World Congress 2026 Europe • Jul 9, 2026 • Session details

Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls

Are passkeys truly phishing-resistant? Discover how flawed configurations undermine WebAuthn and learn to integrate secure identity providers without building everything from scratch.

Pause

Mute

Enter Fullscreen

#1 about 5 min

Why traditional multi-factor authentication fails against modern phishing

Proxy-based attacks can easily intercept time-based one-time passwords to bypass traditional multi-factor authentication.

#2 about 4 min

How passkey architecture provides built-in phishing resistance

Passkeys tie credentials directly to origin domains and utilize cryptographic signatures to eliminate interceptable secrets.

#3 about 6 min

Enabling and managing passkey authentication using Keycloak domains

Developers can register and handle hardware-bound or cross-platform passkeys directly through identity providers like Keycloak.

#4 about 3 min

Configuring the relying party identifier to prevent subdomain takeovers

Restricting the authentication domain prevents attackers from exploiting dangling subdomains to compromise broad passkey scopes.

#5 about 2 min

Enforcing local user verification to prevent physical proximity attacks

Requiring strict biometric unlock steps blocks unauthorized authentication attempts from a nearby connected mobile device.

#6 about 6 min

Evaluating authenticator attestation and utilizing the metadata service

Verifying manufacturer certificates against a global database ensures that only trusted authenticator models are accepted.

#7 about 3 min

Phasing out passwords and managing passkey account recovery

Transitioning users entirely away from passwords requires secure fallback mechanisms like magic links for lost hardware devices.

#8 about 5 min

Key integration takeaways and leveraging managed authentication services

Utilizing established identity providers prevents critical implementation flaws while supporting modern cryptographic standards and hardware constraints.

Matching moments

3:49 min

Navigating authentication challenges and third-party password managers

Christian Heilmann

Christian Heilmann +1 · World Congress 2026 North America

3:04 min

Defending against phishing with hardware passkeys

Christoph Menzel

Christoph Menzel · World Congress 2026 Europe

3:17 min

Platform integration and synchronization using passkeys

Clemens Hübner

Clemens Hübner · World Congress 2023

4:13 min

Hardware keys and mitigating persistent password vulnerabilities

Chris Heilmann

Chris Heilmann +2 · LIVE

4:32 min

Shifting organizational security toward phishing-resistant authentication standards

Christoph Menzel

Christoph Menzel · World Congress 2026 Europe

1:22 min

Securing application access with WebAuthn and physical FIDO keys

Gift Egwuenu · World Congress 2023

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Upcoming sessions on this topic

Shipping MCP to Real Users: Scaling, Auth, and the PII Leak You Didn't See Coming

Hadar Geva

Myop

CTO & Co-founder

Supply Chain Security for the Everyday Engineer

Pradumna Saraf

Kestra Technologies

Quality Assurance Engineer

Beware of Strangers Bearing Code: Open Source Trust in the Agent Era

Vikram Vaswani

Consultant

What I Got Wrong Shipping an MCP Server for Live Infrastructure

Pritesh Kiri

Harness

Developer Relations Engineer

Multi-Cloud Isn't a Project. It's a Side Effect.

Antonio Mendoza Pérez

Temporal Technologies

Staff Developer Success Engineer
Gaurav Thadani

Temporal

Staff Developer Success Engineer

How Google built a Consistent, Global Authorization System with Zanzibar (and you can too!)

Sohan Maheshwar

AuthZed

Lead Developer Advocate

Related videos

Passwordless Web 1.5 thumbnail

LIVE • about 2 years ago

Passwordless Web 1.5

Paweł Łukaszuk

Passwordless future: WebAuthn and Passkeys in practice thumbnail

World Congress 2023 • almost 3 years ago

Passwordless future: WebAuthn and Passkeys in practice

Clemens Hübner

MFA? Game over! Watch your protection collapse – live thumbnail

World Congress 2026 Europe • 3 months ago

MFA? Game over! Watch your protection collapse – live

Christoph Menzel

Going Beyond Passwords: The Future of User Authentication thumbnail

World Congress 2023 • about 3 years ago

Going Beyond Passwords: The Future of User Authentication

Gift Egwuenu

No More Post-its: Boost your login security with APIs thumbnail

World Congress 2024 • about 2 years ago

No More Post-its: Boost your login security with APIs

Alvaro Navarro

Keeping applications secure by evolving OAuth 2.0 and OpenID Connect thumbnail

World Congress 2026 Europe • 3 months ago

Keeping applications secure by evolving OAuth 2.0 and OpenID Connect

Alexander Schwartz

Related articles

CH

Chris Heilmann

The top 200 passwords of 2024 can be cracked in less than a second

Passwords are a pain and with biometric logins, passkeys and other two factor authentication methods should be a thing of the past. In reality, though, a lot of systems still use username and passw...

almost 2 years ago

The top 200 passwords of 2024 can be cracked in less than a second

DC

Daniel Cranney

Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.

Everyone thinks CISOs make the final call on security tools. But in modern software organisations, adoption starts long before the boardroom, inside CI/CD pipelines, developer workflows, and pull r...

8 months ago

A room full of people at a tech conference

BB

Benedikt Bischof

Walking Into The Era of Supply Chain Risks

Welcome to this issue of the WeAreDevelopers Live Talk series. This article recaps an interesting talk by Vandana Verma who introduced the audience interesting topic of supply chain risks.About the...

about 4 years ago

Walking Into The Era of Supply Chain Risks

DC

Daniel Cranney

Understanding and Mitigating Common Web Vulnerabilities

Vulnerabilities exist in many forms on the web, and attackers continue to find creative ways to exploit them. Technological advances like the proliferation of AI are of course exciting nd filled wi...

over 1 year ago

An image with neon lighting featuring a globe and a padlock

From learning to earning

Jobs that call for the skills explored in this talk.

Identity and Access Management - Manager

Philadelphia, PA, United States

Experienced $99k–232k Cyberark Cybercrime IT Management

Identity and Access Management - Manager

Seattle, WA, United States

Experienced $99k–232k Cyberark Cybercrime IT Management

Identity and Access Management - Manager

Tampa, FL, United States

Experienced $99k–232k Cyberark Cybercrime IT Management

Cybersecurity - Identity and Access Management - Sr Manager

Philadelphia, PA, United States

Expert $124k–280k Okta DevOps Cyberark

Identity and Access Management - Manager

Minneapolis, MN, United States

Experienced $99k–232k Cyberark Cybercrime IT Management

Identity and Access Management - Manager

Los Angeles, CA, United States

Experienced $99k–232k Cyberark Cybercrime IT Management