1 of 22

The future is�p4ßw0rdless

@jiripudilοΏ½#posobota

2 of 22

Passwords

πŸ‘Ž

3 of 22

4 of 22

Passwords πŸ‘Ž

  • are inconvenient (https://neal.fun/password-game/)
  • can be weak
  • can be leaked
  • can be shared easily
  • are prone to phishing
  • only represent a single authentication factor

5 of 22

Passkeys

Authentication method built on open standards.

6 of 22

WebAuthn

Public key cryptography.

generates key pair

πŸ—„οΈ

generates challenge

signs challenge

πŸ—„οΈ

stores public key

7 of 22

Passkeys

Specific way of using WebAuthn:

  • userVerification: required
  • residentKey: required
  • authenticatorAttachment: platform

8 of 22

userVerification: required

generates key pair

πŸ—„οΈ

generates challenge

signs challenge

πŸ—„οΈ

stores public key

πŸ‘¨β€πŸ’»

verifies identity

9 of 22

residentKey: required

generates key pair

πŸ—„οΈ

generates challenge

signs challenge

πŸ—„οΈ

stores public key

πŸ‘¨β€πŸ’»

verifies identity

stores metadata

10 of 22

authenticatorAttachment: platform

generates key pair

πŸ—„οΈ

generates challenge

signs challenge

πŸ—„οΈ

stores public key

πŸ‘¨β€πŸ’»

verifies identity

πŸ’»

πŸ’»

stores metadata

11 of 22

Passkeys

🀩

12 of 22

Passwords πŸ‘Ž

  • are inconvenient
  • can be weak
  • can be leaked
  • can be shared easily
  • are prone to phishing
  • only represent a single authentication factor

13 of 22

Passkeys 🀩

  • are super convenient
  • are strong by design
  • can be leaked
  • cannot be shared easily
  • are resistant to phishing
  • combine two authentication factors in a single step

14 of 22

authenticatorAttachment: platform

generates key pair

πŸ—„οΈ

generates challenge

signs challenge

πŸ—„οΈ

stores public key

πŸ‘¨β€πŸ’»

verifies identity

πŸ’»

πŸ’»

stores metadata

15 of 22

16 of 22

17 of 22

18 of 22

19 of 22

20 of 22

21 of 22

22 of 22

Questions?

@jiripudilοΏ½#posobota