WEBVTT

1
00:00:03.615 --> 00:00:04.275
<00:00:03.615>Hi <00:00:04.209>everyone.

2
00:00:04.305 --> 00:00:07.675
<00:00:04.305>Welcome <00:00:04.479>to <00:00:04.654>my <00:00:04.830>talk, <00:00:05.005>um, <00:00:05.180>about <00:00:05.354>the <00:00:05.529>Passwordless <00:00:05.705>future.

3
00:00:08.175 --> 00:00:11.995
<00:00:08.175>Um, <00:00:08.330>yeah, <00:00:08.486>I <00:00:08.641>was <00:00:08.797>already <00:00:08.952>introduced. <00:00:09.108>My <00:00:09.263>name <00:00:09.419>is <00:00:09.575>Clemens.

4
00:00:12.015 --> 00:00:14.475
<00:00:12.015>Uh, <00:00:12.190>I <00:00:12.365>work <00:00:12.540>as <00:00:12.715>a <00:00:12.890>security <00:00:13.065>engineer <00:00:13.240>at <00:00:13.415>Ovex.

5
00:00:14.695 --> 00:00:16.395
<00:00:14.695>We <00:00:14.975>are <00:00:15.255>a <00:00:15.535>software <00:00:15.815>development <00:00:16.094>company,

6
00:00:17.095 --> 00:00:19.515
<00:00:17.095>and, <00:00:17.270>uh, <00:00:17.445>we <00:00:17.619>develop <00:00:17.794>a <00:00:17.970>lot <00:00:18.145>of <00:00:18.320>different <00:00:18.494>software

7
00:00:19.515 --> 00:00:22.515
<00:00:19.515>for <00:00:19.670>different <00:00:19.826>customers, <00:00:19.981>and <00:00:20.137>I <00:00:20.292>try <00:00:20.448>to <00:00:20.603>help <00:00:20.759>our <00:00:20.915>teams

8
00:00:22.775 --> 00:00:26.395
<00:00:22.775>to <00:00:22.915>build <00:00:23.055>secure <00:00:23.195>software, <00:00:23.334>um, <00:00:23.474>so <00:00:23.615>that <00:00:23.755>it <00:00:23.895>can <00:00:24.034>be <00:00:24.174>shipped.

9
00:00:26.815 --> 00:00:30.555
<00:00:26.815>And, <00:00:27.015>um, <00:00:27.215>yeah, <00:00:27.415>I <00:00:27.615>am <00:00:27.815>located <00:00:28.015>in <00:00:28.215>Munich.

10
00:00:30.695 --> 00:00:33.875
<00:00:30.695>Um, <00:00:30.835>I, <00:00:30.975>I <00:00:31.115>lived <00:00:31.255>there <00:00:31.395>for <00:00:31.535>the <00:00:31.675>last <00:00:31.815>five, <00:00:31.955>uh, <00:00:32.095>years.

11
00:00:34.215 --> 00:00:36.995
<00:00:34.215>And, <00:00:34.342>uh, <00:00:34.469>I'd <00:00:34.596>love <00:00:34.724>to <00:00:34.851>take <00:00:34.978>you <00:00:35.105>on <00:00:35.233>a <00:00:35.360>little <00:00:35.487>journey, <00:00:35.615>uh,

12
00:00:37.015 --> 00:00:38.875
<00:00:37.015>to <00:00:37.365>the <00:00:37.715>future <00:00:38.065>of <00:00:38.415>authentication,

13
00:00:39.535 --> 00:00:41.915
<00:00:39.535>but <00:00:39.675>if <00:00:39.815>we <00:00:39.955>want <00:00:40.095>to <00:00:40.235>have <00:00:40.375>a <00:00:40.514>look <00:00:40.654>at <00:00:40.794>the <00:00:40.934>future

14
00:00:41.975 --> 00:00:44.555
<00:00:41.975>of <00:00:42.208>authentication, <00:00:42.441>we <00:00:42.675>have <00:00:42.908>to <00:00:43.141>look, <00:00:43.375>uh,

15
00:00:44.815 --> 00:00:46.275
<00:00:44.815>at <00:00:45.077>the <00:00:45.340>status <00:00:45.603>quo <00:00:45.866>right <00:00:46.129>now.

16
00:00:46.335 --> 00:00:48.915
<00:00:46.335>And <00:00:46.568>if <00:00:46.801>I <00:00:47.035>ask <00:00:47.268>anyone, <00:00:47.501>show <00:00:47.735>me

17
00:00:48.975 --> 00:00:51.035
<00:00:48.975>how <00:00:49.255>would <00:00:49.535>you <00:00:49.815>do <00:00:50.095>an <00:00:50.375>authentication?

18
00:00:51.375 --> 00:00:53.235
<00:00:51.375>How, <00:00:51.575>how <00:00:51.775>does <00:00:51.975>a <00:00:52.175>login <00:00:52.375>form <00:00:52.575>look <00:00:52.775>like?

19
00:00:53.255 --> 00:00:54.675
<00:00:53.255>You <00:00:53.510>would <00:00:53.766>draw <00:00:54.021>something <00:00:54.277>like <00:00:54.533>that.

20
00:00:54.975 --> 00:00:58.555
<00:00:54.975>So <00:00:55.150>a <00:00:55.325>username, <00:00:55.500>a <00:00:55.675>passwordless <00:00:55.850>field, <00:00:56.025>uh, <00:00:56.200>password <00:00:56.375>field.

21
00:00:58.695 --> 00:01:02.995
<00:00:58.695>Um, <00:00:58.850>that's <00:00:59.006>how <00:00:59.161>we <00:00:59.317>did, <00:00:59.472>uh, <00:00:59.628>authentication <00:00:59.783>for <00:00:59.939>almost <00:01:00.095>ever.

22
00:01:03.375 --> 00:01:05.035
<00:01:03.375>So <00:01:03.655>that's, <00:01:03.935>that's <00:01:04.215>the <00:01:04.495>status <00:01:04.775>quo.

23
00:01:05.615 --> 00:01:09.275
<00:01:05.615>And, <00:01:05.755>um, <00:01:05.895>let <00:01:06.035>me <00:01:06.175>ask <00:01:06.315>you, <00:01:06.455>who <00:01:06.595>of <00:01:06.735>you <00:01:06.875>likes <00:01:07.015>passwords?

24
00:01:09.335 --> 00:01:12.715
<00:01:09.335>Who, <00:01:09.535>who <00:01:09.735>likes <00:01:09.935>remembering <00:01:10.135>passwords? <00:01:10.335>Oh, <00:01:10.535>one <00:01:10.735>one.

25
00:01:13.075 --> 00:01:16.475
<00:01:13.075>Password <00:01:13.275>fan. <00:01:13.475>You <00:01:13.675>will <00:01:13.875>be <00:01:14.075>disappointed <00:01:14.275>today. <00:01:14.475>No.

26
00:01:16.615 --> 00:01:20.035
<00:01:16.615>So <00:01:16.770>I <00:01:16.926>think <00:01:17.081>we <00:01:17.237>can <00:01:17.392>all <00:01:17.548>agree <00:01:17.703>that <00:01:17.859>passwords <00:01:18.015>are,

27
00:01:20.625 --> 00:01:21.995
<00:01:20.625>yeah, <00:01:20.871>a <00:01:21.118>pain <00:01:21.364>in <00:01:21.611>the <00:01:21.858>ass.

28
00:01:22.095 --> 00:01:24.115
<00:01:22.095>Um, <00:01:22.328>they <00:01:22.561>are <00:01:22.795>hard <00:01:23.028>to, <00:01:23.261>to <00:01:23.495>remember.

29
00:01:24.615 --> 00:01:27.875
<00:01:24.615>Um, <00:01:24.770>we, <00:01:24.926>we <00:01:25.081>might <00:01:25.237>have <00:01:25.392>some <00:01:25.548>solutions <00:01:25.703>like <00:01:25.859>password <00:01:26.015>managers

30
00:01:27.895 --> 00:01:31.235
<00:01:27.895>to <00:01:28.050>get <00:01:28.206>a <00:01:28.361>bit <00:01:28.517>of <00:01:28.672>this, <00:01:28.828>um, <00:01:28.983>memorizing <00:01:29.139>stuff, <00:01:29.295>um,

31
00:01:31.695 --> 00:01:33.115
<00:01:31.695>um, <00:01:32.334>uh, <00:01:32.973>solved.

32
00:01:33.415 --> 00:01:36.355
<00:01:33.414>But <00:01:33.554>then <00:01:33.695>you'll <00:01:33.835>still <00:01:33.975>have <00:01:34.115>to, <00:01:34.255>to <00:01:34.395>remember <00:01:34.535>one <00:01:34.675>password <00:01:34.815>for,

33
00:01:37.095 --> 00:01:38.555
<00:01:37.095>for, <00:01:37.423>um, <00:01:37.752>the <00:01:38.080>password <00:01:38.409>manager.

34
00:01:38.695 --> 00:01:41.795
<00:01:38.695>And <00:01:38.822>that <00:01:38.949>is <00:01:39.076>because <00:01:39.204>the, <00:01:39.331>the <00:01:39.458>human <00:01:39.585>brain <00:01:39.713>is <00:01:39.840>just <00:01:39.967>not <00:01:40.095>made

35
00:01:41.855 --> 00:01:46.555
<00:01:41.854>for <00:01:42.029>memorizing <00:01:42.204>random <00:01:42.380>strings <00:01:42.554>of <00:01:42.729>a <00:01:42.904>really <00:01:43.079>long <00:01:43.255>length

36
00:01:46.615 --> 00:01:48.995
<00:01:46.615>as <00:01:46.790>we <00:01:46.965>need <00:01:47.140>them, <00:01:47.315>uh, <00:01:47.490>for <00:01:47.665>passwords, <00:01:47.840>uh, <00:01:48.015>today.

37
00:01:49.375 --> 00:01:52.355
<00:01:49.375>And <00:01:49.515>on <00:01:49.655>the <00:01:49.795>other <00:01:49.935>side, <00:01:50.075>as <00:01:50.215>developers, <00:01:50.355>we <00:01:50.495>still <00:01:50.635>need <00:01:50.775>to,

38
00:01:52.695 --> 00:01:54.915
<00:01:52.695>to <00:01:52.975>save <00:01:53.255>the <00:01:53.535>passwords, <00:01:53.815>uh, <00:01:54.095>safely.

39
00:01:55.295 --> 00:01:57.755
<00:01:55.295>And <00:01:55.495>I <00:01:55.695>do <00:01:55.895>a <00:01:56.095>lot <00:01:56.295>of <00:01:56.495>code <00:01:56.695>audits,

40
00:01:57.755 --> 00:02:00.435
<00:01:57.755>and <00:01:57.910>you <00:01:58.066>might <00:01:58.221>think <00:01:58.377>that <00:01:58.532>storing <00:01:58.688>passwords <00:01:58.843>is <00:01:58.999>a <00:01:59.155>solved

41
00:02:00.435 --> 00:02:02.235
<00:02:00.435>problem, <00:02:00.635>but <00:02:00.835>let <00:02:01.035>me <00:02:01.235>tell <00:02:01.435>you, <00:02:01.635>it's <00:02:01.835>not.

42
00:02:02.335 --> 00:02:05.155
<00:02:02.335>So, <00:02:02.684>um, <00:02:03.035>yeah, <00:02:03.384>storing <00:02:03.735>passwords

43
00:02:05.155 --> 00:02:06.795
<00:02:05.155>or <00:02:05.435>password <00:02:05.715>hashes <00:02:05.995>is <00:02:06.275>still <00:02:06.555>something

44
00:02:06.795 --> 00:02:08.155
<00:02:06.795>developers <00:02:07.203>might <00:02:07.611>get <00:02:08.019>wrong.

45
00:02:08.615 --> 00:02:09.715
<00:02:08.615>So <00:02:08.945>in <00:02:09.275>the <00:02:09.605>end,

46
00:02:09.995 --> 00:02:12.435
<00:02:09.995>passwords <00:02:10.195>are <00:02:10.395>getting <00:02:10.595>guessed <00:02:10.795>because <00:02:10.995>they <00:02:11.195>are <00:02:11.395>weak.

47
00:02:12.435 --> 00:02:15.475
<00:02:12.435>They <00:02:12.590>are <00:02:12.746>getting <00:02:12.901>stolen <00:02:13.057>because <00:02:13.212>the <00:02:13.368>backend <00:02:13.523>stores <00:02:13.679>them <00:02:13.835>in

48
00:02:15.475 --> 00:02:16.795
<00:02:15.475>a, <00:02:15.772>in <00:02:16.069>a <00:02:16.366>insecure <00:02:16.663>way.

49
00:02:17.215 --> 00:02:20.435
<00:02:17.215>Um, <00:02:17.370>so <00:02:17.526>it's, <00:02:17.681>it's <00:02:17.837>just, <00:02:17.992>um, <00:02:18.148>a, <00:02:18.303>a <00:02:18.459>big <00:02:18.615>problem.

50
00:02:20.615 --> 00:02:22.515
<00:02:20.615>And <00:02:20.790>how <00:02:20.965>did <00:02:21.140>we <00:02:21.315>solve <00:02:21.490>this <00:02:21.665>in <00:02:21.840>the <00:02:22.015>past?

51
00:02:22.545 --> 00:02:23.955
<00:02:22.545>Yeah, <00:02:22.798>we <00:02:23.052>added <00:02:23.306>a <00:02:23.560>second <00:02:23.814>factor.

52
00:02:24.135 --> 00:02:26.915
<00:02:24.135>So <00:02:24.368>you <00:02:24.601>all <00:02:24.834>know <00:02:25.068>this, <00:02:25.301>having <00:02:25.535>A-T-O-T-P

53
00:02:27.175 --> 00:02:30.355
<00:02:27.175>or <00:02:27.315>maybe <00:02:27.455>getting <00:02:27.595>an <00:02:27.735>SMS <00:02:27.875>to <00:02:28.015>your <00:02:28.155>mobile <00:02:28.295>phone, <00:02:28.435>so <00:02:28.575>your,

54
00:02:30.575 --> 00:02:33.755
<00:02:30.575>so <00:02:30.702>your <00:02:30.829>phone <00:02:30.956>or <00:02:31.084>your <00:02:31.211>SIM <00:02:31.338>card <00:02:31.465>works <00:02:31.593>as <00:02:31.720>a <00:02:31.847>second <00:02:31.975>factor.

55
00:02:34.375 --> 00:02:38.435
<00:02:34.375>Um, <00:02:34.608>and <00:02:34.841>that's <00:02:35.075>better <00:02:35.308>than, <00:02:35.541>than <00:02:35.775>passwords.

56
00:02:38.655 --> 00:02:39.915
<00:02:38.655>Um, <00:02:39.033>um, <00:02:39.411>of <00:02:39.789>course,

57
00:02:40.255 --> 00:02:41.515
<00:02:40.255>but <00:02:40.481>still <00:02:40.708>you <00:02:40.935>need <00:02:41.162>to <00:02:41.388>remember

58
00:02:41.515 --> 00:02:42.635
<00:02:41.515>the <00:02:41.716>password <00:02:41.918>in <00:02:42.119>the <00:02:42.321>first <00:02:42.523>place.

59
00:02:42.655 --> 00:02:45.955
<00:02:42.655>So <00:02:42.830>it's <00:02:43.005>just <00:02:43.180>securing <00:02:43.355>the <00:02:43.530>weak <00:02:43.705>authentication <00:02:43.880>method <00:02:44.055>of,

60
00:02:45.955 --> 00:02:47.715
<00:02:45.954>of <00:02:46.154>passwords <00:02:46.355>a <00:02:46.554>bit, <00:02:46.755>a <00:02:46.954>little <00:02:47.154>bit <00:02:47.355>more.

61
00:02:48.215 --> 00:02:50.355
<00:02:48.215>And <00:02:48.370>also, <00:02:48.526>we, <00:02:48.681>we <00:02:48.837>did <00:02:48.992>not <00:02:49.148>discuss <00:02:49.303>the <00:02:49.459>big <00:02:49.615>problem

62
00:02:50.385 --> 00:02:53.475
<00:02:50.385>that <00:02:50.618>authentication <00:02:50.851>nowadays <00:02:51.084>have, <00:02:51.318>um, <00:02:51.551>of <00:02:51.785>phishing.

63
00:02:53.575 --> 00:02:56.995
<00:02:53.575>So <00:02:53.750>phishing <00:02:53.924>is <00:02:54.100>a <00:02:54.274>big, <00:02:54.450>um, <00:02:54.625>problem <00:02:54.799>in <00:02:54.975>authentication

64
00:02:57.495 --> 00:02:59.035
<00:02:57.495>and <00:02:57.841>passwords <00:02:58.188>get <00:02:58.534>phished <00:02:58.881>easily,

65
00:02:59.585 --> 00:03:01.845
<00:02:59.585>but <00:02:59.785>also <00:02:59.985>two <00:03:00.185>factors <00:03:00.385>can, <00:03:00.585>can <00:03:00.785>get <00:03:00.985>phished.

