WebAuthn Rocks! Stop authenticating as if it were the 60s
summary
WebAuthn is now a W3C Candidate Recommendation and implements strong, browser-side authentication using public key cryptography via the JavaScript credential API (create/get). Registration sends a server challenge, the authenticator (YubiKey, Google Titan, Windows Hello, phone/NFC, TPM-backed PIN/fingerprint) generates a key pair, keeps the private key on-device, and returns a public key; authentication signs a fresh challenge and verifies it server-side. Demo uses the browser debugger with USB/NFC keys and fingerprint, shows origin binding prevents phishing, and cites passwords cause ~80% of breaches, 90 accounts average, 51% reuse.
AI-written summary · about
chapters (9)
- 0:00Introduction and speaker intro
- 2:56Passwords in the 60s and risks today
- 7:13What is WebAuthn explained
- 10:47WebAuthn as second factor
- 12:16How WebAuthn works technically
- 17:20Types of authenticators demo
- 21:51WebAuthn implementation and benefits
- 26:50Browser support and demo
- 27:57Q&A and closing
related talks
20mWebAuthn: The Revival of Authentication
26mWebAuthn 101 - Demystifying WebAuthn
44mWebAuthn: Strong Authentication vs Privacy vs Convenience
01h 14mWebAuthn: Theory and practice
53mUser-friendly, phishing-proof 2FA with WebAuthn
18mA Developers Guide to WebAuthn
29mWebAuthn and security keys - unlocking the key to authentication
27mSay Goodbye to Passwords and Hello to WebAuthn