User-friendly, phishing-proof 2FA with WebAuthn
summary
WebAuthn uses browser HTTPS plus authenticators (YubiKey, built‑in phone/laptop keys via CTAP2) to sign origin‑bound challenges so phishing pages fail; demo logs into GitHub with a plugged YubiKey and a Java demo uses webauthn-server and webauthn-json libraries. Google reports zero employee account takeovers and a 92% reduction in support incidents after deploying keys. Features shown: phishing‑resistant origin binding, discoverable (resident) keys for username‑less flows, user verification (PIN/biometric) and optional attestation.
AI-written summary · about
chapters (15)
- 0:00Start
- 2:06What is WebAuthn?
- 4:04Not all 2FA is equal
- 11:27Components
- 14:20Validate the origin - detect fakes
- 16:16Google: Security Keys Neutralized Employee Phishing
- 17:17Recap
- 18:22Background: U2F
- 22:30U2F, FIDO, CTAP, WebAuthn...
- 26:14How to WebAuthn
- 40:44Password 2FA
- 41:11Terrible idea
- 41:37Passwordless 2FA
- 46:47Authenticator data
- 49:18Attestation object
related talks
26mWebAuthn 101 - Demystifying WebAuthn
30mWebAuthn Rocks! Stop authenticating as if it were the 60s
44mWebAuthn: Strong Authentication vs Privacy vs Convenience
29mWebAuthn and security keys - unlocking the key to authentication
27mSay Goodbye to Passwords and Hello to WebAuthn
45mSecure your application with WebAuthn
39mGo Passwordless with WebAuthn in Ruby
47mWhy FIDO Security Keys & Webauthn are Awesome