Passwordless zero-knowledge services
summary
Claim: password managers can ditch master passwords by combining a low-entropy PIN with device possession and server-assisted cryptography so the client reconstructs a high-entropy key while the server learns nothing. Implementation uses QR-style device bootstrapping like WhatsApp and an OPAQUE or augmented protocol to enable attempt limits for browser extensions. Big unsolved points are provisioning, account recovery, and shared access; a proposed pattern is shared-by-reference cloud enclave hosting private keys. Dashlane reports PIN auth becomes much more reliable for users.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:06Zero-knowledge password managers
- 2:56Passkeys adoption challenges
- 4:01Password manager security flaws
- 6:10Passkeys vs password managers
- 7:56Passwordless authentication model
- 10:01Passwordless challenges
- 11:30Account recovery solutions
- 13:14Browser extensions security
- 15:21Passwordless implementation
- 16:27Q&A session
- 16:47Recovery protocol standards
- 18:32UX and adoption hurdles
- 20:58Zero-knowledge protocol
- 21:20Shared passkeys access
- 24:33Device pin security
- 27:23Closing remarks
related talks
47mPasswordless Web- 47mPasswordless Web
59mPasswordless Future: Using WebAuthn And Passkeys In Practice
34mPasswordless: a story of risk, protection & excellent UX
38mPasswordless App with Passkey
47mThe state of passwordless auth on the web
41mOur future without passwords
47mPasswordless apps: Passkeys in practice