WebAuthn 201: How to FIDO

on YouTube ↗40m

" summary

Covers practical steps to add phishing‑resistant and passwordless logins using FIDO2/WebAuthn and CTAP, with concrete API calls, browser behavior and device types. Shows when to use isUserVerifyingPlatformAuthenticatorAvailable to detect platform biometrics, how to register and authenticate via navigator.credentials.create and navigator.credentials.get, when to set requireResidentKey for username‑less UVRA keys, and how CaBLE/BLE transports enable phone‑based roaming credentials.

AI-written summary · about

" chapters (10)

1. 0:00Introduction to FIDO
2. 1:04WebAuthn and CTAP protocols
3. 2:54Phishing protection mechanisms
4. 6:27Types of authenticators
5. 11:07Authentication best practices
6. 14:27Platform biometric login
7. 19:09Roaming hardware security keys
8. 23:21Resident keys and registration
9. 29:57Multi-device authentication
10. 35:44Next steps and resources

" related talks

• 01h 14mWebAuthn: Theory and practiceMartin Splitt, Semyon Levenson · HolyJS 2020 Moscow
• 33mNavigating Passwordless Authentication with FIDO2 & WebAuthnJerrod Chong · BSidesSF 2019
• 42mBeyond Passwords: How WebAuthn Actually WorksEli Holderness · GOTO Amsterdam 2023
• 33mSimple. Open. Mobile: A Look at the Future of Strong AuthenticationJerrod Chong · BSidesSF 2018
• 29mWebAuthn and security keys - unlocking the key to authenticationChristiaan Brand · PasswordsCon 2018 Stockholm
• 41mUsing FIDO authentication to defend against account takeoverRaj Galagali, Balu Santhosh · Authenticate 2022
• 20mWebAuthn: The Revival of AuthenticationThomas Blaisot · DevFest Lille 2019
• 56mPasskeys 101: Technical Principles of FIDODavid Turner · Authenticate 2024