World Congress 2023 • Nov 10, 2023

Passwordless future: WebAuthn and Passkeys in practice

Clemens Hübner

Traditional passwords and SMS 2FA are failing modern security standards. Master the navigator.credentials API to implement passkeys and deliver frictionless, phishing-resistant logins across all devices.

Pause

Mute

Enter Fullscreen

#1 about 4 min

Shortcomings of passwords and secondary authentication factors

Traditional memorized secrets and basic two-factor methods remain highly susceptible to phishing.

#2 about 2 min

Exploring possession and biometric authentication factors

Hardware tokens and biometric data provide stronger authentication by removing memorization burdens.

#3 about 2 min

Introduction to the WebAuthn JavaScript API architecture

WebAuthn acts as a standardized browser interface to securely handle challenge-response cryptography without transmitting secrets.

#4 about 2 min

Demonstration of passwordless registration and login

A practical implementation showcases how users interact with hardware keys during the registration and authentication flow.

#5 about 5 min

Understanding WebAuthn registration and authentication ceremonies

The underlying protocol relies on public key cryptography to generate credentials and verify digital signatures.

#6 about 5 min

Browser support timeline and early usability challenges

Despite widespread technical support, initial adoption struggled due to hardware portability limits and user education barriers.

#7 about 4 min

Platform integration and synchronization using passkeys

Major tech ecosystems rebrand webauthn credentials as synchronized passkeys to solve device constraints.

#8 about 2 min

Implementing cross-device login via QR codes

A hybrid mechanism allows secure authentication across device boundaries via proximity and local communication channels.

#9 about 4 min

Accelerating adoption through developer resources and user education

Implementing modern passwordless solutions requires careful planning around ecosystem constraints and guiding users through new workflows.

#10 about 3 min

Handling lost authenticators and future cryptographic standards

Fallback workflows for lost physical tokens rely on traditional email verification protocols while waiting for quantum-resistant updates.

#11 about 2 min

Establishing secure recovery factors without password fallbacks

Registering multiple hardware tokens or ecosystem passkeys prevents complete account lockout during device loss.

#12 about 3 min

Phishing protection and proximity checks for cross-device authentication

WebAuthn strictly binds credentials to originating domains to thwart traditional phishing and man-in-the-middle attacks.

Matching moments

1:53 min

Overcoming barriers to passwordless authentication adoption

Christoph Menzel

Christoph Menzel · WWC Europe 2026

4:13 min

Hardware keys and mitigating persistent password vulnerabilities

Chris Heilmann +2 · LIVE

2:09 min

Replacing traditional website logins with biometric web passkeys

Gift Egwuenu · WWC 2023

3:04 min

Introducing passkeys and the web authentication protocol components

Paweł Łukaszuk · LIVE

1:22 min

Securing application access with WebAuthn and physical FIDO keys

Gift Egwuenu · WWC 2023

2:20 min

Phasing out passwords and managing passkey account recovery

Martina Kraus

Martina Kraus · WWC Europe 2026

More from World Congress 2023

The year 3000, a brief history of Web Development thumbnail

over 2 years ago

The year 3000, a brief history of Web Development

Lorenzo Pieri

Demografie nutzen um jedem Bewerber das passende Angebot zu machen! thumbnail

over 2 years ago

Demografie nutzen um jedem Bewerber das passende Angebot zu machen!

Nathalie Gierth

Guided Memory Management: Rust's Ownership Model thumbnail

over 2 years ago

Guided Memory Management: Rust's Ownership Model

Stefan Baumgartner

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail

over 2 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Building Reliable Serverless Applications with AWS CDK and Testing thumbnail

over 2 years ago

Building Reliable Serverless Applications with AWS CDK and Testing

Raphael Manke

Fifty Shades of Kubernetes Autoscaling thumbnail

over 2 years ago

Fifty Shades of Kubernetes Autoscaling

Mario-Leander Reimer

Upcoming sessions on this topic

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali

World Congress 2026 North America

Securing AI Agent Infrastructure: Identity, Attestation, and Trust at Scale

Abdel Fane

Founder of OpenA2A

Abdel Fane

World Congress 2026 North America

From Software Agents to Physical Devices: Inside the Agentic Hardware Stack

Michael Yuan, Vivian Hu

Michael Yuan

Vivian Hu

World Congress 2026 North America

Responsible AI Architecture with Zero Trust Agents

Ashok Prakash

Staff ML Engineer at Apple

Ashok Prakash

World Congress 2026 North America

It passed auth, then production caught fire

Alex Olivier

Co-founder & CPO @ Cerbos | OpenID AuthZEN Co-chair

Alex Olivier

Related videos

Passwordless Web 1.5 thumbnail

LIVE • almost 2 years ago

Passwordless Web 1.5

Paweł Łukaszuk

Going Beyond Passwords: The Future of User Authentication thumbnail

WWC 2023 • almost 3 years ago

Going Beyond Passwords: The Future of User Authentication

Gift Egwuenu

Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls thumbnail

WWC Europe 2026 • about 1 month ago

Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls

Martina Kraus

MFA? Game over! Watch your protection collapse – live thumbnail

WWC Europe 2026 • about 1 month ago

MFA? Game over! Watch your protection collapse – live

Christoph Menzel

Accelerating Authentication Architecture: Taking Passwordless to the Next Level thumbnail

LIVE • almost 3 years ago

Accelerating Authentication Architecture: Taking Passwordless to the Next Level

Yedidya Schwartz

No More Post-its: Boost your login security with APIs thumbnail

WWC 2024 • almost 2 years ago

No More Post-its: Boost your login security with APIs

Alvaro Navarro

Related articles

CH

Chris Heilmann

The top 200 passwords of 2024 can be cracked in less than a second

Passwords are a pain and with biometric logins, passkeys and other two factor authentication methods should be a thing of the past. In reality, though, a lot of systems still use username and passw...

over 1 year ago

The top 200 passwords of 2024 can be cracked in less than a second

BB

Benedikt Bischof

Native Web Apps: Are We There Yet?

Welcome to this issue of the WeAreDevelopers Live Talk series. This article recaps an interesting talk by Maxim Salnikov who spoke about the development of native web apps. What you will learn:Some...

over 4 years ago

Native Web Apps: Are We There Yet?

CH

Chris Heilmann

Dev Digest 138 - Are you secure about this?

Hello there! This is the 2nd "out of the can" edition of 3 as I am on vacation in Greece eating lovely things on the beach. So, fewer news, but lots of great resources. Many around the topic of sec...

almost 2 years ago

Dev Digest 138 - Are you secure about this?

CH

Chris Heilmann

Dev Digest 115 password beefstew is not Strog/|n0FF

In edition 115 of our Dev Digest we cover how AI changes how code is taught, learn about cryptography, the history of passwords, how the internet is declining and we can play Super Mario on a type ...

about 2 years ago

Dev Digest 115 password beefstew is not Strog/|n0FF

From learning to earning

Jobs that call for the skills explored in this talk.

Principal Software Engineer, Identity

Expert Remote Ruby OAuth OpenID

about 1 month ago

Cyber Security Architect

Experienced Middleware Smart Cards Cyber Security

Staff Developer Advocate, GitHub Security Lab

Experienced $121k–323k Remote Git Github Databases

Penetration Tester / Red team Specialist

Raiffeisen Bank International AG

€47k Linux OAuth Scripting

Security Architect - AI

Oberkochen, Germany

Expert OAuth Terraform AI Platforms

Security Solution Architekt - Schwerpunkt Access Management & Zero Trust

Expert Cyber Security Cloud Computing Information Technology