66
00:03:01.845 --> 00:03:03.845
<00:03:01.845>So <00:03:02.078>if <00:03:02.311>anyone <00:03:02.545>tricks <00:03:02.778>me <00:03:03.011>into <00:03:03.245>believing

67
00:03:03.845 --> 00:03:05.325
<00:03:03.845>that <00:03:04.111>a <00:03:04.377>page <00:03:04.644>looks <00:03:04.910>like <00:03:05.177>Google

68
00:03:05.825 --> 00:03:08.325
<00:03:05.825>and <00:03:05.952>I <00:03:06.079>enter <00:03:06.206>my <00:03:06.334>password <00:03:06.461>there, <00:03:06.588>then <00:03:06.715>he <00:03:06.843>also <00:03:06.970>can <00:03:07.097>trick <00:03:07.225>me

69
00:03:08.325 --> 00:03:11.125
<00:03:08.325>to <00:03:08.464>enter <00:03:08.605>my, <00:03:08.744>my <00:03:08.885>second <00:03:09.024>factor <00:03:09.165>there, <00:03:09.304>my <00:03:09.445>TOTP <00:03:09.584>token <00:03:09.725>there,

70
00:03:11.465 --> 00:03:13.725
<00:03:11.465>he <00:03:11.620>intercepts <00:03:11.776>it, <00:03:11.931>he <00:03:12.087>uses <00:03:12.242>it <00:03:12.398>once <00:03:12.553>to <00:03:12.709>log <00:03:12.865>in,

71
00:03:13.955 --> 00:03:15.285
<00:03:13.955>then <00:03:14.154>he's <00:03:14.354>in <00:03:14.553>there <00:03:14.753>and <00:03:14.952>he <00:03:15.152>has

72
00:03:15.285 --> 00:03:16.885
<00:03:15.285>to <00:03:15.565>maintain <00:03:15.845>access <00:03:16.125>for <00:03:16.405>the <00:03:16.685>future.

73
00:03:17.265 --> 00:03:20.045
<00:03:17.265>So <00:03:17.420>phishing <00:03:17.576>is, <00:03:17.731>is <00:03:17.887>also <00:03:18.042>a <00:03:18.198>big <00:03:18.353>problem, <00:03:18.509>um, <00:03:18.665>for,

74
00:03:20.465 --> 00:03:23.085
<00:03:20.465>for <00:03:20.665>a <00:03:20.865>two <00:03:21.065>factor <00:03:21.265>authentication, <00:03:21.465>um, <00:03:21.665>as <00:03:21.865>well.

75
00:03:23.545 --> 00:03:26.765
<00:03:23.545>So <00:03:23.672>we, <00:03:23.799>we <00:03:23.926>want <00:03:24.054>to, <00:03:24.181>we <00:03:24.308>want <00:03:24.435>to <00:03:24.563>solve <00:03:24.690>this, <00:03:24.817>this <00:03:24.945>problem.

76
00:03:26.985 --> 00:03:30.365
<00:03:26.985>So <00:03:27.140>something <00:03:27.296>that <00:03:27.451>we <00:03:27.607>have <00:03:27.762>to <00:03:27.918>remember, <00:03:28.073>something, <00:03:28.229>you <00:03:28.385>know,

77
00:03:30.465 --> 00:03:33.845
<00:03:30.465>um, <00:03:30.620>as <00:03:30.776>an, <00:03:30.931>uh, <00:03:31.087>authentication <00:03:31.242>factor <00:03:31.398>is, <00:03:31.553>is <00:03:31.709>hard <00:03:31.865>to,

78
00:03:34.345 --> 00:03:35.845
<00:03:34.345>um, <00:03:34.795>to, <00:03:35.245>to <00:03:35.695>use.

79
00:03:36.265 --> 00:03:38.445
<00:03:36.265>Um, <00:03:36.464>we <00:03:36.665>have <00:03:36.864>this <00:03:37.065>problem <00:03:37.265>with, <00:03:37.464>with <00:03:37.665>phishing,

80
00:03:38.785 --> 00:03:41.845
<00:03:38.785>and <00:03:38.940>still <00:03:39.096>you <00:03:39.251>have <00:03:39.407>to, <00:03:39.562>to <00:03:39.718>trust <00:03:39.873>the, <00:03:40.029>the <00:03:40.185>website

81
00:03:41.945 --> 00:03:43.925
<00:03:41.945>to <00:03:42.225>handle <00:03:42.505>your <00:03:42.785>password, <00:03:43.065>uh, <00:03:43.345>securely.

82
00:03:43.925 --> 00:03:47.085
<00:03:43.925>So <00:03:44.065>that's <00:03:44.205>a <00:03:44.345>problem. <00:03:44.485>Um, <00:03:44.625>we, <00:03:44.765>we <00:03:44.905>are <00:03:45.045>dealing <00:03:45.185>with <00:03:45.325>password,

83
00:03:47.105 --> 00:03:48.125
<00:03:47.105>uh, <00:03:48.023>authentication.

84
00:03:48.465 --> 00:03:52.845
<00:03:48.465>And <00:03:48.572>what, <00:03:48.680>what, <00:03:48.788>uh, <00:03:48.895>the <00:03:49.003>idea <00:03:49.111>is, <00:03:49.218>is, <00:03:49.326>um, <00:03:49.434>we <00:03:49.541>want <00:03:49.649>to <00:03:49.757>get <00:03:49.865>rid

85
00:03:52.845 --> 00:03:55.965
<00:03:52.845>of <00:03:53.000>these <00:03:53.156>factors <00:03:53.311>that <00:03:53.467>are <00:03:53.622>based <00:03:53.778>on <00:03:53.933>something, <00:03:54.089>you <00:03:54.245>know,

86
00:03:55.965 --> 00:03:58.765
<00:03:55.965>something <00:03:56.120>you <00:03:56.276>have <00:03:56.431>to <00:03:56.587>remember <00:03:56.742>and <00:03:56.898>get <00:03:57.053>to <00:03:57.209>other <00:03:57.365>factors.

87
00:03:59.065 --> 00:04:02.645
<00:03:59.065>Um, <00:03:59.220>for <00:03:59.376>example, <00:03:59.531>something <00:03:59.687>you, <00:03:59.842>you <00:03:59.998>have, <00:04:00.153>so <00:04:00.309>possession, <00:04:00.465>uh,

88
00:04:02.645 --> 00:04:04.605
<00:04:02.645>for <00:04:02.878>example, <00:04:03.111>your <00:04:03.345>phone <00:04:03.578>is <00:04:03.811>something <00:04:04.045>that,

89
00:04:04.605 --> 00:04:06.365
<00:04:04.605>that <00:04:04.838>you <00:04:05.071>have, <00:04:05.304>uh, <00:04:05.538>that <00:04:05.771>you <00:04:06.005>possess.

90
00:04:06.745 --> 00:04:08.005
<00:04:06.745>Um, <00:04:06.971>or <00:04:07.198>you <00:04:07.425>might <00:04:07.652>know <00:04:07.879>this.

91
00:04:08.145 --> 00:04:11.365
<00:04:08.145>Um, <00:04:08.320>uh, <00:04:08.495>um, <00:04:08.670>use <00:04:08.845>B <00:04:09.020>keys, <00:04:09.195>uh, <00:04:09.370>IC <00:04:09.545>keys.

92
00:04:11.435 --> 00:04:13.885
<00:04:11.435>This <00:04:11.635>is <00:04:11.835>a <00:04:12.035>solo <00:04:12.235>key, <00:04:12.435>for <00:04:12.635>example, <00:04:12.835>um,

93
00:04:13.885 --> 00:04:15.165
<00:04:13.885>something <00:04:14.269>you, <00:04:14.653>you <00:04:15.036>process.

94
00:04:15.665 --> 00:04:18.485
<00:04:15.665>And, <00:04:15.864>um, <00:04:16.065>yeah, <00:04:16.265>where, <00:04:16.464>where <00:04:16.664>the, <00:04:16.865>the <00:04:17.065>proof

95
00:04:18.485 --> 00:04:21.285
<00:04:18.485>of <00:04:18.660>authentication <00:04:18.835>is <00:04:19.010>that <00:04:19.185>you <00:04:19.360>prove, <00:04:19.535>um, <00:04:19.710>that <00:04:19.885>you,

96
00:04:21.305 --> 00:04:23.485
<00:04:21.305>you <00:04:21.584>have <00:04:21.865>this, <00:04:22.145>uh, <00:04:22.425>device, <00:04:22.705>um,

97
00:04:23.545 --> 00:04:26.565
<00:04:23.545>or <00:04:23.700>the, <00:04:23.856>the <00:04:24.011>third <00:04:24.167>method <00:04:24.322>is <00:04:24.478>something <00:04:24.633>you <00:04:24.789>are <00:04:24.945>so

98
00:04:27.165 --> 00:04:30.205
<00:04:27.165>biometric <00:04:27.365>features, <00:04:27.565>select <00:04:27.765>fingerprint, <00:04:27.965>like, <00:04:28.165>uh, <00:04:28.365>you <00:04:28.565>face

99
00:04:30.705 --> 00:04:32.685
<00:04:30.705>for <00:04:30.938>face <00:04:31.171>id, <00:04:31.405>uh, <00:04:31.638>stuff <00:04:31.871>like <00:04:32.104>that.

100
00:04:32.785 --> 00:04:35.165
<00:04:32.784>So <00:04:32.984>something <00:04:33.184>that <00:04:33.385>is <00:04:33.585>inherent <00:04:33.784>through <00:04:33.984>your <00:04:34.184>body

101
00:04:35.265 --> 00:04:39.445
<00:04:35.265>and, <00:04:35.420>uh, <00:04:35.576>no <00:04:35.731>one <00:04:35.887>else <00:04:36.042>hopefully <00:04:36.198>can, <00:04:36.353>can, <00:04:36.509>uh, <00:04:36.664>have.

102
00:04:39.585 --> 00:04:42.285
<00:04:39.585>And, <00:04:39.818>uh, <00:04:40.051>these, <00:04:40.284>uh, <00:04:40.518>three <00:04:40.751>methods, <00:04:40.984>uh,

103
00:04:42.285 --> 00:04:45.245
<00:04:42.284>of <00:04:42.484>authentication <00:04:42.684>are <00:04:42.885>also <00:04:43.085>known, <00:04:43.284>uh, <00:04:43.484>as, <00:04:43.684>uh,

104
00:04:45.245 --> 00:04:47.045
<00:04:45.245>something <00:04:45.525>you <00:04:45.805>forget, <00:04:46.085>something <00:04:46.365>you <00:04:46.645>lose

105
00:04:47.105 --> 00:04:48.325
<00:04:47.105>or <00:04:47.324>something <00:04:47.544>that <00:04:47.763>is <00:04:47.983>chopped <00:04:48.203>off.

106
00:04:48.985 --> 00:04:52.765
<00:04:48.985>So <00:04:49.160>of <00:04:49.335>course, <00:04:49.510>every <00:04:49.685>authentication <00:04:49.860>method <00:04:50.035>still <00:04:50.210>has <00:04:50.385>its

107
00:04:52.965 --> 00:04:56.605
<00:04:52.965>downsides, <00:04:53.165>but, <00:04:53.365>um, <00:04:53.565>yeah, <00:04:53.765>getting <00:04:53.965>away <00:04:54.165>from <00:04:54.365>this,

108
00:04:56.795 --> 00:05:01.205
<00:04:56.795>this <00:04:56.950>memorizing <00:04:57.106>load, <00:04:57.261>um, <00:04:57.417>uh, <00:04:57.572>to <00:04:57.728>things <00:04:57.883>that <00:04:58.039>are <00:04:58.195>yeah,

109
00:05:01.305 --> 00:05:04.805
<00:05:01.305>easier <00:05:01.460>to, <00:05:01.616>to <00:05:01.771>use <00:05:01.927>in, <00:05:02.082>in <00:05:02.238>daily <00:05:02.393>life, <00:05:02.549>um, <00:05:02.705>is,

110
00:05:04.865 --> 00:05:06.445
<00:05:04.865>is <00:05:05.145>the <00:05:05.425>aim <00:05:05.705>of <00:05:05.985>the <00:05:06.265>web.

111
00:05:06.565 --> 00:05:08.725
<00:05:06.565>APII <00:05:06.798>want <00:05:07.031>to, <00:05:07.265>uh, <00:05:07.498>show <00:05:07.731>you <00:05:07.965>today,

112
00:05:08.825 --> 00:05:10.965
<00:05:08.825>and <00:05:09.000>you <00:05:09.175>might, <00:05:09.349>uh, <00:05:09.525>have <00:05:09.700>heard <00:05:09.875>of, <00:05:10.050>uh, <00:05:10.224>it,

113
00:05:11.315 --> 00:05:14.765
<00:05:11.315>it's <00:05:11.442>called <00:05:11.569>Web <00:05:11.696>auth <00:05:11.824>n <00:05:11.951>it's <00:05:12.078>been <00:05:12.205>around <00:05:12.333>for, <00:05:12.460>for <00:05:12.587>some <00:05:12.715>times,

114
00:05:15.065 --> 00:05:19.645
<00:05:15.065>but, <00:05:15.172>uh, <00:05:15.280>uh, <00:05:15.388>web <00:05:15.495>auth <00:05:15.603>n <00:05:15.711>is <00:05:15.818>a <00:05:15.926>JavaScript <00:05:16.034>API <00:05:16.141>that <00:05:16.249>we <00:05:16.357>can <00:05:16.465>use

115
00:05:19.705 --> 00:05:22.885
<00:05:19.705>as, <00:05:19.938>uh, <00:05:20.171>web <00:05:20.405>developers <00:05:20.638>to, <00:05:20.871>um, <00:05:21.104>yeah,

116
00:05:23.185 --> 00:05:25.565
<00:05:23.185>use <00:05:23.385>other <00:05:23.585>authentication <00:05:23.785>methods <00:05:23.985>in <00:05:24.185>our <00:05:24.385>web, <00:05:24.585>uh,

117
00:05:25.565 --> 00:05:28.725
<00:05:25.565>applications <00:05:25.844>beside, <00:05:26.125>um, <00:05:26.405>yeah, <00:05:26.685>normal <00:05:26.965>passwords.

118
00:05:29.185 --> 00:05:32.125
<00:05:29.185>So, <00:05:29.418>um, <00:05:29.651>we <00:05:29.885>want <00:05:30.118>to <00:05:30.351>use, <00:05:30.585>um,

119
00:05:32.125 --> 00:05:34.325
<00:05:32.125>possession <00:05:32.358>based <00:05:32.591>factors <00:05:32.825>like <00:05:33.058>a <00:05:33.291>uuv <00:05:33.525>key

120
00:05:34.505 --> 00:05:38.085
<00:05:34.505>to <00:05:34.632>allow <00:05:34.759>our <00:05:34.886>our <00:05:35.014>users <00:05:35.141>to, <00:05:35.268>to <00:05:35.395>log <00:05:35.523>in <00:05:35.650>with <00:05:35.777>them <00:05:35.905>instead

121
00:05:38.085 --> 00:05:39.925
<00:05:38.085>of <00:05:38.435>passwords <00:05:38.784>or <00:05:39.135>biometric <00:05:39.484>factors.

122
00:05:39.985 --> 00:05:42.445
<00:05:39.985>And <00:05:40.112>we <00:05:40.239>want <00:05:40.366>to <00:05:40.494>build <00:05:40.621>this <00:05:40.748>into <00:05:40.875>a, <00:05:41.003>into <00:05:41.130>a <00:05:41.257>web <00:05:41.385>app,

123
00:05:42.445 --> 00:05:45.165
<00:05:42.445>and <00:05:42.600>that's <00:05:42.756>where <00:05:42.911>web <00:05:43.067>webs <00:05:43.222>and <00:05:43.378>it <00:05:43.533>takes <00:05:43.689>over <00:05:43.844>and,

124
00:05:45.165 --> 00:05:47.045
<00:05:45.165>and <00:05:45.398>helps <00:05:45.631>us <00:05:45.865>to, <00:05:46.098>to <00:05:46.331>solve <00:05:46.565>this.

125
00:05:47.425 --> 00:05:50.365
<00:05:47.425>It <00:05:47.658>uses <00:05:47.891>modern <00:05:48.125>cryptography, <00:05:48.358>that's <00:05:48.591>also <00:05:48.825>nice.

126
00:05:50.465 --> 00:05:54.325
<00:05:50.465>So <00:05:50.665>there's <00:05:50.865>a <00:05:51.065>challenge <00:05:51.265>response, <00:05:51.465>um, <00:05:51.665>um, <00:05:51.865>process

127
00:05:54.535 --> 00:05:58.685
<00:05:54.534>where <00:05:54.710>there's <00:05:54.885>no, <00:05:55.059>uh, <00:05:55.234>secret <00:05:55.409>ever <00:05:55.585>been <00:05:55.760>transmitted, <00:05:55.934>um,

128
00:05:58.825 --> 00:06:00.405
<00:05:58.825>on <00:05:59.058>the <00:05:59.291>wire <00:05:59.525>that <00:05:59.758>can <00:05:59.991>be <00:06:00.224>leaked

129
00:06:00.405 --> 00:06:02.565
<00:06:00.405>or <00:06:00.580>that <00:06:00.755>has <00:06:00.929>to, <00:06:01.104>uh, <00:06:01.280>to <00:06:01.455>be <00:06:01.630>stored <00:06:01.804>somehow.

130
00:06:03.225 --> 00:06:06.205
<00:06:03.225>Um, <00:06:03.400>and <00:06:03.575>we <00:06:03.750>have <00:06:03.925>a <00:06:04.100>very <00:06:04.275>strong <00:06:04.450>phishing <00:06:04.625>protection,

131
00:06:06.205 --> 00:06:07.685
<00:06:06.205>but <00:06:06.426>we <00:06:06.649>might <00:06:06.871>get <00:06:07.093>to <00:06:07.315>that <00:06:07.537>later.

