WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe • Jul 9, 2026 • Session details

Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls

Martina Kraus

Are passkeys truly phishing-resistant? Discover how flawed configurations undermine WebAuthn and learn to integrate secure identity providers without building everything from scratch.

Pause
Mute Enter Fullscreen
#1 about 5 min

Why traditional multi-factor authentication fails against modern phishing

Proxy-based attacks can easily intercept time-based one-time passwords to bypass traditional multi-factor authentication.

#2 about 4 min

How passkey architecture provides built-in phishing resistance

Passkeys tie credentials directly to origin domains and utilize cryptographic signatures to eliminate interceptable secrets.

#3 about 6 min

Enabling and managing passkey authentication using Keycloak domains

Developers can register and handle hardware-bound or cross-platform passkeys directly through identity providers like Keycloak.

#4 about 3 min

Configuring the relying party identifier to prevent subdomain takeovers

Restricting the authentication domain prevents attackers from exploiting dangling subdomains to compromise broad passkey scopes.

#5 about 2 min

Enforcing local user verification to prevent physical proximity attacks

Requiring strict biometric unlock steps blocks unauthorized authentication attempts from a nearby connected mobile device.

#6 about 6 min

Evaluating authenticator attestation and utilizing the metadata service

Verifying manufacturer certificates against a global database ensures that only trusted authenticator models are accepted.

#7 about 3 min

Phasing out passwords and managing passkey account recovery

Transitioning users entirely away from passwords requires secure fallback mechanisms like magic links for lost hardware devices.

#8 about 5 min

Key integration takeaways and leveraging managed authentication services

Utilizing established identity providers prevents critical implementation flaws while supporting modern cryptographic standards and hardware constraints.

Matching moments

3:04 min

Defending against phishing with hardware passkeys

Christoph Menzel Christoph Menzel · World Congress 2026 Europe

3:17 min

Platform integration and synchronization using passkeys

Clemens Hübner Clemens Hübner · World Congress 2023

4:13 min

Hardware keys and mitigating persistent password vulnerabilities

Chris Heilmann Chris Heilmann +2 · LIVE

4:32 min

Shifting organizational security toward phishing-resistant authentication standards

Christoph Menzel Christoph Menzel · World Congress 2026 Europe

1:22 min

Securing application access with WebAuthn and physical FIDO keys

Gift Egwuenu · World Congress 2023

2:21 min

Improving usability around secure private key custody

John Woods John Woods · World Congress 2024

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail
29:17
3 months ago

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail
19:41
3 months ago

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail
32:06
3 months ago

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail
35:13
3 months ago

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail
24:23
3 months ago

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail
30:26
3 months ago

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Related videos

Passwordless Web 1.5 thumbnail
30:21
LIVE • about 2 years ago

Passwordless Web 1.5

Paweł Łukaszuk

Passwordless future: WebAuthn and Passkeys in practice thumbnail
32:32
World Congress 2023 • almost 3 years ago

Passwordless future: WebAuthn and Passkeys in practice

Clemens Hübner

MFA? Game over! Watch your protection collapse – live thumbnail
28:30
World Congress 2026 Europe • 3 months ago

MFA? Game over! Watch your protection collapse – live

Christoph Menzel

Going Beyond Passwords: The Future of User Authentication thumbnail
27:55
World Congress 2023 • about 3 years ago

Going Beyond Passwords: The Future of User Authentication

Gift Egwuenu

No More Post-its: Boost your login security with APIs thumbnail
16:05
World Congress 2024 • about 2 years ago

No More Post-its: Boost your login security with APIs

Alvaro Navarro

Keeping applications secure by evolving OAuth 2.0 and OpenID Connect thumbnail
24:07
World Congress 2026 Europe • 3 months ago

Keeping applications secure by evolving OAuth 2.0 and OpenID Connect

Alexander Schwartz

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.