Authentication and Beyond Using FIDO and Push Notifications
summary
eBay implements FIDO + Push Notifications to replace passwords on mobile and extend phishing‑resistant keys to web via a push delivery flow, enrolling a device key pair (private stays on device) and approving logins by signing a short‑lived transaction identifier. Deployment reaches millions across 134 million customers in 190 countries, is open sourced, solves mobile biometric and MFA use cases, and exposes real issues: backup factors, key rotation and cross‑domain web limits.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:02Outline
- 1:56Authentication @ eBay
- 3:53What we are aiming for?
- 5:36Then comes FIDO
- 6:40Options for other platforms?
- 7:19Why Push Notifications?
- 8:14Architecture
- 8:43Registration
- 11:12Deep dive
- 12:53MFA simplified
- 15:16Framework in action
- 16:05Beyond Just Authentication
- 18:16Wait, but what about WebAuthn?
- 18:59Approach
- 20:02Challenges again!
- 22:10Let's summarize
- 23:13What can you do next?
related talks
02h 22mFIDO 101
01h 00mFeatured Keynote
19mProtect your company with FIDO2 authentication
24mAchieving strategic outcomes with FIDO: The phishing-resistant user
24mJourney to Implement FIDO
34mFIDO Welcome Address
56mPasskeys 101: Technical Principles of FIDO
33mSimple. Open. Mobile: A Look at the Future of Strong Authentication