132
00:06:07.895 --> 00:06:11.645
<00:06:07.895>First <00:06:08.034>of <00:06:08.174>all, <00:06:08.315>I <00:06:08.455>want <00:06:08.594>to <00:06:08.734>explain <00:06:08.875>in, <00:06:09.015>in <00:06:09.155>detail <00:06:09.294>what,

133
00:06:11.645 --> 00:06:12.965
<00:06:11.645>what, <00:06:11.942>uh, <00:06:12.239>web <00:06:12.536>and <00:06:12.832>is.

134
00:06:13.105 --> 00:06:17.565
<00:06:13.105>So <00:06:13.232>if <00:06:13.359>we <00:06:13.486>have <00:06:13.614>a, <00:06:13.741>a <00:06:13.868>classic <00:06:13.995>web, <00:06:14.123>um, <00:06:14.250>um, <00:06:14.377>web <00:06:14.505>app

135
00:06:17.755 --> 00:06:20.485
<00:06:17.755>with <00:06:17.895>some <00:06:18.034>kind <00:06:18.175>of, <00:06:18.315>of <00:06:18.455>backend, <00:06:18.594>the <00:06:18.735>server <00:06:18.875>in, <00:06:19.015>in <00:06:19.155>web,

136
00:06:20.625 --> 00:06:21.965
<00:06:20.625>and <00:06:20.926>it's <00:06:21.228>called <00:06:21.529>relying <00:06:21.830>party,

137
00:06:22.785 --> 00:06:25.045
<00:06:22.785>and <00:06:22.925>we <00:06:23.065>have <00:06:23.205>the, <00:06:23.345>the <00:06:23.485>web <00:06:23.625>app <00:06:23.765>that <00:06:23.905>is <00:06:24.045>running <00:06:24.185>in,

138
00:06:25.045 --> 00:06:27.805
<00:06:25.045>in <00:06:25.245>the <00:06:25.445>browser, <00:06:25.645>typically <00:06:25.845>written <00:06:26.045>in, <00:06:26.245>in <00:06:26.445>JavaScript

139
00:06:27.825 --> 00:06:31.245
<00:06:27.825>or <00:06:27.965>TypeScript, <00:06:28.104>and <00:06:28.245>it <00:06:28.385>is <00:06:28.525>running <00:06:28.664>on <00:06:28.805>a <00:06:28.945>browser, <00:06:29.085>um, <00:06:29.224>uh,

140
00:06:31.345 --> 00:06:32.645
<00:06:31.345>on <00:06:31.637>some <00:06:31.930>kind <00:06:32.222>of <00:06:32.515>platform.

141
00:06:32.645 --> 00:06:35.085
<00:06:32.645>And <00:06:32.878>web <00:06:33.111>developers <00:06:33.344>know <00:06:33.578>there's <00:06:33.811>a <00:06:34.044>lot

142
00:06:35.085 --> 00:06:37.085
<00:06:35.085>of <00:06:35.364>different <00:06:35.645>browsers <00:06:35.924>and <00:06:36.205>different <00:06:36.484>platforms.

143
00:06:37.085 --> 00:06:39.885
<00:06:37.085>It's <00:06:37.260>hard <00:06:37.435>to, <00:06:37.609>um, <00:06:37.784>yeah, <00:06:37.960>maintain <00:06:38.135>all <00:06:38.310>of <00:06:38.484>them.

144
00:06:39.905 --> 00:06:42.245
<00:06:39.905>And <00:06:40.138>that's <00:06:40.371>where <00:06:40.604>Web <00:06:40.838>N <00:06:41.071>comes <00:06:41.304>in

145
00:06:42.245 --> 00:06:45.845
<00:06:42.245>because <00:06:42.420>it <00:06:42.595>defines <00:06:42.770>the, <00:06:42.945>the, <00:06:43.120>um, <00:06:43.295>yeah, <00:06:43.470>the <00:06:43.645>interface

146
00:06:45.845 --> 00:06:46.885
<00:06:45.845>between <00:06:46.313>the <00:06:46.781>application

147
00:06:46.905 --> 00:06:51.125
<00:06:46.905>and <00:06:47.032>the <00:06:47.159>underlying, <00:06:47.286>um, <00:06:47.414>browser <00:06:47.541>so <00:06:47.668>that <00:06:47.795>we <00:06:47.923>can <00:06:48.050>use <00:06:48.177>some <00:06:48.304>kind

148
00:06:51.125 --> 00:06:52.565
<00:06:51.125>of <00:06:51.773>built-in <00:06:52.421>authenticators,

149
00:06:52.595 --> 00:06:54.885
<00:06:52.595>like <00:06:52.795>face <00:06:52.995>Id <00:06:53.195>touch, <00:06:53.395>ID <00:06:53.595>even <00:06:53.795>those <00:06:53.995>hello?

150
00:06:55.305 --> 00:06:58.245
<00:06:55.305>Um, <00:06:55.480>or <00:06:55.655>external <00:06:55.830>authenticators, <00:06:56.005>something <00:06:56.180>that <00:06:56.355>you <00:06:56.530>can <00:06:56.705>carry

151
00:06:58.245 --> 00:07:00.125
<00:06:58.245>around <00:06:58.478>like <00:06:58.711>the <00:06:58.945>solo <00:06:59.178>key, <00:06:59.411>for <00:06:59.645>example.

152
00:07:01.105 --> 00:07:03.805
<00:07:01.105>But, <00:07:01.260>um, <00:07:01.416>let <00:07:01.571>me <00:07:01.727>show <00:07:01.882>you <00:07:02.038>a <00:07:02.193>quick <00:07:02.349>demo, <00:07:02.505>um,

153
00:07:04.145 --> 00:07:06.885
<00:07:04.145>before <00:07:04.300>we <00:07:04.456>dive <00:07:04.611>a <00:07:04.767>bit <00:07:04.922>into <00:07:05.078>what, <00:07:05.233>what's <00:07:05.389>happening <00:07:05.544>so

154
00:07:07.155 --> 00:07:08.405
<00:07:07.155>that <00:07:07.436>you <00:07:07.717>can <00:07:07.998>see <00:07:08.280>how,

155
00:07:08.625 --> 00:07:11.165
<00:07:08.625>how <00:07:08.825>web <00:07:09.025>bath <00:07:09.225>end <00:07:09.425>behaves <00:07:09.625>in, <00:07:09.825>in <00:07:10.025>practice.

156
00:07:11.785 --> 00:07:15.085
<00:07:11.785>So, <00:07:11.940>um, <00:07:12.096>I <00:07:12.251>have <00:07:12.407>a <00:07:12.562>small, <00:07:12.718>uh, <00:07:12.873>demo <00:07:13.029>app <00:07:13.185>here.

157
00:07:15.425 --> 00:07:17.405
<00:07:15.425>Um, <00:07:15.705>it, <00:07:15.985>it's <00:07:16.265>really, <00:07:16.545>really <00:07:16.825>simple.

158
00:07:17.545 --> 00:07:20.205
<00:07:17.545>We <00:07:17.672>have <00:07:17.799>a <00:07:17.926>log <00:07:18.054>in <00:07:18.181>here, <00:07:18.308>and <00:07:18.435>you <00:07:18.563>might <00:07:18.690>have <00:07:18.817>noticed <00:07:18.945>already

159
00:07:20.205 --> 00:07:24.165
<00:07:20.205>that <00:07:20.332>it <00:07:20.459>is <00:07:20.586>not <00:07:20.714>the <00:07:20.841>usual <00:07:20.968>login <00:07:21.095>in, <00:07:21.223>um, <00:07:21.350>uh, <00:07:21.477>form <00:07:21.604>that,

160
00:07:24.165 --> 00:07:26.605
<00:07:24.165>that <00:07:24.292>I <00:07:24.419>told <00:07:24.546>you <00:07:24.674>about <00:07:24.801>because <00:07:24.928>a, <00:07:25.055>a <00:07:25.183>password <00:07:25.310>is <00:07:25.437>missing <00:07:25.565>here.

161
00:07:26.985 --> 00:07:29.085
<00:07:26.985>Um, <00:07:27.185>but <00:07:27.385>before <00:07:27.585>we <00:07:27.785>can, <00:07:27.985>uh, <00:07:28.185>log <00:07:28.385>in,

162
00:07:29.085 --> 00:07:30.325
<00:07:29.085>we <00:07:29.364>have <00:07:29.643>to <00:07:29.921>register <00:07:30.200>first.

163
00:07:30.785 --> 00:07:35.735
<00:07:30.785>So <00:07:30.940>I <00:07:31.096>type <00:07:31.251>in <00:07:31.407>my <00:07:31.562>email, <00:07:31.718>let <00:07:31.873>me <00:07:32.029>copy <00:07:32.185>that

164
00:07:35.735 --> 00:07:37.815
<00:07:35.735>for <00:07:35.910>later, <00:07:36.085>and <00:07:36.260>I <00:07:36.435>also <00:07:36.610>type <00:07:36.785>in <00:07:36.960>my <00:07:37.135>name.

165
00:07:38.195 --> 00:07:39.975
<00:07:38.195>So, <00:07:38.395>uh, <00:07:38.594>we <00:07:38.795>can <00:07:38.995>see <00:07:39.195>later <00:07:39.395>that, <00:07:39.594>uh,

166
00:07:40.035 --> 00:07:42.215
<00:07:40.034>the <00:07:40.314>application <00:07:40.594>really <00:07:40.874>recognizes <00:07:41.155>me <00:07:41.434>again.

167
00:07:42.635 --> 00:07:46.135
<00:07:42.635>So <00:07:42.775>what <00:07:42.914>happens <00:07:43.055>now <00:07:43.195>if <00:07:43.335>I <00:07:43.474>click <00:07:43.615>on <00:07:43.755>a <00:07:43.895>register, <00:07:44.034>um,

168
00:07:46.435 --> 00:07:49.055
<00:07:46.435>the <00:07:46.635>website <00:07:46.835>opens <00:07:47.035>some, <00:07:47.235>some <00:07:47.435>kind <00:07:47.635>of <00:07:47.835>popup,

169
00:07:49.055 --> 00:07:50.215
<00:07:49.055>this <00:07:49.263>is <00:07:49.472>coming <00:07:49.681>from <00:07:49.890>the <00:07:50.099>browser,

170
00:07:50.595 --> 00:07:53.495
<00:07:50.595>and <00:07:50.770>it, <00:07:50.945>uh, <00:07:51.120>ask <00:07:51.295>me <00:07:51.470>to, <00:07:51.645>um, <00:07:51.820>create <00:07:51.995>some,

171
00:07:53.495 --> 00:07:54.655
<00:07:53.495>some <00:07:53.843>kind <00:07:54.191>of <00:07:54.539>credentials.

172
00:07:55.035 --> 00:07:58.335
<00:07:55.034>So <00:07:55.135>I <00:07:55.234>take <00:07:55.335>my <00:07:55.434>UBI <00:07:55.534>key, <00:07:55.635>I, <00:07:55.734>uh, <00:07:55.835>plug <00:07:55.934>it <00:07:56.034>in, <00:07:56.135>uh, <00:07:56.234>to <00:07:56.335>my <00:07:56.434>computer

173
00:07:58.335 --> 00:07:59.615
<00:07:58.335>because <00:07:58.565>I <00:07:58.795>want <00:07:59.026>to <00:07:59.256>use <00:07:59.487>this.

174
00:08:00.075 --> 00:08:02.215
<00:08:00.075>And, <00:08:00.308>um, <00:08:00.541>I <00:08:00.775>tap <00:08:01.008>it <00:08:01.241>very <00:08:01.474>shortly.

175
00:08:02.755 --> 00:08:05.455
<00:08:02.755>And <00:08:02.882>then <00:08:03.009>it <00:08:03.136>says, <00:08:03.264>so <00:08:03.391>for <00:08:03.518>the <00:08:03.645>German, <00:08:03.773>uh, <00:08:03.900>it <00:08:04.027>says, <00:08:04.155>uh,

176
00:08:05.455 --> 00:08:06.575
<00:08:05.455>registration <00:08:06.462>completed.

177
00:08:06.715 --> 00:08:09.975
<00:08:06.715>So <00:08:06.854>the, <00:08:06.994>the <00:08:07.135>web <00:08:07.275>app <00:08:07.414>says, <00:08:07.554>okay, <00:08:07.695>this <00:08:07.835>user <00:08:07.974>is <00:08:08.114>now,

178
00:08:10.075 --> 00:08:11.095
<00:08:10.075>um, <00:08:10.993>completed.

179
00:08:11.585 --> 00:08:14.535
<00:08:11.585>There <00:08:11.784>was <00:08:11.984>not <00:08:12.185>really <00:08:12.385>much, <00:08:12.585>uh, <00:08:12.784>going <00:08:12.984>on,

180
00:08:14.535 --> 00:08:16.255
<00:08:14.535>or <00:08:14.768>you <00:08:15.001>could <00:08:15.235>not <00:08:15.468>see <00:08:15.701>that <00:08:15.935>much,

181
00:08:16.275 --> 00:08:18.935
<00:08:16.275>but <00:08:16.414>let's <00:08:16.554>see <00:08:16.695>if <00:08:16.835>it, <00:08:16.974>if <00:08:17.114>it <00:08:17.255>really, <00:08:17.395>um, <00:08:17.534>um, <00:08:17.674>worked.

182
00:08:19.315 --> 00:08:21.535
<00:08:19.315>So <00:08:19.470>we <00:08:19.626>try <00:08:19.781>to <00:08:19.937>log <00:08:20.092>in <00:08:20.248>again, <00:08:20.403>I <00:08:20.559>enter <00:08:20.715>my,

183
00:08:21.535 --> 00:08:22.735
<00:08:21.535>my <00:08:21.805>username, <00:08:22.075>my <00:08:22.345>email <00:08:22.615>address.

184
00:08:23.055 --> 00:08:25.935
<00:08:23.055>I <00:08:23.230>click <00:08:23.405>on <00:08:23.580>log <00:08:23.755>in, <00:08:23.930>a <00:08:24.105>similar <00:08:24.280>pop-up <00:08:24.455>opens.

185
00:08:26.075 --> 00:08:29.535
<00:08:26.075>Um, <00:08:26.191>it <00:08:26.308>asked <00:08:26.425>me <00:08:26.541>to, <00:08:26.658>to <00:08:26.775>use <00:08:26.891>some <00:08:27.008>credentials <00:08:27.125>to, <00:08:27.241>to <00:08:27.358>log <00:08:27.474>in.

186
00:08:29.835 --> 00:08:32.095
<00:08:29.835>My <00:08:30.068>UB <00:08:30.301>key <00:08:30.534>starts, <00:08:30.768>uh, <00:08:31.001>blinking <00:08:31.234>again.

187
00:08:32.375 --> 00:08:36.945
<00:08:32.375>I, <00:08:32.515>I <00:08:32.655>tap <00:08:32.794>it <00:08:32.934>shortly <00:08:33.075>and <00:08:33.215>I <00:08:33.355>am, <00:08:33.495>uh, <00:08:33.635>logged <00:08:33.775>in.

188
00:08:37.205 --> 00:08:40.025
<00:08:37.205>And, <00:08:37.360>uh, <00:08:37.516>the <00:08:37.671>website, <00:08:37.827>um, <00:08:37.982>greets <00:08:38.138>me <00:08:38.293>with <00:08:38.449>my <00:08:38.605>name.

189
00:08:40.085 --> 00:08:44.785
<00:08:40.085>So <00:08:40.212>we, <00:08:40.339>we <00:08:40.466>can <00:08:40.594>be, <00:08:40.721>um, <00:08:40.848>yeah, <00:08:40.975>uh, <00:08:41.103>we <00:08:41.230>can <00:08:41.357>think <00:08:41.485>that,

190
00:08:44.785 --> 00:08:46.465
<00:08:44.785>that <00:08:45.135>it <00:08:45.485>really <00:08:45.834>authenticated <00:08:46.185>me.

191
00:08:46.965 --> 00:08:48.105
<00:08:46.965>So <00:08:47.307>that's <00:08:47.649>how, <00:08:47.991>um,

192
00:08:48.505 --> 00:08:50.465
<00:08:48.505>passwordless <00:08:48.855>authentication <00:08:49.205>could <00:08:49.555>look <00:08:49.905>in,

193
00:08:50.465 --> 00:08:51.545
<00:08:50.465>in <00:08:50.789>a <00:08:51.113>web <00:08:51.437>application.

194
00:08:51.885 --> 00:08:56.645
<00:08:51.885>And, <00:08:52.040>uh, <00:08:52.196>let <00:08:52.351>me, <00:08:52.507>oh, <00:08:52.662>let <00:08:52.818>me, <00:08:52.973>um, <00:08:53.129>show <00:08:53.285>you

195
00:08:57.225 --> 00:08:59.205
<00:08:57.225>how, <00:08:57.425>uh, <00:08:57.625>what, <00:08:57.825>what <00:08:58.025>happened <00:08:58.225>under <00:08:58.425>the <00:08:58.625>hood

196
00:08:59.205 --> 00:09:02.965
<00:08:59.205>because, <00:08:59.332>um, <00:08:59.459>we, <00:08:59.586>we <00:08:59.714>did <00:08:59.841>not <00:08:59.968>see <00:09:00.095>that <00:09:00.223>much, <00:09:00.350>uh, <00:09:00.477>during <00:09:00.605>this,

197
00:09:03.265 --> 00:09:05.585
<00:09:03.265>um, <00:09:03.615>uh, <00:09:03.965>during <00:09:04.314>this <00:09:04.665>demo.

198
00:09:05.615 --> 00:09:08.345
<00:09:05.615>What, <00:09:05.815>what <00:09:06.015>is <00:09:06.215>really, <00:09:06.415>um, <00:09:06.615>happening <00:09:06.815>technically <00:09:07.015>here.

