Make your authentication flow perfect
summary
Research finds roughly 25% of users drop at authentication and simple fixes move that needle: add ratings and transparent copy, postpone phone collection, and use proper HTML (labels, autocomplete, inputmode) so browsers autofill. Implementations use navigator.credentials.get with mediation: "silent" to auto-login when one credential exists, and WebOTP SMS with domain hash for zero‑input codes. WebAuthn/FIDO2 flows require base64izing buffers and a server challenge roundtrip; demos work on Blink/Android but not yet on WebKit/iOS.
AI-written summary · about
chapters (16)
- 0:00Start
- 1:30How Did You Come Up with the Talk Topic
- 4:13Perfect Authentication Flow
- 5:41How We Can Improve Trust
- 13:03Autocomplete New Password
- 16:34Text Message Forwarding
- 17:28How Exactly Sms Parsed on Ios
- 24:14Google Password Manager
- 28:11Credential Management Specification
- 35:06Silent Mediation
- 40:04Prevent Silent Access
- 40:34Cross-Platform Logging
- 41:48Federated Credential
- 45:59Pre-Requirements for Using Sms on Chrome on Android
- 1:08:57The Cross-Platform Authentication Feature How Does It Work
- 1:11:13Google Account Synchronization
related talks
47mThe state of passwordless auth on the web
51mWeb APIs for delightful two factor auth experiences
27mTips for Painless Passwordless
31mWeb Authentication - Imagine a World Without Passwords
41mThe state of passwordless auth on the web
47mPasswords are so 1990
34mThe Web Authentication API - Imagine a World Without Passwords
01h 14mWebAuthn: Theory and practice