Passkeys on Android
summary
A demo Halloween game called Trick or Treat game illustrates passkeys on Android by actually creating credentials, sending a JSON credentialCreateOptions to an authenticator, and completing a verified server registration in an 11-step server flow (or a 9-step local flow). Code paths use Android CredentialManager and the Ubikit flow, with extensions: a 4 kilobytes largeBlob for portable storage, and a PRF that feeds HKDF to derive an AES key for encrypting larger files; the game demo has a UI crash but the passkey flows work.
AI-written summary · about
chapters (17)
- 0:00Passkeys on Android intro
- 4:03Password security problems
- 6:33What are passkeys
- 8:17Save game state with passkeys
- 10:48Credential create options
- 11:52Authenticator role in passkeys
- 12:54Android credential manager
- 14:17UbiKit credential manager
- 16:24Local passkey storage
- 17:28Passkey extensions
- 18:10Large blob storage
- 20:41Large blob read/write
- 22:30PRF for large data
- 23:54HKDF file encryption
- 26:49UbiKit passkey guide
- 27:54Summary for developers
- 28:15Q&A
related talks
22mPasskeys on Android
26mPasskeys on Android
35mNo More Passwords: How I Got Passkeys Working (Without Losing My Mind)
38mPasswordless App with Passkey
26mMobile UX Best Practices for Passkeys
52mPasswords are Dead, Long live Passkeys!
43mPasskeys in practice: implementing passwordless apps
01h 06mTutorial: Passkeys to the People: Building a Modern MFA Application with Open Source...