199
00:09:08.405 --> 00:09:12.425
<00:09:08.405>So <00:09:08.521>web, <00:09:08.638>both <00:09:08.755>n <00:09:08.871>is, <00:09:08.988>is <00:09:09.105>a, <00:09:09.221>uh, <00:09:09.338>W <00:09:09.454>three <00:09:09.571>c <00:09:09.688>uh, <00:09:09.805>standard,

200
00:09:12.525 --> 00:09:16.185
<00:09:12.525>and <00:09:12.680>it <00:09:12.836>defines <00:09:12.991>two <00:09:13.147>different <00:09:13.302>ceremonies, <00:09:13.458>so <00:09:13.613>two <00:09:13.769>kind <00:09:13.925>of

201
00:09:16.205 --> 00:09:17.585
<00:09:16.205>of <00:09:16.453>processes <00:09:16.701>I <00:09:16.950>would <00:09:17.198>call <00:09:17.447>it.

202
00:09:17.605 --> 00:09:20.305
<00:09:17.605>But, <00:09:17.838>um, <00:09:18.071>web <00:09:18.305>then <00:09:18.538>calls <00:09:18.771>them <00:09:19.005>ceremonies.

203
00:09:20.645 --> 00:09:23.505
<00:09:20.645>And, <00:09:20.845>um, <00:09:21.045>one <00:09:21.245>ceremony <00:09:21.444>is <00:09:21.645>the <00:09:21.845>registration <00:09:22.045>ceremony

204
00:09:23.685 --> 00:09:25.505
<00:09:23.685>that's <00:09:23.918>happening <00:09:24.151>when <00:09:24.385>you <00:09:24.618>want <00:09:24.851>to <00:09:25.084>register

205
00:09:25.605 --> 00:09:27.145
<00:09:25.605>as <00:09:25.836>a <00:09:26.067>new <00:09:26.298>user <00:09:26.529>on <00:09:26.760>the <00:09:26.991>website.

206
00:09:27.605 --> 00:09:31.545
<00:09:27.605>And, <00:09:27.745>um, <00:09:27.885>what <00:09:28.025>is <00:09:28.165>happening <00:09:28.305>there <00:09:28.445>is <00:09:28.585>the <00:09:28.725>website <00:09:28.865>creates <00:09:29.005>some

207
00:09:31.545 --> 00:09:33.705
<00:09:31.545>kind <00:09:31.778>of <00:09:32.011>public <00:09:32.245>key <00:09:32.478>private <00:09:32.711>key <00:09:32.944>credential.

208
00:09:34.245 --> 00:09:37.025
<00:09:34.245>And, <00:09:34.445>um, <00:09:34.645>it's, <00:09:34.845>uh, <00:09:35.045>scoped <00:09:35.245>to <00:09:35.445>the <00:09:35.645>parties,

209
00:09:37.165 --> 00:09:39.705
<00:09:37.165>or <00:09:37.305>it's <00:09:37.444>scoped <00:09:37.584>to, <00:09:37.724>to <00:09:37.865>the <00:09:38.005>server <00:09:38.145>I <00:09:38.285>want <00:09:38.425>to <00:09:38.564>authenticate.

210
00:09:40.285 --> 00:09:42.905
<00:09:40.285>And <00:09:40.518>that's <00:09:40.751>what <00:09:40.985>happening <00:09:41.218>during <00:09:41.451>the <00:09:41.685>registration.

211
00:09:42.965 --> 00:09:45.145
<00:09:42.965>And <00:09:43.120>then <00:09:43.276>we <00:09:43.431>have <00:09:43.587>the <00:09:43.742>authentication <00:09:43.898>to <00:09:44.053>actual <00:09:44.209>log <00:09:44.365>in,

212
00:09:45.405 --> 00:09:47.345
<00:09:45.405>and <00:09:45.605>we <00:09:45.805>saw <00:09:46.005>where <00:09:46.204>I <00:09:46.405>have <00:09:46.605>to <00:09:46.805>prove

213
00:09:47.345 --> 00:09:50.025
<00:09:47.345>that <00:09:47.500>I <00:09:47.656>still <00:09:47.811>possess <00:09:47.967>the <00:09:48.122>private <00:09:48.278>key <00:09:48.433>that <00:09:48.589>is, <00:09:48.745>um,

214
00:09:50.625 --> 00:09:51.865
<00:09:50.625>registered <00:09:50.904>to <00:09:51.183>this <00:09:51.462>public <00:09:51.741>key.

215
00:09:52.085 --> 00:09:54.625
<00:09:52.085>But <00:09:52.212>let's <00:09:52.339>have <00:09:52.466>a <00:09:52.594>look <00:09:52.721>at <00:09:52.848>this <00:09:52.975>a <00:09:53.103>bit <00:09:53.230>more <00:09:53.357>in <00:09:53.485>detail.

216
00:09:54.925 --> 00:09:57.945
<00:09:54.925>So <00:09:55.080>you <00:09:55.236>remember <00:09:55.391>this, <00:09:55.547>this <00:09:55.702>architecture, <00:09:55.858>we <00:09:56.013>have <00:09:56.169>a <00:09:56.324>server,

217
00:09:58.085 --> 00:10:00.305
<00:09:58.085>we <00:09:58.260>have <00:09:58.435>the, <00:09:58.610>the <00:09:58.785>web <00:09:58.960>application <00:09:59.135>we <00:09:59.310>just <00:09:59.485>saw

218
00:10:00.305 --> 00:10:03.785
<00:10:00.305>that <00:10:00.444>is <00:10:00.584>running <00:10:00.724>on, <00:10:00.864>uh, <00:10:01.005>chromium <00:10:01.145>on, <00:10:01.285>on <00:10:01.425>in <00:10:01.564>this <00:10:01.704>case,

219
00:10:04.165 --> 00:10:05.385
<00:10:04.165>and <00:10:04.439>it <00:10:04.714>wants <00:10:04.988>to <00:10:05.263>communicate

220
00:10:05.385 --> 00:10:06.825
<00:10:05.385>with <00:10:05.817>this <00:10:06.249>external <00:10:06.681>authenticator.

221
00:10:07.365 --> 00:10:10.905
<00:10:07.365>So <00:10:07.492>what <00:10:07.619>is <00:10:07.746>happening <00:10:07.874>in <00:10:08.001>the <00:10:08.128>moment <00:10:08.255>that <00:10:08.383>I, <00:10:08.510>that <00:10:08.637>I, <00:10:08.765>um,

222
00:10:11.385 --> 00:10:12.625
<00:10:11.385>registered <00:10:11.757>in <00:10:12.129>this <00:10:12.501>website.

223
00:10:12.765 --> 00:10:16.905
<00:10:12.765>So <00:10:12.892>the <00:10:13.019>client, <00:10:13.146>the, <00:10:13.274>the <00:10:13.401>web <00:10:13.528>app, <00:10:13.655>um, <00:10:13.783>I <00:10:13.910>wrote, <00:10:14.037>um, <00:10:14.165>says,

224
00:10:17.035 --> 00:10:20.265
<00:10:17.035>hello, <00:10:17.190>I <00:10:17.346>have <00:10:17.501>this, <00:10:17.657>uh, <00:10:17.812>user, <00:10:17.968>um, <00:10:18.123>with <00:10:18.279>the <00:10:18.435>username,

225
00:10:20.545 --> 00:10:22.545
<00:10:20.545>Clemen <00:10:20.778>Ner, <00:10:21.011>and <00:10:21.245>he <00:10:21.478>wants <00:10:21.711>to <00:10:21.944>register,

226
00:10:22.545 --> 00:10:24.385
<00:10:22.545>and <00:10:22.778>the <00:10:23.011>server <00:10:23.245>responds, <00:10:23.478>okay, <00:10:23.711>that's <00:10:23.944>cool.

227
00:10:24.735 --> 00:10:28.825
<00:10:24.735>Then <00:10:24.862>you <00:10:24.989>need <00:10:25.116>to <00:10:25.244>create <00:10:25.371>me, <00:10:25.498>uh, <00:10:25.625>private <00:10:25.753>key <00:10:25.880>public <00:10:26.007>key <00:10:26.135>pair,

228
00:10:29.325 --> 00:10:31.425
<00:10:29.325>and <00:10:29.605>it <00:10:29.885>passes <00:10:30.165>along <00:10:30.445>some <00:10:30.725>specification,

229
00:10:31.425 --> 00:10:34.745
<00:10:31.425>which <00:10:31.599>algorithms <00:10:31.775>should <00:10:31.949>they <00:10:32.125>use, <00:10:32.300>what <00:10:32.474>key <00:10:32.650>size, <00:10:32.824>some,

230
00:10:34.745 --> 00:10:37.705
<00:10:34.745>some <00:10:34.920>technical <00:10:35.095>stuff <00:10:35.270>that, <00:10:35.445>that <00:10:35.620>the <00:10:35.795>server <00:10:35.970>can, <00:10:36.145>um,

231
00:10:38.325 --> 00:10:40.465
<00:10:38.325>can <00:10:38.558>provide <00:10:38.791>to, <00:10:39.025>to <00:10:39.258>give <00:10:39.491>some, <00:10:39.725>um,

232
00:10:40.465 --> 00:10:41.945
<00:10:40.465>constraints <00:10:40.798>on, <00:10:41.131>on <00:10:41.464>the <00:10:41.797>key.

233
00:10:42.365 --> 00:10:45.465
<00:10:42.365>And <00:10:42.540>all <00:10:42.715>these <00:10:42.890>constraints, <00:10:43.065>um, <00:10:43.240>we, <00:10:43.415>we <00:10:43.590>use <00:10:43.765>in,

234
00:10:45.565 --> 00:10:46.825
<00:10:45.565>in, <00:10:45.848>in <00:10:46.132>the <00:10:46.415>front <00:10:46.699>end.

235
00:10:47.445 --> 00:10:51.425
<00:10:47.445>And <00:10:47.600>that's <00:10:47.756>where <00:10:47.911>the <00:10:48.067>actual <00:10:48.222>JavaScript, <00:10:48.378>um, <00:10:48.533>uh, <00:10:48.689>API <00:10:48.845>web,

236
00:10:52.285 --> 00:10:53.425
<00:10:52.285>um, <00:10:52.627>comes <00:10:52.968>in <00:10:53.310>place

237
00:10:53.455 --> 00:10:56.425
<00:10:53.455>because <00:10:53.655>this <00:10:53.855>is <00:10:54.055>living <00:10:54.255>in <00:10:54.455>this <00:10:54.655>navigator <00:10:54.855>credentials.

238
00:10:56.545 --> 00:10:59.865
<00:10:56.545>API, <00:10:56.672>this <00:10:56.799>is <00:10:56.926>some, <00:10:57.054>some <00:10:57.181>thing <00:10:57.308>that <00:10:57.435>a <00:10:57.563>browser <00:10:57.690>provides <00:10:57.817>to <00:10:57.944>us.

239
00:11:00.525 --> 00:11:03.265
<00:11:00.525>And, <00:11:00.758>um, <00:11:00.991>um, <00:11:01.225>there <00:11:01.458>are <00:11:01.691>two <00:11:01.925>methods.

240
00:11:03.405 --> 00:11:04.745
<00:11:03.405>One <00:11:03.646>method <00:11:03.887>is <00:11:04.128>this <00:11:04.369>create <00:11:04.611>method.

241
00:11:05.205 --> 00:11:07.465
<00:11:05.205>We <00:11:05.380>put <00:11:05.555>the <00:11:05.730>specification <00:11:05.905>we <00:11:06.080>got <00:11:06.255>from <00:11:06.430>the <00:11:06.605>server

242
00:11:08.045 --> 00:11:10.465
<00:11:08.045>in <00:11:08.324>there <00:11:08.604>in <00:11:08.885>our <00:11:09.165>JavaScript <00:11:09.444>application,

243
00:11:10.805 --> 00:11:15.345
<00:11:10.805>and <00:11:10.944>that's <00:11:11.084>where <00:11:11.224>we <00:11:11.364>as <00:11:11.505>developers <00:11:11.645>can, <00:11:11.785>um, <00:11:11.925>yeah, <00:11:12.064>lay <00:11:12.204>back

244
00:11:15.345 --> 00:11:17.505
<00:11:15.345>because, <00:11:15.578>um, <00:11:15.811>from <00:11:16.045>there, <00:11:16.278>the, <00:11:16.511>the <00:11:16.745>browser

245
00:11:17.525 --> 00:11:18.705
<00:11:17.525>and <00:11:17.737>the <00:11:17.949>platform <00:11:18.162>takes <00:11:18.374>it <00:11:18.587>over.

246
00:11:18.765 --> 00:11:19.865
<00:11:18.765>So <00:11:19.012>it <00:11:19.260>has <00:11:19.507>a <00:11:19.755>look.

247
00:11:19.935 --> 00:11:21.905
<00:11:19.935>What <00:11:20.135>platform <00:11:20.334>am <00:11:20.535>I, <00:11:20.734>am <00:11:20.935>I <00:11:21.135>running <00:11:21.334>on

248
00:11:22.015 --> 00:11:23.865
<00:11:22.015>what <00:11:22.481>authenticators <00:11:22.948>are <00:11:23.415>there?

249
00:11:24.165 --> 00:11:25.225
<00:11:24.165>How, <00:11:24.403>what <00:11:24.641>can <00:11:24.880>I <00:11:25.119>use?

250
00:11:25.645 --> 00:11:27.905
<00:11:25.645>Um, <00:11:25.925>it <00:11:26.204>communicates <00:11:26.485>with <00:11:26.765>the <00:11:27.045>authenticators,

251
00:11:28.195 --> 00:11:31.345
<00:11:28.195>makes <00:11:28.428>this <00:11:28.661>cryptographic <00:11:28.895>creation <00:11:29.128>of <00:11:29.361>the, <00:11:29.595>um,

252
00:11:31.405 --> 00:11:35.265
<00:11:31.405>of <00:11:31.521>the <00:11:31.638>key <00:11:31.755>here, <00:11:31.871>and <00:11:31.988>it <00:11:32.105>returns <00:11:32.221>the <00:11:32.338>public <00:11:32.454>key <00:11:32.571>that <00:11:32.688>we <00:11:32.805>need

253
00:11:35.325 --> 00:11:37.825
<00:11:35.325>to, <00:11:35.558>um, <00:11:35.791>pass <00:11:36.025>back <00:11:36.258>to <00:11:36.491>the <00:11:36.725>server.

254
00:11:38.445 --> 00:11:40.505
<00:11:38.445>And <00:11:38.678>the <00:11:38.911>server <00:11:39.145>takes <00:11:39.378>this <00:11:39.611>public <00:11:39.845>key.

255
00:11:40.845 --> 00:11:42.265
<00:11:40.845>He <00:11:41.164>stores <00:11:41.484>this <00:11:41.803>public <00:11:42.123>key.

256
00:11:42.605 --> 00:11:46.225
<00:11:42.605>That's <00:11:42.780>what, <00:11:42.955>what <00:11:43.130>usually <00:11:43.305>would <00:11:43.480>be <00:11:43.655>the <00:11:43.830>password <00:11:44.005>hash.

257
00:11:46.245 --> 00:11:48.345
<00:11:46.245>So <00:11:46.445>that's <00:11:46.645>what <00:11:46.845>the <00:11:47.045>server <00:11:47.245>stores <00:11:47.445>as, <00:11:47.645>um,

258
00:11:48.845 --> 00:11:50.625
<00:11:48.845>as <00:11:49.078>the <00:11:49.311>credential <00:11:49.545>on, <00:11:49.778>on <00:11:50.011>its <00:11:50.245>side

259
00:11:51.205 --> 00:11:55.525
<00:11:51.205>and <00:11:51.345>the, <00:11:51.485>the, <00:11:51.625>um, <00:11:51.765>the <00:11:51.905>server <00:11:52.045>says, <00:11:52.185>okay, <00:11:52.325>that's, <00:11:52.465>that's <00:11:52.605>it.

260
00:11:55.525 --> 00:11:56.725
<00:11:55.525>That <00:11:55.885>was <00:11:56.245>the <00:11:56.605>registration.

261
00:11:57.185 --> 00:11:59.885
<00:11:57.185>And <00:11:57.359>for <00:11:57.535>the <00:11:57.709>login, <00:11:57.885>it, <00:11:58.060>it <00:11:58.234>looks <00:11:58.410>quite <00:11:58.584>similar.

262
00:12:00.285 --> 00:12:03.365
<00:12:00.285>I <00:12:00.425>enter <00:12:00.564>my <00:12:00.704>username, <00:12:00.844>the <00:12:00.985>client <00:12:01.125>talks <00:12:01.265>to <00:12:01.405>the <00:12:01.545>server, <00:12:01.685>hello,

263
00:12:03.685 --> 00:12:06.005
<00:12:03.685>Clemen, <00:12:03.840>sweetner <00:12:03.996>wants <00:12:04.151>to <00:12:04.307>authenticate, <00:12:04.462>how <00:12:04.618>can <00:12:04.773>we <00:12:04.929>do <00:12:05.084>that?

264
00:12:06.385 --> 00:12:07.925
<00:12:06.385>And <00:12:06.847>the <00:12:07.309>server <00:12:07.771>responds

265
00:12:07.945 --> 00:12:09.685
<00:12:07.945>and <00:12:08.178>says, <00:12:08.411>okay, <00:12:08.645>I <00:12:08.878>know <00:12:09.111>this <00:12:09.345>user,

266
00:12:10.285 --> 00:12:11.885
<00:12:10.285>I <00:12:10.564>know <00:12:10.844>he <00:12:11.125>has <00:12:11.405>some <00:12:11.685>credentials.

