Passwords are so 1990?
summary
Passwords are brittle and replaceable by key-based login using the web authentication API, which creates a private/public keypair on hardware authenticators or on-device secure chips and exchanges challenges via navigator.credentials.create/get. Registration stores only a public key (or a resident credential on the device); authentication signs a server challenge. Works in modern browsers (including Safari 13) and is already supported by Google, GitHub and Dropbox, but devices are bound to hardware so recovery needs a second factor and cross-device sync remains unsolved.
AI-written summary · about
chapters (10)
- 0:00Introduction and welcome
- 2:45Why I hate passwords
- 4:09History of passwords
- 6:59Types of passwords
- 9:49Problems with passwords
- 13:19Passwordless solutions
- 18:34Web Authentication API
- 24:59How WebAuthn works
- 30:32Issues and future of WebAuthn
- 32:35Summary and Q&A
