Passwords are Dead, Long live Passkeys!
summary
Passkeys replace passwords by generating a public/private keypair in a local authenticator (Windows Hello, phone or password manager) and sending only the public key to the site; authentication signs a server challenge with the private key. Demos use WebAuthn, passkeys.is and webauthn.me, with QR + Bluetooth device pairing to register other devices and OnePassword to sync keys. Flow works smoothly on Windows and browser demos; Android third‑party sync breaks during the talk and synced private keys remain a realistic attack surface. Phishing‑resistant but not zero‑risk.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:49Passwords fail despite strengths
- 3:56Human weaknesses in passwords
- 6:23Limitations of multi-factor authentication methods
- 9:30Hardware tokens and biometrics flaws
- 12:39Introducing passkeys
- 14:07Passkey registration demo
- 23:52Passkey goals: speed, convenience, security
- 33:36Passkey authentication deep dive
- 41:24Passkey security risks
- 46:52Fishing resistance and domain binding
- 49:01WebAuthn flow demo
- 51:50Resources and learning