267
00:12:12.385 --> 00:12:14.325
<00:12:12.385>Um, <00:12:12.665>he <00:12:12.944>has <00:12:13.225>to <00:12:13.505>prove <00:12:13.785>that,

268
00:12:14.325 --> 00:12:16.565
<00:12:14.325>that <00:12:14.605>he <00:12:14.885>still <00:12:15.165>possesses <00:12:15.445>these <00:12:15.725>credentials.

269
00:12:16.985 --> 00:12:18.325
<00:12:16.985>And <00:12:17.226>he's, <00:12:17.467>we <00:12:17.708>are <00:12:17.949>doing <00:12:18.191>this

270
00:12:18.325 --> 00:12:19.765
<00:12:18.325>with <00:12:18.649>a <00:12:18.973>challenge <00:12:19.297>response <00:12:19.621>process.

271
00:12:20.345 --> 00:12:22.325
<00:12:20.345>So <00:12:20.578>the <00:12:20.811>server <00:12:21.045>passes <00:12:21.278>on <00:12:21.511>a <00:12:21.745>challenge,

272
00:12:22.725 --> 00:12:24.845
<00:12:22.725>a <00:12:22.880>random <00:12:23.036>string <00:12:23.191>in <00:12:23.347>the <00:12:23.502>end, <00:12:23.658>we <00:12:23.813>have <00:12:23.969>to <00:12:24.125>sign

273
00:12:24.875 --> 00:12:28.245
<00:12:24.875>with <00:12:25.050>the <00:12:25.225>private <00:12:25.400>key <00:12:25.575>that <00:12:25.750>we <00:12:25.925>use <00:12:26.100>for <00:12:26.275>registration.

274
00:12:28.985 --> 00:12:33.085
<00:12:28.985>And, <00:12:29.125>um, <00:12:29.265>all <00:12:29.405>this <00:12:29.545>stuff <00:12:29.685>is, <00:12:29.825>um, <00:12:29.965>handling <00:12:30.105>by <00:12:30.245>is <00:12:30.385>handled

275
00:12:33.265 --> 00:12:36.365
<00:12:33.265>by <00:12:33.420>the <00:12:33.576>JavaScript <00:12:33.731>API, <00:12:33.887>again, <00:12:34.042>that's <00:12:34.198>a <00:12:34.353>different, <00:12:34.509>uh, <00:12:34.665>the,

276
00:12:36.365 --> 00:12:41.205
<00:12:36.365>the <00:12:36.492>second <00:12:36.619>method <00:12:36.746>that, <00:12:36.874>um, <00:12:37.001>the <00:12:37.128>web <00:12:37.255>of <00:12:37.383>API <00:12:37.510>provides <00:12:37.637>to <00:12:37.765>us,

277
00:12:41.315 --> 00:12:42.885
<00:12:41.315>this <00:12:41.781>credentialed <00:12:42.248>get <00:12:42.715>method.

278
00:12:43.225 --> 00:12:46.605
<00:12:43.225>We <00:12:43.380>pass <00:12:43.536>in <00:12:43.691>the, <00:12:43.847>um, <00:12:44.002>the <00:12:44.158>challenge <00:12:44.313>with, <00:12:44.469>with <00:12:44.625>the

279
00:12:47.245 --> 00:12:50.925
<00:12:47.245>surrounding <00:12:47.400>metadata, <00:12:47.556>the <00:12:47.711>browser <00:12:47.867>takes <00:12:48.022>over, <00:12:48.178>has <00:12:48.333>a <00:12:48.489>log, <00:12:48.645>oh,

280
00:12:50.925 --> 00:12:53.605
<00:12:50.925>do <00:12:51.080>I <00:12:51.236>know <00:12:51.391>this <00:12:51.547>authenticator <00:12:51.702>r <00:12:51.858>there's <00:12:52.013>the <00:12:52.169>UV <00:12:52.324>key,

281
00:12:53.605 --> 00:12:54.885
<00:12:53.605>please <00:12:53.989>sign <00:12:54.373>this <00:12:54.757>challenge.

282
00:12:55.025 --> 00:12:57.525
<00:12:55.025>We <00:12:55.199>get <00:12:55.375>back <00:12:55.550>the <00:12:55.725>signature, <00:12:55.900>we <00:12:56.074>pass <00:12:56.250>this <00:12:56.425>back

283
00:12:57.525 --> 00:12:59.365
<00:12:57.525>to <00:12:57.805>the <00:12:58.084>server, <00:12:58.365>the <00:12:58.645>server <00:12:58.925>checks.

284
00:12:59.625 --> 00:13:01.245
<00:12:59.625>Is <00:12:59.975>the <00:13:00.325>signature <00:13:00.675>really <00:13:01.025>matching

285
00:13:01.305 --> 00:13:02.605
<00:13:01.305>to <00:13:01.500>the <00:13:01.694>public <00:13:01.890>key <00:13:02.085>that <00:13:02.280>I <00:13:02.475>know?

286
00:13:02.605 --> 00:13:03.645
<00:13:02.605>Is <00:13:02.839>this <00:13:03.073>all <00:13:03.307>working <00:13:03.540>out?

287
00:13:04.185 --> 00:13:06.925
<00:13:04.185>Um, <00:13:04.385>and <00:13:04.584>if, <00:13:04.785>if <00:13:04.984>that's <00:13:05.185>correct, <00:13:05.385>then <00:13:05.584>we,

288
00:13:07.305 --> 00:13:08.405
<00:13:07.305>we <00:13:07.502>can <00:13:07.700>log <00:13:07.899>in <00:13:08.097>the <00:13:08.295>user.

289
00:13:08.665 --> 00:13:12.685
<00:13:08.665>So <00:13:08.820>that's <00:13:08.976>what, <00:13:09.131>what <00:13:09.287>happening <00:13:09.442>in <00:13:09.598>this <00:13:09.753>two, <00:13:09.909>um, <00:13:10.064>ceremonies.

290
00:13:14.035 --> 00:13:17.455
<00:13:14.035>So <00:13:14.175>I <00:13:14.314>talked <00:13:14.454>a <00:13:14.594>lot <00:13:14.735>about <00:13:14.875>a <00:13:15.015>JavaScript <00:13:15.155>API <00:13:15.295>that <00:13:15.435>is

291
00:13:17.655 --> 00:13:19.775
<00:13:17.655>provided <00:13:17.829>in <00:13:18.005>the <00:13:18.180>browser, <00:13:18.355>and <00:13:18.530>that <00:13:18.704>allows <00:13:18.880>us <00:13:19.055>not

292
00:13:19.775 --> 00:13:24.615
<00:13:19.775>to <00:13:19.949>care <00:13:20.125>about <00:13:20.300>how <00:13:20.475>different <00:13:20.650>authenticators <00:13:20.824>are, <00:13:21.000>um, <00:13:21.175>handled

293
00:13:24.715 --> 00:13:26.455
<00:13:24.715>and <00:13:24.995>how <00:13:25.275>we <00:13:25.555>talk <00:13:25.835>to <00:13:26.115>them.

294
00:13:26.515 --> 00:13:29.735
<00:13:26.515>But <00:13:26.689>it's <00:13:26.865>all <00:13:27.040>encapsulated <00:13:27.215>in, <00:13:27.390>in <00:13:27.564>this <00:13:27.740>JavaScript <00:13:27.915>API.

295
00:13:30.235 --> 00:13:31.415
<00:13:30.235>And <00:13:30.589>then <00:13:30.943>of <00:13:31.297>course,

296
00:13:31.435 --> 00:13:33.815
<00:13:31.435>the <00:13:31.590>first <00:13:31.746>question <00:13:31.901>is <00:13:32.057>in <00:13:32.212>which <00:13:32.368>browsers <00:13:32.523>can <00:13:32.679>I <00:13:32.834>use?

297
00:13:33.955 --> 00:13:38.575
<00:13:33.955>And, <00:13:34.095>um, <00:13:34.235>today <00:13:34.375>we, <00:13:34.515>we <00:13:34.655>have <00:13:34.795>the, <00:13:34.935>the <00:13:35.075>good <00:13:35.215>situation <00:13:35.355>that,

298
00:13:38.875 --> 00:13:43.495
<00:13:38.875>uh, <00:13:39.050>almost <00:13:39.225>every, <00:13:39.400>um, <00:13:39.575>browser, <00:13:39.750>um, <00:13:39.925>supports <00:13:40.100>Web <00:13:40.275>N

299
00:13:43.495 --> 00:13:44.975
<00:13:43.495>and <00:13:43.761>it <00:13:44.027>supports <00:13:44.294>it <00:13:44.560>for <00:13:44.827>years.

300
00:13:45.035 --> 00:13:46.855
<00:13:45.035>So <00:13:45.235>this <00:13:45.435>is <00:13:45.635>around <00:13:45.834>for, <00:13:46.035>for <00:13:46.235>some <00:13:46.435>years.

301
00:13:47.315 --> 00:13:50.255
<00:13:47.315>Um, <00:13:47.431>if, <00:13:47.548>if <00:13:47.665>we <00:13:47.781>have <00:13:47.898>a <00:13:48.015>look <00:13:48.131>at <00:13:48.248>the, <00:13:48.365>at <00:13:48.481>the <00:13:48.598>user <00:13:48.715>percentage,

302
00:13:50.715 --> 00:13:55.015
<00:13:50.715>um, <00:13:50.855>then, <00:13:50.995>uh, <00:13:51.135>we, <00:13:51.275>we <00:13:51.415>can <00:13:51.555>see <00:13:51.695>that, <00:13:51.835>um, <00:13:51.975>I <00:13:52.115>think

303
00:13:55.015 --> 00:13:59.095
<00:13:55.015>around <00:13:55.131>95% <00:13:55.248>of <00:13:55.365>all <00:13:55.481>users, <00:13:55.598>uh, <00:13:55.715>in <00:13:55.831>the <00:13:55.948>world <00:13:56.064>use, <00:13:56.181>um, <00:13:56.298>a <00:13:56.415>browser

304
00:13:59.095 --> 00:14:00.535
<00:13:59.095>that <00:13:59.354>is <00:13:59.613>supporting <00:13:59.872>Web <00:14:00.131>of <00:14:00.391>n

305
00:14:00.645 --> 00:14:04.575
<00:14:00.645>that <00:14:00.819>is <00:14:00.995>supporting <00:14:01.170>this <00:14:01.345>tool <00:14:01.520>at <00:14:01.694>JavaScript, <00:14:01.870>uh, <00:14:02.045>APIs

306
00:14:04.575 --> 00:14:06.975
<00:14:04.575>that <00:14:04.775>we, <00:14:04.975>uh, <00:14:05.175>need <00:14:05.375>to, <00:14:05.575>to <00:14:05.775>build, <00:14:05.975>uh,

307
00:14:07.215 --> 00:14:09.095
<00:14:07.215>passwordless <00:14:07.495>authentication <00:14:07.775>in <00:14:08.055>our <00:14:08.335>web <00:14:08.615>app.

308
00:14:09.915 --> 00:14:12.855
<00:14:09.915>So <00:14:10.055>I <00:14:10.194>said <00:14:10.334>it's, <00:14:10.474>um, <00:14:10.615>been, <00:14:10.755>uh, <00:14:10.895>been <00:14:11.035>around <00:14:11.175>a <00:14:11.314>bit.

309
00:14:12.875 --> 00:14:15.695
<00:14:12.875>Uh, <00:14:12.982>I <00:14:13.090>want <00:14:13.198>to <00:14:13.305>have <00:14:13.413>a <00:14:13.521>look, <00:14:13.628>uh, <00:14:13.736>a <00:14:13.844>short <00:14:13.951>look <00:14:14.059>at <00:14:14.167>the <00:14:14.275>timeline

310
00:14:15.695 --> 00:14:18.855
<00:14:15.695>because <00:14:15.975>there's <00:14:16.255>some, <00:14:16.535>some <00:14:16.815>development <00:14:17.095>recently.

311
00:14:19.395 --> 00:14:20.855
<00:14:19.395>So <00:14:19.657>the, <00:14:19.920>the, <00:14:20.183>the <00:14:20.446>first, <00:14:20.709>um,

312
00:14:21.165 --> 00:14:24.415
<00:14:21.165>working <00:14:21.515>draft <00:14:21.865>was <00:14:22.214>from <00:14:22.564>2016.

313
00:14:24.845 --> 00:14:27.655
<00:14:24.845>Then, <00:14:25.045>uh, <00:14:25.245>Firefox <00:14:25.445>and <00:14:25.645>Chrome <00:14:25.845>already <00:14:26.045>implemented <00:14:26.245>it

314
00:14:27.655 --> 00:14:29.335
<00:14:27.655>because, <00:14:28.121>um, <00:14:28.588>Mozilla <00:14:29.055>and,

315
00:14:29.475 --> 00:14:33.775
<00:14:29.475>and <00:14:29.602>Google, <00:14:29.729>um, <00:14:29.856>are <00:14:29.984>part <00:14:30.111>of <00:14:30.238>this, <00:14:30.365>um, <00:14:30.493>of <00:14:30.620>this <00:14:30.747>working <00:14:30.875>group.

316
00:14:34.035 --> 00:14:36.375
<00:14:34.035>And <00:14:34.235>then <00:14:34.435>in <00:14:34.635>March, <00:14:34.834>2019, <00:14:35.035>there <00:14:35.235>was <00:14:35.435>the,

317
00:14:36.475 --> 00:14:38.735
<00:14:36.475>the <00:14:36.825>W <00:14:37.175>three <00:14:37.525>C <00:14:37.875>recommendation.

318
00:14:38.755 --> 00:14:41.615
<00:14:38.755>So <00:14:38.955>that's, <00:14:39.155>um, <00:14:39.355>when <00:14:39.555>it's <00:14:39.755>really, <00:14:39.955>really <00:14:40.155>standardized.

319
00:14:42.165 --> 00:14:45.055
<00:14:42.165>Then <00:14:42.281>at <00:14:42.398>the <00:14:42.515>joint, <00:14:42.631>uh, <00:14:42.748>we, <00:14:42.865>we <00:14:42.981>got <00:14:43.098>it <00:14:43.214>in <00:14:43.331>Safari <00:14:43.448>as <00:14:43.564>well.

320
00:14:45.055 --> 00:14:46.415
<00:14:45.055>That <00:14:45.361>was <00:14:45.666>a <00:14:45.973>big <00:14:46.279>milestone.

321
00:14:47.075 --> 00:14:50.615
<00:14:47.075>And, <00:14:47.250>um, <00:14:47.425>in <00:14:47.600>2022, <00:14:47.775>there <00:14:47.950>was <00:14:48.125>a <00:14:48.300>second <00:14:48.475>level

322
00:14:50.755 --> 00:14:52.045
<00:14:50.755>of <00:14:51.335>this <00:14:51.915>recommendation

323
00:14:52.045 --> 00:14:54.405
<00:14:52.045>that <00:14:52.245>really <00:14:52.444>did <00:14:52.645>not <00:14:52.844>bring <00:14:53.045>that <00:14:53.245>much <00:14:53.444>new.

324
00:14:54.865 --> 00:14:57.885
<00:14:54.865>And <00:14:55.005>then <00:14:55.145>we <00:14:55.285>had, <00:14:55.425>um, <00:14:55.565>the <00:14:55.705>summer <00:14:55.845>of, <00:14:55.985>uh, <00:14:56.125>last <00:14:56.265>year,

325
00:14:58.225 --> 00:15:00.885
<00:14:58.225>and <00:14:58.505>the <00:14:58.785>situation <00:14:59.065>last <00:14:59.345>year <00:14:59.625>was

326
00:15:00.995 --> 00:15:03.645
<00:15:00.995>that <00:15:01.228>all <00:15:01.461>the <00:15:01.695>browsers <00:15:01.928>already <00:15:02.161>supported <00:15:02.395>it.

327
00:15:03.745 --> 00:15:06.085
<00:15:03.745>So <00:15:03.920>we, <00:15:04.095>we <00:15:04.270>had <00:15:04.445>the <00:15:04.620>same <00:15:04.795>browser <00:15:04.970>support, <00:15:05.145>um,

328
00:15:06.105 --> 00:15:09.285
<00:15:06.105>as <00:15:06.260>we <00:15:06.416>have <00:15:06.571>today, <00:15:06.727>but <00:15:06.882>there <00:15:07.038>were <00:15:07.193>very <00:15:07.349>less <00:15:07.505>application

329
00:15:09.435 --> 00:15:12.285
<00:15:09.435>that <00:15:09.609>really <00:15:09.785>allowed <00:15:09.959>the <00:15:10.135>users <00:15:10.310>to, <00:15:10.484>to <00:15:10.660>log <00:15:10.834>in.

330
00:15:12.385 --> 00:15:16.045
<00:15:12.385>So <00:15:12.540>I <00:15:12.696>gave <00:15:12.851>a <00:15:13.007>similar <00:15:13.162>talk, <00:15:13.318>um, <00:15:13.473>one <00:15:13.629>year <00:15:13.785>ago.

331
00:15:16.385 --> 00:15:20.765
<00:15:16.385>And, <00:15:16.525>um, <00:15:16.665>back <00:15:16.805>then <00:15:16.944>you <00:15:17.085>only <00:15:17.225>had <00:15:17.365>two, <00:15:17.505>um, <00:15:17.645>major <00:15:17.785>applications.

