGoing Passwordless
40mGoing passwordless with Web Authentication
46mPassword-less apps: implementing WebAuthN
30mThe State of Passwordless Auth on the Web
34mThe Web Authentication API - Imagine a World Without Passwords
45mPassword-less apps: implementing WebAuthN
39mGo Passwordless with WebAuthn in Ruby
20mWebAuthn: The Revival of Authentication