WebAuthn 101 - Demystifying WebAuthn
summary
WebAuthn is now a W3C-recommended way to stop phishing by signing a server challenge plus the current web origin with a key that never leaves the device, proven on USB/NFC/Bluetooth local channel hardware keys and on Android 7+ platform authenticator built into phones. Google cites 110 million proactively secured accounts and 4.3 billion leaked credentials motivating this work; studies show ~43% still fall for phishing and 91% of attacks start with it. Yahoo Japan reports a 37.5% sign-in time reduction after adopting platform attestation.
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:42Agenda
- 2:32Statistics
- 6:00Sources of stolen passwords
- 7:54Phishing statistics
- 10:13Multifactor authentication
- 13:36Security keys
- 22:55User journeys
related talks
53mUser-friendly, phishing-proof 2FA with WebAuthn
30mWebAuthn Rocks! Stop authenticating as if it were the 60s
29mWebAuthn and security keys - unlocking the key to authentication
44mWebAuthn: Strong Authentication vs Privacy vs Convenience
20mWebAuthn: The Revival of Authentication
27mSay Goodbye to Passwords and Hello to WebAuthn
01h 14mWebAuthn: Theory and practice
45mSecure your application with WebAuthn