332
00:15:20.885 --> 00:15:24.085
<00:15:20.885>I <00:15:21.040>I <00:15:21.196>knew <00:15:21.351>about <00:15:21.507>where <00:15:21.662>can <00:15:21.818>actually <00:15:21.973>as <00:15:22.129>a <00:15:22.285>user

333
00:15:24.715 --> 00:15:26.085
<00:15:24.715>sign <00:15:25.331>in <00:15:25.948>Passwordless.

334
00:15:26.105 --> 00:15:29.885
<00:15:26.105>So <00:15:26.245>that <00:15:26.385>was <00:15:26.525>Office <00:15:26.665>365, <00:15:26.805>but <00:15:26.945>also <00:15:27.085>only <00:15:27.225>for <00:15:27.365>Windows <00:15:27.505>users.

335
00:15:30.065 --> 00:15:31.525
<00:15:30.065>So <00:15:30.503>not <00:15:30.941>really <00:15:31.379>counting

336
00:15:31.905 --> 00:15:34.925
<00:15:31.905>and <00:15:32.045>next <00:15:32.185>cloud, <00:15:32.324>they <00:15:32.464>were, <00:15:32.605>uh, <00:15:32.745>quite, <00:15:32.885>quite <00:15:33.025>early <00:15:33.165>with, <00:15:33.305>uh,

337
00:15:34.925 --> 00:15:37.125
<00:15:34.925>implementing <00:15:35.391>real <00:15:35.858>passwordless <00:15:36.324>authentication.

338
00:15:37.575 --> 00:15:39.365
<00:15:37.575>There <00:15:37.855>were <00:15:38.135>a <00:15:38.415>lot <00:15:38.695>of <00:15:38.975>websites

339
00:15:39.365 --> 00:15:41.925
<00:15:39.365>where <00:15:39.520>you <00:15:39.676>could <00:15:39.831>use <00:15:39.987>web <00:15:40.142>N <00:15:40.298>as <00:15:40.453>a <00:15:40.609>second <00:15:40.765>factor.

340
00:15:42.065 --> 00:15:45.605
<00:15:42.065>So <00:15:42.220>in <00:15:42.376>addition <00:15:42.531>to, <00:15:42.687>um, <00:15:42.842>to <00:15:42.998>the, <00:15:43.153>uh, <00:15:43.309>normal <00:15:43.465>password.

341
00:15:45.745 --> 00:15:48.485
<00:15:45.745>So <00:15:45.920>when <00:15:46.095>GitHub <00:15:46.270>announced, <00:15:46.445>oh, <00:15:46.620>we <00:15:46.795>are <00:15:46.970>doing <00:15:47.145>web,

342
00:15:48.665 --> 00:15:51.205
<00:15:48.665>and <00:15:48.792>now <00:15:48.919>it <00:15:49.046>was <00:15:49.174>only <00:15:49.301>as <00:15:49.428>a <00:15:49.555>second <00:15:49.683>factor, <00:15:49.810>it <00:15:49.937>was <00:15:50.064>not,

343
00:15:51.505 --> 00:15:54.885
<00:15:51.505>not <00:15:51.705>a <00:15:51.905>real, <00:15:52.105>um, <00:15:52.305>passwordless <00:15:52.505>authentication <00:15:52.705>back <00:15:52.905>then.

344
00:15:55.585 --> 00:15:59.885
<00:15:55.585>Um, <00:15:55.712>and <00:15:55.839>the <00:15:55.966>problem, <00:15:56.094>why, <00:15:56.221>why <00:15:56.348>this <00:15:56.475>was, <00:15:56.603>was, <00:15:56.730>in <00:15:56.857>my <00:15:56.985>opinion,

345
00:15:59.885 --> 00:16:00.925
<00:15:59.885>mostly <00:16:00.820>usability.

346
00:16:01.305 --> 00:16:05.805
<00:16:01.305>So, <00:16:01.444>um, <00:16:01.584>most <00:16:01.724>of <00:16:01.864>you <00:16:02.005>might, <00:16:02.145>uh, <00:16:02.285>know <00:16:02.425>how <00:16:02.564>such <00:16:02.704>a

347
00:16:06.325 --> 00:16:07.765
<00:16:06.325>UV <00:16:06.541>key <00:16:06.757>or <00:16:06.973>solo <00:16:07.189>key <00:16:07.405>is <00:16:07.621>working.

348
00:16:07.875 --> 00:16:10.005
<00:16:07.875>Some <00:16:08.108>of <00:16:08.341>you <00:16:08.575>might <00:16:08.808>have <00:16:09.041>one <00:16:09.275>yourself.

349
00:16:10.425 --> 00:16:12.605
<00:16:10.425>Um, <00:16:10.704>but <00:16:10.984>my <00:16:11.265>parents, <00:16:11.545>my <00:16:11.824>grandparents,

350
00:16:12.715 --> 00:16:15.045
<00:16:12.715>they <00:16:12.890>are <00:16:13.065>not <00:16:13.240>really <00:16:13.415>used <00:16:13.590>to <00:16:13.765>something <00:16:13.940>like <00:16:14.115>that.

351
00:16:15.105 --> 00:16:17.365
<00:16:15.105>And <00:16:15.260>they <00:16:15.416>do <00:16:15.571>not <00:16:15.727>really <00:16:15.882>understand <00:16:16.038>how <00:16:16.193>do <00:16:16.349>I <00:16:16.505>have

352
00:16:17.365 --> 00:16:19.005
<00:16:17.365>to <00:16:17.715>keep <00:16:18.065>this, <00:16:18.415>what's <00:16:18.765>happening?

353
00:16:19.005 --> 00:16:22.325
<00:16:19.005>If <00:16:19.105>I <00:16:19.205>lose <00:16:19.305>it, <00:16:19.405>do <00:16:19.505>I, <00:16:19.605>can <00:16:19.705>I <00:16:19.805>give <00:16:19.905>it <00:16:20.005>to <00:16:20.105>someone <00:16:20.205>else <00:16:20.305>or <00:16:20.405>not?

354
00:16:22.945 --> 00:16:26.045
<00:16:22.945>So, <00:16:23.145>um, <00:16:23.345>that's <00:16:23.545>a <00:16:23.745>big <00:16:23.945>advantage <00:16:24.145>of <00:16:24.345>passwords.

355
00:16:26.045 --> 00:16:27.605
<00:16:26.045>They've <00:16:26.395>been <00:16:26.745>around <00:16:27.094>a <00:16:27.444>lot

356
00:16:27.665 --> 00:16:30.565
<00:16:27.665>and <00:16:27.820>everyone <00:16:27.976>knows <00:16:28.131>how <00:16:28.287>to, <00:16:28.442>um, <00:16:28.598>how <00:16:28.753>to <00:16:28.909>use <00:16:29.064>them.

357
00:16:30.585 --> 00:16:33.565
<00:16:30.585>And <00:16:30.760>even <00:16:30.935>my <00:16:31.110>grandmother <00:16:31.285>understands <00:16:31.460>that <00:16:31.635>she's <00:16:31.810>not, <00:16:31.985>um,

358
00:16:33.565 --> 00:16:35.805
<00:16:33.565>allowed <00:16:33.765>to <00:16:33.965>tell <00:16:34.165>her <00:16:34.365>passwords <00:16:34.565>to <00:16:34.765>anyone <00:16:34.965>else.

359
00:16:35.945 --> 00:16:38.485
<00:16:35.945>But, <00:16:36.178>uh, <00:16:36.411>other <00:16:36.645>kinds <00:16:36.878>of, <00:16:37.111>uh, <00:16:37.345>authentication,

360
00:16:38.555 --> 00:16:39.765
<00:16:38.555>also <00:16:39.099>biometric <00:16:39.644>features.

361
00:16:39.875 --> 00:16:43.085
<00:16:39.875>There's <00:16:40.030>a <00:16:40.186>lot <00:16:40.341>of <00:16:40.497>people <00:16:40.652>that <00:16:40.808>really <00:16:40.963>do <00:16:41.119>not <00:16:41.275>know

362
00:16:43.225 --> 00:16:44.365
<00:16:43.225>how, <00:16:43.481>how <00:16:43.738>this <00:16:43.994>is <00:16:44.251>working.

363
00:16:45.255 --> 00:16:47.875
<00:16:45.255>And <00:16:45.395>also <00:16:45.535>there <00:16:45.675>was <00:16:45.814>a <00:16:45.955>big <00:16:46.095>problem <00:16:46.235>that <00:16:46.375>if <00:16:46.515>you <00:16:46.655>want

364
00:16:47.875 --> 00:16:50.675
<00:16:47.875>to <00:16:48.030>sign <00:16:48.186>in <00:16:48.341>on <00:16:48.497>multiple <00:16:48.652>devices <00:16:48.808>with <00:16:48.963>the <00:16:49.119>same <00:16:49.275>account,

365
00:16:51.015 --> 00:16:53.715
<00:16:51.015>you <00:16:51.189>needed <00:16:51.365>some <00:16:51.540>kind <00:16:51.715>of, <00:16:51.890>uh, <00:16:52.064>this <00:16:52.240>UB <00:16:52.415>key

366
00:16:53.715 --> 00:16:55.675
<00:16:53.715>or <00:16:53.995>some <00:16:54.275>kind <00:16:54.555>of <00:16:54.835>external <00:16:55.115>authenticated

367
00:16:55.675 --> 00:16:58.115
<00:16:55.675>to <00:16:55.954>pass <00:16:56.234>your <00:16:56.515>credentials, <00:16:56.795>um, <00:16:57.074>along.

368
00:16:58.135 --> 00:17:02.555
<00:16:58.135>So <00:16:58.262>it <00:16:58.389>was <00:16:58.516>not, <00:16:58.644>uh, <00:16:58.771>really <00:16:58.898>possible <00:16:59.025>to, <00:16:59.153>um, <00:16:59.280>if <00:16:59.407>you <00:16:59.535>used,

369
00:17:02.735 --> 00:17:05.995
<00:17:02.735>for <00:17:02.910>example, <00:17:03.085>touch <00:17:03.260>Id <00:17:03.435>on <00:17:03.610>on <00:17:03.785>your <00:17:03.960>platform, <00:17:04.135>um,

370
00:17:06.015 --> 00:17:09.755
<00:17:06.015>you <00:17:06.215>could <00:17:06.415>use, <00:17:06.615>um, <00:17:06.815>um, <00:17:07.015>um, <00:17:07.215>passwordless <00:17:07.415>authentication,

371
00:17:09.755 --> 00:17:11.955
<00:17:09.755>but <00:17:09.882>then <00:17:10.009>if <00:17:10.136>you <00:17:10.264>wanted <00:17:10.391>to <00:17:10.518>log <00:17:10.645>in <00:17:10.773>on <00:17:10.900>your <00:17:11.027>Android <00:17:11.155>phone,

372
00:17:11.955 --> 00:17:13.675
<00:17:11.954>it <00:17:12.234>was <00:17:12.514>not <00:17:12.794>really <00:17:13.074>possible <00:17:13.355>to,

373
00:17:13.775 --> 00:17:15.315
<00:17:13.775>to <00:17:14.121>transport <00:17:14.468>this <00:17:14.814>credentials <00:17:15.161>along

374
00:17:15.315 --> 00:17:19.075
<00:17:15.315>because, <00:17:15.455>um, <00:17:15.595>part <00:17:15.735>of <00:17:15.875>the <00:17:16.015>web <00:17:16.155>of <00:17:16.295>N <00:17:16.435>standard <00:17:16.575>is <00:17:16.715>the,

375
00:17:19.335 --> 00:17:23.435
<00:17:19.335>the <00:17:19.475>strong <00:17:19.615>security <00:17:19.755>of <00:17:19.895>the <00:17:20.035>secret <00:17:20.175>is <00:17:20.315>not <00:17:20.454>leaving <00:17:20.595>the <00:17:20.735>device.

376
00:17:23.615 --> 00:17:26.595
<00:17:23.615>So <00:17:23.731>we <00:17:23.848>have <00:17:23.964>this <00:17:24.081>private <00:17:24.198>key <00:17:24.315>on <00:17:24.431>the <00:17:24.548>device, <00:17:24.665>on <00:17:24.781>the <00:17:24.898>UI <00:17:25.015>key,

377
00:17:26.595 --> 00:17:29.435
<00:17:26.595>but <00:17:26.735>also <00:17:26.875>maybe <00:17:27.015>on, <00:17:27.155>on <00:17:27.295>your <00:17:27.435>laptop <00:17:27.575>or <00:17:27.714>on <00:17:27.855>your <00:17:27.995>phone,

378
00:17:29.495 --> 00:17:30.595
<00:17:29.495>and <00:17:29.742>it <00:17:29.990>is <00:17:30.237>secured <00:17:30.485>there,

379
00:17:30.615 --> 00:17:32.915
<00:17:30.615>and <00:17:30.790>it <00:17:30.965>should <00:17:31.140>not <00:17:31.315>get <00:17:31.490>outside <00:17:31.665>of, <00:17:31.840>of <00:17:32.015>this,

380
00:17:33.095 --> 00:17:34.555
<00:17:33.095>um, <00:17:33.533>of <00:17:33.971>this <00:17:34.409>device.

381
00:17:34.935 --> 00:17:38.275
<00:17:34.935>So <00:17:35.075>this <00:17:35.215>was, <00:17:35.355>was <00:17:35.495>a <00:17:35.635>big <00:17:35.774>problem <00:17:35.915>of, <00:17:36.054>of <00:17:36.195>the <00:17:36.335>authenticators

382
00:17:38.335 --> 00:17:39.355
<00:17:38.335>and <00:17:38.641>of <00:17:38.947>the <00:17:39.253>portability.

383
00:17:40.295 --> 00:17:42.795
<00:17:40.295>So, <00:17:40.761>um, <00:17:41.228>this <00:17:41.695>usability

384
00:17:43.135 --> 00:17:45.835
<00:17:43.135>and <00:17:43.415>security <00:17:43.695>trade-offs <00:17:43.975>had <00:17:44.254>the <00:17:44.535>effect

385
00:17:45.835 --> 00:17:48.635
<00:17:45.835>that <00:17:46.010>it <00:17:46.185>was <00:17:46.360>not <00:17:46.535>really, <00:17:46.710>um, <00:17:46.885>taken <00:17:47.060>over <00:17:47.235>by,

386
00:17:48.655 --> 00:17:50.845
<00:17:48.655>by <00:17:48.855>web <00:17:49.055>applications <00:17:49.254>and, <00:17:49.455>and, <00:17:49.655>and <00:17:49.855>by <00:17:50.055>users.

387
00:17:51.465 --> 00:17:54.565
<00:17:51.465>So, <00:17:51.620>um, <00:17:51.776>but <00:17:51.931>then <00:17:52.087>last <00:17:52.242>year <00:17:52.398>something <00:17:52.553>happened <00:17:52.709>that <00:17:52.865>might,

388
00:17:54.635 --> 00:17:57.845
<00:17:54.635>some <00:17:54.810>of <00:17:54.985>you <00:17:55.160>might <00:17:55.335>might <00:17:55.510>know <00:17:55.685>that, <00:17:55.860>uh, <00:17:56.035>Google

389
00:17:58.065 --> 00:18:02.085
<00:17:58.065>and <00:17:58.240>Apple <00:17:58.415>both <00:17:58.590>introduced <00:17:58.765>on <00:17:58.940>the <00:17:59.115>developer <00:17:59.290>conferences <00:17:59.465>that,

390
00:18:02.265 --> 00:18:05.285
<00:18:02.265>um, <00:18:02.498>they <00:18:02.731>introduced <00:18:02.965>a <00:18:03.198>new <00:18:03.431>passwordless <00:18:03.665>form

391
00:18:05.285 --> 00:18:07.565
<00:18:05.285>of <00:18:05.485>out <00:18:05.685>the <00:18:05.885>indication <00:18:06.085>they <00:18:06.285>called <00:18:06.485>pass <00:18:06.685>keys.

392
00:18:07.825 --> 00:18:11.125
<00:18:07.825>So <00:18:07.980>what's <00:18:08.136>this <00:18:08.291>all <00:18:08.447>about? <00:18:08.602>Is <00:18:08.758>this <00:18:08.913>something <00:18:09.069>completely <00:18:09.225>new?

393
00:18:11.265 --> 00:18:13.365
<00:18:11.265>Is <00:18:11.465>this <00:18:11.665>the <00:18:11.865>same <00:18:12.065>as <00:18:12.265>web <00:18:12.465>of <00:18:12.665>Anzo?

394
00:18:13.365 --> 00:18:16.285
<00:18:13.365>We <00:18:13.505>wanna <00:18:13.645>wanna <00:18:13.785>have <00:18:13.925>a <00:18:14.065>look <00:18:14.205>at <00:18:14.345>that, <00:18:14.485>uh, <00:18:14.625>now, <00:18:14.765>um,

395
00:18:16.305 --> 00:18:19.445
<00:18:16.305>for <00:18:16.445>the <00:18:16.585>last <00:18:16.725>minute, <00:18:16.865>and <00:18:17.005>also <00:18:17.145>why <00:18:17.285>this <00:18:17.425>is, <00:18:17.565>uh, <00:18:17.705>interesting

396
00:18:19.665 --> 00:18:21.765
<00:18:19.665>for, <00:18:19.945>um, <00:18:20.225>for <00:18:20.504>the <00:18:20.784>further <00:18:21.065>development.

