Going Passwordless
summary
Passwords are insecure: a cited dataset contains 517 million hashes and password rules only encourage reuse. Practical alternatives shown include email magic links (used by Slack and Medium) implemented via Django's password-reset token flow, and WebAuthn/U2F using py_webauthn with stored credential ID, public key, and sign count. A demo registers and logs in with a YubiKey, and Google reports U2F protects 85,000 employees from phishing for a year.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 0:52Password Rules
- 2:30Data Breach
- 3:02Password Manager
- 3:55TwoFactor Authentication
- 4:58Get rid of passwords
- 5:12SSL certificates
- 6:17Mozilla Persona
- 6:33Single SignOn
- 7:29Authentication
- 9:28Login Token
- 10:57Check Token
- 11:38Web Authentication
- 13:22Database
- 14:06Views
- 15:20Bundle
- 15:42Verification
- 16:15Login
- 17:12Demo
- 17:26Registration
- 18:14Logging In
- 18:26Logging In Again
- 18:36No Passwords
- 18:49Advantages
- 20:45Quote
related talks
38mForgot Password? Yes I Did!
47mPasswordless Web
17mGoing Beyond Passwords: The Future of User Authentication
47mThe state of passwordless auth on the web
51mThe state of passwordless auth on the web
30mThe State of Passwordless Auth on the Web
30mGoing Beyond Passwords: The Future of User Authentication
32mPasswords are so 1990