397
00:18:22.065 --> 00:18:25.645
<00:18:22.065>So, <00:18:22.265>um, <00:18:22.465>long, <00:18:22.665>short, <00:18:22.865>uh, <00:18:23.065>story <00:18:23.265>short, <00:18:23.465>um,

398
00:18:26.285 --> 00:18:29.205
<00:18:26.285>pass <00:18:26.425>keys <00:18:26.565>are <00:18:26.705>in <00:18:26.845>the <00:18:26.985>end <00:18:27.125>just <00:18:27.265>web <00:18:27.405>of <00:18:27.545>N <00:18:27.685>credentials.

399
00:18:29.225 --> 00:18:32.645
<00:18:29.225>So <00:18:29.365>the <00:18:29.504>standard <00:18:29.645>on <00:18:29.784>underneath <00:18:29.925>is <00:18:30.064>still, <00:18:30.205>uh, <00:18:30.344>web <00:18:30.485>of <00:18:30.625>N,

400
00:18:33.065 --> 00:18:36.365
<00:18:33.065>but <00:18:33.220>the <00:18:33.376>big <00:18:33.531>platforms <00:18:33.687>added <00:18:33.842>a <00:18:33.998>lot <00:18:34.153>of <00:18:34.309>usability <00:18:34.465>here

401
00:18:36.395 --> 00:18:40.005
<00:18:36.395>that <00:18:36.522>makes <00:18:36.649>it <00:18:36.776>easier <00:18:36.904>for <00:18:37.031>the <00:18:37.158>users <00:18:37.285>to <00:18:37.413>actually <00:18:37.540>use <00:18:37.667>this, <00:18:37.795>um,

402
00:18:40.025 --> 00:18:41.245
<00:18:40.025>web <00:18:40.391>of <00:18:40.757>n <00:18:41.122>credentials.

403
00:18:41.705 --> 00:18:46.085
<00:18:41.705>And, <00:18:41.879>um, <00:18:42.054>these <00:18:42.230>three, <00:18:42.405>uh, <00:18:42.580>usability <00:18:42.754>features <00:18:42.929>are, <00:18:43.105>yeah,

404
00:18:46.465 --> 00:18:49.525
<00:18:46.465>the <00:18:46.620>integration <00:18:46.776>of <00:18:46.931>the <00:18:47.087>credentials <00:18:47.242>in <00:18:47.398>the, <00:18:47.553>in <00:18:47.709>the <00:18:47.865>platforms,

405
00:18:49.905 --> 00:18:53.725
<00:18:49.905>the <00:18:50.080>syncing <00:18:50.254>of <00:18:50.430>the <00:18:50.605>credentials <00:18:50.780>across, <00:18:50.955>um, <00:18:51.129>your <00:18:51.305>devices

406
00:18:54.265 --> 00:18:55.485
<00:18:54.265>and, <00:18:54.631>and <00:18:54.997>new <00:18:55.362>portability.

407
00:18:55.625 --> 00:18:57.045
<00:18:55.625>So <00:18:55.838>let's <00:18:56.051>have <00:18:56.264>a <00:18:56.477>look <00:18:56.690>at <00:18:56.903>this.

408
00:18:57.425 --> 00:19:00.565
<00:18:57.425>So, <00:18:57.625>um, <00:18:57.825>Google, <00:18:58.024>uh, <00:18:58.225>and, <00:18:58.425>and, <00:18:58.625>uh, <00:18:58.825>apple

409
00:19:00.625 --> 00:19:05.045
<00:19:00.625>and <00:19:00.825>later <00:19:01.025>also <00:19:01.225>Microsoft, <00:19:01.425>they <00:19:01.625>integrated, <00:19:01.825>uh, <00:19:02.025>web

410
00:19:05.225 --> 00:19:06.965
<00:19:05.225>and <00:19:05.574>credentials <00:19:05.925>as <00:19:06.274>pass <00:19:06.625>keys.

411
00:19:06.965 --> 00:19:09.205
<00:19:06.965>That's <00:19:07.198>their <00:19:07.431>marketing <00:19:07.665>term <00:19:07.898>in <00:19:08.131>the <00:19:08.365>end

412
00:19:09.345 --> 00:19:13.685
<00:19:09.345>for <00:19:09.500>web <00:19:09.656>end <00:19:09.811>credentials <00:19:09.967>into <00:19:10.122>the, <00:19:10.278>the <00:19:10.433>ecosystems <00:19:10.589>of, <00:19:10.745>um,

413
00:19:13.985 --> 00:19:16.405
<00:19:13.985>of <00:19:14.264>the, <00:19:14.544>um, <00:19:14.824>of <00:19:15.104>their <00:19:15.385>platform.

414
00:19:16.505 --> 00:19:18.125
<00:19:16.505>So, <00:19:16.785>um, <00:19:17.065>you <00:19:17.345>can <00:19:17.625>connect <00:19:17.905>web

415
00:19:18.305 --> 00:19:21.245
<00:19:18.305>and <00:19:18.480>credentials <00:19:18.655>as <00:19:18.830>pass <00:19:19.005>keys <00:19:19.180>to <00:19:19.355>your <00:19:19.530>Apple <00:19:19.705>ID

416
00:19:21.245 --> 00:19:22.885
<00:19:21.245>or <00:19:21.524>to <00:19:21.804>your <00:19:22.084>Google, <00:19:22.364>uh, <00:19:22.645>account.

417
00:19:23.265 --> 00:19:26.405
<00:19:23.265>And, <00:19:23.440>um, <00:19:23.615>they <00:19:23.790>also, <00:19:23.965>yeah, <00:19:24.140>push <00:19:24.315>their <00:19:24.490>users, <00:19:24.665>um,

418
00:19:26.565 --> 00:19:29.485
<00:19:26.565>a <00:19:26.681>bit <00:19:26.798>in <00:19:26.915>the, <00:19:27.031>in <00:19:27.148>the <00:19:27.265>last <00:19:27.381>month <00:19:27.498>to, <00:19:27.615>to <00:19:27.731>really <00:19:27.848>do <00:19:27.965>so.

419
00:19:30.065 --> 00:19:32.085
<00:19:30.065>And, <00:19:30.345>uh, <00:19:30.625>inside <00:19:30.905>of <00:19:31.185>their <00:19:31.465>platforms,

420
00:19:32.105 --> 00:19:34.685
<00:19:32.105>we <00:19:32.280>already <00:19:32.455>have <00:19:32.630>some <00:19:32.805>security <00:19:32.980>measures <00:19:33.155>like <00:19:33.330>face <00:19:33.505>Id,

421
00:19:34.685 --> 00:19:37.285
<00:19:34.685>like <00:19:34.840>touch, <00:19:34.996>ID <00:19:35.151>like <00:19:35.307>the <00:19:35.462>device <00:19:35.618>log, <00:19:35.773>um, <00:19:35.929>that, <00:19:36.085>uh,

422
00:19:37.285 --> 00:19:40.845
<00:19:37.285>will <00:19:37.460>be <00:19:37.635>used <00:19:37.810>to <00:19:37.985>secure <00:19:38.160>this <00:19:38.335>pass <00:19:38.510>keys <00:19:38.685>inside

423
00:19:40.945 --> 00:19:42.045
<00:19:40.945>of, <00:19:41.275>of <00:19:41.605>your <00:19:41.935>account.

424
00:19:43.425 --> 00:19:47.645
<00:19:43.425>So, <00:19:43.565>um, <00:19:43.705>the, <00:19:43.845>that's, <00:19:43.985>uh, <00:19:44.125>out <00:19:44.264>of <00:19:44.405>the <00:19:44.544>demo <00:19:44.685>of, <00:19:44.825>um,

425
00:19:47.945 --> 00:19:49.085
<00:19:47.945>uh, <00:19:48.287>apple <00:19:48.629>last <00:19:48.971>year.

426
00:19:49.385 --> 00:19:52.005
<00:19:49.385>You, <00:19:49.560>you <00:19:49.735>see <00:19:49.910>how, <00:19:50.085>how <00:19:50.260>pass <00:19:50.435>keys <00:19:50.610>are <00:19:50.785>integrated,

427
00:19:52.385 --> 00:19:53.525
<00:19:52.385>uh, <00:19:52.590>in <00:19:52.795>the, <00:19:53.000>in <00:19:53.205>the <00:19:53.411>devices.

428
00:19:53.625 --> 00:19:56.005
<00:19:53.625>We <00:19:53.765>have <00:19:53.905>a, <00:19:54.045>um, <00:19:54.185>a <00:19:54.325>MacBook <00:19:54.465>on, <00:19:54.605>on <00:19:54.745>the <00:19:54.885>left <00:19:55.025>side

429
00:19:56.105 --> 00:19:57.245
<00:19:56.105>and <00:19:56.447>iPhone <00:19:56.789>on <00:19:57.130>divide,

430
00:19:57.745 --> 00:20:01.005
<00:19:57.745>and <00:19:57.919>you <00:19:58.094>can <00:19:58.270>use <00:19:58.445>the <00:19:58.620>same <00:19:58.794>credentials, <00:19:58.969>um, <00:19:59.145>for,

431
00:20:01.105 --> 00:20:03.045
<00:20:01.105>for <00:20:01.455>both <00:20:01.805>the, <00:20:02.155>um, <00:20:02.505>devices.

432
00:20:03.505 --> 00:20:06.085
<00:20:03.505>And <00:20:03.660>also <00:20:03.816>it <00:20:03.971>is <00:20:04.127>integrated <00:20:04.282>in <00:20:04.438>a <00:20:04.593>way <00:20:04.749>that, <00:20:04.905>um,

433
00:20:06.275 --> 00:20:09.845
<00:20:06.275>when <00:20:06.415>you <00:20:06.555>click <00:20:06.695>in, <00:20:06.835>in <00:20:06.975>the, <00:20:07.115>in <00:20:07.255>the <00:20:07.395>username, <00:20:07.535>um, <00:20:07.675>field,

434
00:20:10.075 --> 00:20:13.365
<00:20:10.075>then <00:20:10.202>it <00:20:10.329>already <00:20:10.456>asks <00:20:10.584>you, <00:20:10.711>Hey, <00:20:10.838>you <00:20:10.965>already <00:20:11.093>have <00:20:11.220>a <00:20:11.347>pass <00:20:11.475>key

435
00:20:13.505 --> 00:20:14.525
<00:20:13.505>for <00:20:13.964>this <00:20:14.423>website.

436
00:20:14.985 --> 00:20:16.485
<00:20:14.985>Um, <00:20:15.209>do <00:20:15.435>you <00:20:15.659>want <00:20:15.885>to <00:20:16.110>use <00:20:16.334>this?

437
00:20:16.545 --> 00:20:19.525
<00:20:16.545>So, <00:20:16.700>um, <00:20:16.856>that's <00:20:17.011>the, <00:20:17.167>the, <00:20:17.322>uh, <00:20:17.478>difference <00:20:17.633>to <00:20:17.789>my <00:20:17.945>demo.

438
00:20:19.585 --> 00:20:22.165
<00:20:19.585>Before <00:20:19.760>that, <00:20:19.935>I <00:20:20.110>still <00:20:20.285>had <00:20:20.460>to <00:20:20.635>enter <00:20:20.810>my <00:20:20.985>username

439
00:20:22.185 --> 00:20:23.525
<00:20:22.185>and <00:20:22.486>the <00:20:22.788>process <00:20:23.089>started <00:20:23.391>again.

440
00:20:23.785 --> 00:20:26.085
<00:20:23.785>Now <00:20:23.985>it's <00:20:24.185>even <00:20:24.385>more <00:20:24.585>integrated <00:20:24.785>into <00:20:24.985>the <00:20:25.185>platforms

441
00:20:26.275 --> 00:20:28.445
<00:20:26.275>that <00:20:26.450>they <00:20:26.625>know, <00:20:26.800>what, <00:20:26.975>what <00:20:27.150>credentials <00:20:27.325>do <00:20:27.500>you <00:20:27.675>have

442
00:20:28.465 --> 00:20:31.005
<00:20:28.465>and, <00:20:28.620>um, <00:20:28.776>ask <00:20:28.931>you <00:20:29.087>if <00:20:29.242>you <00:20:29.398>want <00:20:29.553>to <00:20:29.709>use <00:20:29.865>them.

443
00:20:31.905 --> 00:20:34.605
<00:20:31.905>The <00:20:32.045>other <00:20:32.185>big <00:20:32.325>thing <00:20:32.465>is <00:20:32.605>it's, <00:20:32.745>it's <00:20:32.885>closely <00:20:33.024>connected <00:20:33.165>to <00:20:33.305>that,

444
00:20:34.635 --> 00:20:37.485
<00:20:34.635>that <00:20:34.868>the, <00:20:35.101>the <00:20:35.335>credentials <00:20:35.568>are <00:20:35.801>now <00:20:36.035>soon.

445
00:20:37.545 --> 00:20:39.885
<00:20:37.545>So <00:20:37.700>if <00:20:37.856>you <00:20:38.011>have <00:20:38.167>a <00:20:38.322>credential <00:20:38.478>created <00:20:38.633>on <00:20:38.789>your <00:20:38.945>MacBook

446
00:20:40.265 --> 00:20:42.565
<00:20:40.265>and <00:20:40.420>you, <00:20:40.576>uh, <00:20:40.731>want <00:20:40.887>to <00:20:41.042>use <00:20:41.198>it <00:20:41.353>on <00:20:41.509>your <00:20:41.665>iPhone

447
00:20:42.565 --> 00:20:44.925
<00:20:42.565>and <00:20:42.740>it's, <00:20:42.915>um, <00:20:43.090>connected <00:20:43.265>by <00:20:43.440>the <00:20:43.615>same <00:20:43.790>Apple <00:20:43.965>id,

448
00:20:44.925 --> 00:20:48.245
<00:20:44.925>you <00:20:45.065>can <00:20:45.205>just <00:20:45.345>do <00:20:45.485>so <00:20:45.625>and <00:20:45.764>use <00:20:45.905>the <00:20:46.044>same, <00:20:46.185>uh, <00:20:46.325>credentials.

449
00:20:48.705 --> 00:20:51.605
<00:20:48.705>Um, <00:20:48.938>there. <00:20:49.171>So <00:20:49.405>that's, <00:20:49.638>um, <00:20:49.871>currently <00:20:50.105>valid

450
00:20:51.665 --> 00:20:52.805
<00:20:51.665>for, <00:20:51.921>for <00:20:52.178>Google <00:20:52.434>and <00:20:52.691>Apple.

451
00:20:52.875 --> 00:20:55.125
<00:20:52.875>They <00:20:53.108>both, <00:20:53.341>um, <00:20:53.575>integrated <00:20:53.808>it <00:20:54.041>in <00:20:54.275>the,

452
00:20:55.125 --> 00:20:56.485
<00:20:55.125>the <00:20:55.329>key <00:20:55.533>chain <00:20:55.736>or <00:20:55.941>the <00:20:56.145>password <00:20:56.349>manager.

453
00:20:56.915 --> 00:20:58.725
<00:20:56.915>They <00:20:57.264>claim <00:20:57.615>it's <00:20:57.965>end-to-end <00:20:58.315>protected.

454
00:20:59.025 --> 00:21:01.685
<00:20:59.025>Um, <00:20:59.200>we, <00:20:59.375>we <00:20:59.550>will <00:20:59.725>see, <00:20:59.900>uh, <00:21:00.075>how, <00:21:00.250>how, <00:21:00.425>uh,

455
00:21:01.685 --> 00:21:02.965
<00:21:01.685>this <00:21:01.915>works <00:21:02.145>out <00:21:02.376>in <00:21:02.606>the <00:21:02.837>future.

456
00:21:03.625 --> 00:21:06.405
<00:21:03.625>Um, <00:21:03.752>Microsoft, <00:21:03.879>as <00:21:04.006>far <00:21:04.134>as <00:21:04.261>I <00:21:04.388>know, <00:21:04.515>did <00:21:04.643>not <00:21:04.770>syn <00:21:04.897>it <00:21:05.025>yet,

457
00:21:06.405 --> 00:21:07.845
<00:21:06.405>but <00:21:06.621>they <00:21:06.837>are <00:21:07.053>planning <00:21:07.269>on <00:21:07.485>do <00:21:07.701>so.

458
00:21:09.445 --> 00:21:10.545
<00:21:09.445>But, <00:21:10.435>um,

459
00:21:10.615 --> 00:21:13.945
<00:21:10.615>even <00:21:10.755>if <00:21:10.895>this <00:21:11.035>looks <00:21:11.175>like <00:21:11.315>the <00:21:11.455>things <00:21:11.595>are <00:21:11.735>more <00:21:11.875>concentrating <00:21:12.015>on

460
00:21:13.945 --> 00:21:16.585
<00:21:13.945>the <00:21:14.085>platforms <00:21:14.225>and <00:21:14.365>you <00:21:14.504>syn <00:21:14.645>it <00:21:14.784>inside <00:21:14.925>of <00:21:15.064>your <00:21:15.205>Apple <00:21:15.345>id,

461
00:21:16.585 --> 00:21:19.745
<00:21:16.585>but <00:21:16.760>then <00:21:16.935>you're <00:21:17.110>stuck <00:21:17.285>in, <00:21:17.460>in, <00:21:17.635>in <00:21:17.810>one <00:21:17.985>platform,

462
00:21:19.935 --> 00:21:22.545
<00:21:19.935>this <00:21:20.075>is <00:21:20.215>not <00:21:20.355>the <00:21:20.495>case <00:21:20.635>because <00:21:20.774>they <00:21:20.915>also <00:21:21.054>introduced <00:21:21.195>a <00:21:21.335>new

463
00:21:22.725 --> 00:21:26.585
<00:21:22.725>method <00:21:22.899>of, <00:21:23.074>uh, <00:21:23.250>cross <00:21:23.425>device <00:21:23.600>usage <00:21:23.774>of <00:21:23.949>pass <00:21:24.125>keys.

464
00:21:26.965 --> 00:21:30.025
<00:21:26.965>Um, <00:21:27.081>we, <00:21:27.198>we <00:21:27.314>will <00:21:27.431>just <00:21:27.548>have <00:21:27.665>a <00:21:27.781>quick <00:21:27.898>look <00:21:28.014>at <00:21:28.131>the <00:21:28.248>demo <00:21:28.365>here.

465
00:21:30.445 --> 00:21:33.345
<00:21:30.445>Um, <00:21:30.645>so <00:21:30.845>let's <00:21:31.044>wait <00:21:31.245>until <00:21:31.445>it <00:21:31.645>starts <00:21:31.845>again.

466
00:21:33.765 --> 00:21:36.945
<00:21:33.765>So <00:21:33.905>we <00:21:34.045>have, <00:21:34.185>um, <00:21:34.325>um, <00:21:34.465>um, <00:21:34.605>MacBook <00:21:34.745>on <00:21:34.885>the <00:21:35.025>left <00:21:35.165>side

467
00:21:36.965 --> 00:21:39.425
<00:21:36.965>and <00:21:37.105>then, <00:21:37.245>uh, <00:21:37.385>an <00:21:37.524>Android <00:21:37.665>phone <00:21:37.804>on <00:21:37.945>the, <00:21:38.084>on <00:21:38.225>the <00:21:38.365>right.

468
00:21:39.765 --> 00:21:41.705
<00:21:39.765>And <00:21:39.965>if <00:21:40.165>I <00:21:40.365>want <00:21:40.565>to <00:21:40.765>log <00:21:40.965>in <00:21:41.165>now,

469
00:21:41.725 --> 00:21:43.985
<00:21:41.725>and <00:21:41.880>I <00:21:42.036>do <00:21:42.191>not <00:21:42.347>have <00:21:42.502>a <00:21:42.658>credential, <00:21:42.813>it <00:21:42.969>allows <00:21:43.125>me

470
00:21:43.985 --> 00:21:48.625
<00:21:43.985>to <00:21:44.112>open <00:21:44.239>a <00:21:44.366>QR <00:21:44.494>code <00:21:44.621>instead <00:21:44.748>that <00:21:44.875>I <00:21:45.003>can <00:21:45.130>scan <00:21:45.257>with <00:21:45.385>my,

471
00:21:48.845 --> 00:21:50.985
<00:21:48.845>um, <00:21:49.125>phone <00:21:49.405>with <00:21:49.685>my <00:21:49.965>Android <00:21:50.245>phone.

472
00:21:51.565 --> 00:21:55.105
<00:21:51.565>And <00:21:51.720>then <00:21:51.876>what's <00:21:52.031>happening <00:21:52.187>in, <00:21:52.342>in, <00:21:52.498>in <00:21:52.653>the <00:21:52.809>background <00:21:52.965>is

473
00:21:55.105 --> 00:21:58.465
<00:21:55.105>that <00:21:55.305>the, <00:21:55.505>uh, <00:21:55.705>web <00:21:55.905>application <00:21:56.105>in <00:21:56.305>the <00:21:56.505>browser

474
00:21:58.645 --> 00:22:02.825
<00:21:58.645>and <00:21:58.785>the, <00:21:58.925>um, <00:21:59.065>pass <00:21:59.205>key <00:21:59.345>storage <00:21:59.485>in <00:21:59.625>my <00:21:59.764>phone <00:21:59.905>are <00:22:00.045>communicating

475
00:22:02.825 --> 00:22:05.545
<00:22:02.825>with, <00:22:02.965>with <00:22:03.105>each <00:22:03.245>other, <00:22:03.385>and <00:22:03.525>they <00:22:03.665>are <00:22:03.805>doing <00:22:03.945>the <00:22:04.085>sign <00:22:04.225>in

476
00:22:05.545 --> 00:22:09.825
<00:22:05.545>that <00:22:05.685>was <00:22:05.825>done, <00:22:05.965>um, <00:22:06.105>for <00:22:06.245>example, <00:22:06.385>with <00:22:06.525>the <00:22:06.665>UBI <00:22:06.805>key <00:22:06.945>before.

477
00:22:09.825 --> 00:22:13.345
<00:22:09.825>So <00:22:09.980>this <00:22:10.136>challenge <00:22:10.291>response <00:22:10.447>for, <00:22:10.602>um, <00:22:10.758>process, <00:22:10.913>um, <00:22:11.069>in <00:22:11.225>the,

478
00:22:13.345 --> 00:22:15.025
<00:22:13.345>in <00:22:13.545>the <00:22:13.745>background <00:22:13.945>and <00:22:14.145>they <00:22:14.345>sign <00:22:14.545>me <00:22:14.745>in

479
00:22:15.125 --> 00:22:16.225
<00:22:15.125>on, <00:22:15.372>on <00:22:15.620>the <00:22:15.867>other <00:22:16.115>device.

480
00:22:16.285 --> 00:22:20.905
<00:22:16.285>So <00:22:16.440>that's <00:22:16.596>something <00:22:16.751>that's, <00:22:16.907>um, <00:22:17.062>quite <00:22:17.218>handy, <00:22:17.373>um, <00:22:17.529>for, <00:22:17.685>yeah,

481
00:22:20.905 --> 00:22:23.545
<00:22:20.905>signing <00:22:21.185>across <00:22:21.465>the, <00:22:21.745>the <00:22:22.024>platform <00:22:22.305>boundaries.

482
00:22:24.655 --> 00:22:28.035
<00:22:24.655>So <00:22:24.855>these <00:22:25.055>three <00:22:25.254>things, <00:22:25.455>um, <00:22:25.655>were <00:22:25.855>introduced <00:22:26.055>last,

483
00:22:28.145 --> 00:22:30.475
<00:22:28.145>last <00:22:28.378>summer, <00:22:28.611>and, <00:22:28.845>uh, <00:22:29.078>since <00:22:29.311>then <00:22:29.545>we,

484
00:22:30.495 --> 00:22:32.715
<00:22:30.495>we <00:22:30.728>saw <00:22:30.961>a <00:22:31.195>massive <00:22:31.428>growth <00:22:31.661>in <00:22:31.895>application

485
00:22:32.715 --> 00:22:35.515
<00:22:32.715>that <00:22:32.948>really <00:22:33.181>allows <00:22:33.415>real <00:22:33.648>passwordless, <00:22:33.881>uh, <00:22:34.115>authentication.

486
00:22:35.575 --> 00:22:39.195
<00:22:35.575>So, <00:22:35.750>uh, <00:22:35.925>what <00:22:36.100>took, <00:22:36.275>uh, <00:22:36.450>I <00:22:36.625>think <00:22:36.800>three <00:22:36.975>years

487
00:22:39.295 --> 00:22:42.635
<00:22:39.295>to <00:22:39.470>have <00:22:39.645>two <00:22:39.820>applications <00:22:39.995>is <00:22:40.170>now <00:22:40.345>growing <00:22:40.520>and <00:22:40.695>growing

488
00:22:43.255 --> 00:22:45.515
<00:22:43.255>and, <00:22:43.488>um, <00:22:43.721>yeah, <00:22:43.955>a <00:22:44.188>lot <00:22:44.421>of <00:22:44.655>platform

489
00:22:45.535 --> 00:22:50.035
<00:22:45.535>and <00:22:45.662>a <00:22:45.789>lot <00:22:45.916>of <00:22:46.044>applications, <00:22:46.171>uh, <00:22:46.298>allow <00:22:46.425>the <00:22:46.553>users <00:22:46.680>to, <00:22:46.807>um, <00:22:46.935>um,

490
00:22:50.295 --> 00:22:52.755
<00:22:50.295>use <00:22:50.575>Passwordless <00:22:50.855>authentication, <00:22:51.135>use <00:22:51.415>past <00:22:51.695>Keys,

491
00:22:52.935 --> 00:22:54.475
<00:22:52.935>and <00:22:53.281>also <00:22:53.628>Apple, <00:22:53.974>Google, <00:22:54.321>Microsoft,

492
00:22:54.665 --> 00:22:56.075
<00:22:54.665>they're <00:22:54.982>promoting <00:22:55.299>in <00:22:55.616>a <00:22:55.934>lot.

493
00:22:56.135 --> 00:22:58.995
<00:22:56.135>And <00:22:56.290>they <00:22:56.446>also <00:22:56.601>do <00:22:56.757>a <00:22:56.912>lot <00:22:57.068>of <00:22:57.223>the <00:22:57.379>educational <00:22:57.535>work

494
00:22:58.995 --> 00:23:00.875
<00:22:58.995>that <00:22:59.195>is <00:22:59.395>needed <00:22:59.594>for <00:22:59.794>the, <00:22:59.995>for <00:23:00.195>the <00:23:00.395>users.

495
00:23:01.495 --> 00:23:05.195
<00:23:01.495>Um, <00:23:01.635>so <00:23:01.774>this <00:23:01.915>is <00:23:02.054>why <00:23:02.195>this <00:23:02.334>is <00:23:02.475>definitely <00:23:02.614>something <00:23:02.754>you <00:23:02.895>might

496
00:23:05.225 --> 00:23:06.315
<00:23:05.225>want <00:23:05.388>to <00:23:05.552>have <00:23:05.715>a <00:23:05.879>look <00:23:06.042>at <00:23:06.206>it

497
00:23:06.375 --> 00:23:09.875
<00:23:06.375>and <00:23:06.515>want <00:23:06.655>to <00:23:06.795>see <00:23:06.935>if <00:23:07.075>that's <00:23:07.215>something <00:23:07.355>that's, <00:23:07.495>uh, <00:23:07.635>also <00:23:07.775>usable

498
00:23:09.975 --> 00:23:13.835
<00:23:09.975>for, <00:23:10.130>um, <00:23:10.286>your <00:23:10.441>applications <00:23:10.597>and <00:23:10.752>for, <00:23:10.908>for <00:23:11.063>your, <00:23:11.219>um, <00:23:11.375>users.

499
00:23:14.735 --> 00:23:18.355
<00:23:14.735>So <00:23:14.890>something <00:23:15.046>that <00:23:15.201>that's <00:23:15.357>really <00:23:15.512>important <00:23:15.668>from, <00:23:15.823>from <00:23:15.979>my, <00:23:16.135>um,

500
00:23:18.405 --> 00:23:20.115
<00:23:18.405>experience <00:23:18.754>with <00:23:19.105>Web <00:23:19.455>of <00:23:19.805>N.

501
00:23:20.455 --> 00:23:24.195
<00:23:20.455>Um, <00:23:20.595>you <00:23:20.735>still <00:23:20.875>need, <00:23:21.014>um, <00:23:21.155>to <00:23:21.294>do <00:23:21.435>the <00:23:21.574>technical <00:23:21.715>stuff <00:23:21.855>integrated

502
00:23:24.265 --> 00:23:27.235
<00:23:24.265>with <00:23:24.440>this <00:23:24.615>APIs, <00:23:24.790>um, <00:23:24.965>um, <00:23:25.140>I, <00:23:25.315>I <00:23:25.490>showed <00:23:25.665>you,

503
00:23:27.455 --> 00:23:30.315
<00:23:27.455>but <00:23:27.610>you <00:23:27.766>also <00:23:27.921>still <00:23:28.077>need <00:23:28.232>to, <00:23:28.388>um, <00:23:28.543>guide <00:23:28.699>your <00:23:28.855>users

504
00:23:30.615 --> 00:23:32.195
<00:23:30.615>and <00:23:31.081>Microsoft <00:23:31.548>Google <00:23:32.015>app.

505
00:23:32.225 --> 00:23:34.395
<00:23:32.225>They <00:23:32.425>are <00:23:32.625>doing <00:23:32.824>a <00:23:33.024>lot <00:23:33.225>of <00:23:33.425>work <00:23:33.625>there,

506
00:23:34.495 --> 00:23:37.995
<00:23:34.495>and <00:23:34.635>with, <00:23:34.774>with <00:23:34.915>pass <00:23:35.054>keys, <00:23:35.195>it's, <00:23:35.334>uh, <00:23:35.475>even <00:23:35.614>more <00:23:35.754>usable <00:23:35.895>than,

507
00:23:38.185 --> 00:23:39.675
<00:23:38.185>than <00:23:38.520>with <00:23:38.855>web <00:23:39.190>and <00:23:39.525>before.

508
00:23:39.815 --> 00:23:40.955
<00:23:39.815>So <00:23:40.157>this <00:23:40.499>really <00:23:40.841>helps,

509
00:23:41.095 --> 00:23:43.555
<00:23:41.095>but <00:23:41.328>still <00:23:41.561>users <00:23:41.795>need <00:23:42.028>to <00:23:42.261>understand <00:23:42.495>how,

510
00:23:43.735 --> 00:23:46.005
<00:23:43.735>how <00:23:43.909>they <00:23:44.084>should <00:23:44.260>use <00:23:44.435>pass <00:23:44.610>keys, <00:23:44.784>how <00:23:44.959>it's <00:23:45.135>working.

511
00:23:46.705 --> 00:23:50.485
<00:23:46.705>So, <00:23:46.879>um, <00:23:47.054>that's, <00:23:47.230>that's <00:23:47.405>something <00:23:47.580>you <00:23:47.754>should, <00:23:47.929>um, <00:23:48.105>um,

512
00:23:50.875 --> 00:23:54.605
<00:23:50.875>keep <00:23:51.002>in <00:23:51.129>mind, <00:23:51.256>but <00:23:51.384>also <00:23:51.511>that <00:23:51.638>you <00:23:51.765>want <00:23:51.893>to <00:23:52.020>promote <00:23:52.147>the <00:23:52.275>feature

513
00:23:54.705 --> 00:23:57.165
<00:23:54.705>to <00:23:54.905>the, <00:23:55.105>to <00:23:55.304>users <00:23:55.504>because <00:23:55.705>it <00:23:55.905>really <00:23:56.105>allows

514
00:23:57.645 --> 00:23:58.765
<00:23:57.645>a <00:23:57.981>much <00:23:58.317>smoother <00:23:58.653>login.

515
00:23:58.985 --> 00:24:02.805
<00:23:58.985>And, <00:23:59.112>uh, <00:23:59.239>in <00:23:59.366>the <00:23:59.494>end, <00:23:59.621>a <00:23:59.748>more <00:23:59.875>secure <00:24:00.003>login <00:24:00.130>than <00:24:00.257>users <00:24:00.385>having,

516
00:24:03.105 --> 00:24:05.205
<00:24:03.105>uh, <00:24:03.571>chosen <00:24:04.038>insecure <00:24:04.505>passwords.

517
00:24:05.465 --> 00:24:08.525
<00:24:05.465>And <00:24:05.665>we <00:24:05.865>use <00:24:06.064>them <00:24:06.264>across <00:24:06.465>different, <00:24:06.665>uh, <00:24:06.865>websites.

518
00:24:08.545 --> 00:24:11.365
<00:24:08.545>So <00:24:08.700>that's <00:24:08.856>something <00:24:09.011>you, <00:24:09.167>um, <00:24:09.322>should <00:24:09.478>have <00:24:09.633>a <00:24:09.789>look <00:24:09.945>at.

519
00:24:12.305 --> 00:24:13.765
<00:24:12.305>Uh, <00:24:12.524>you <00:24:12.743>will <00:24:12.962>get <00:24:13.181>the <00:24:13.400>slides <00:24:13.619>later

520
00:24:13.945 --> 00:24:17.365
<00:24:13.945>or, <00:24:14.052>um, <00:24:14.160>if, <00:24:14.268>if <00:24:14.375>you <00:24:14.483>want <00:24:14.591>to <00:24:14.698>have <00:24:14.806>a <00:24:14.914>look <00:24:15.021>more, <00:24:15.129>more <00:24:15.237>in <00:24:15.345>detail,

521
00:24:17.365 --> 00:24:19.365
<00:24:17.365>there <00:24:17.565>are <00:24:17.765>some <00:24:17.965>nice, <00:24:18.165>uh, <00:24:18.365>demos <00:24:18.565>out <00:24:18.765>there.

522
00:24:19.745 --> 00:24:22.165
<00:24:19.745>If <00:24:20.024>you <00:24:20.304>are <00:24:20.584>very <00:24:20.864>into <00:24:21.145>standards,

523
00:24:22.165 --> 00:24:24.285
<00:24:22.165>then <00:24:22.320>you <00:24:22.476>also <00:24:22.631>can <00:24:22.787>have <00:24:22.942>a <00:24:23.098>look <00:24:23.253>at <00:24:23.409>the <00:24:23.565>specification.

524
00:24:24.425 --> 00:24:27.605
<00:24:24.425>But, <00:24:24.580>uh, <00:24:24.736>that, <00:24:24.891>that's, <00:24:25.047>that's <00:24:25.202>more <00:24:25.358>advanced, <00:24:25.513>I <00:24:25.669>would <00:24:25.825>say.

525
00:24:27.785 --> 00:24:29.165
<00:24:27.785>But <00:24:28.033>the <00:24:28.281>demos <00:24:28.530>are <00:24:28.778>really <00:24:29.027>nice,

526
00:24:29.705 --> 00:24:32.965
<00:24:29.705>and <00:24:29.845>I <00:24:29.985>also <00:24:30.125>added <00:24:30.264>some, <00:24:30.405>some <00:24:30.544>resources <00:24:30.685>if <00:24:30.824>you <00:24:30.965>really <00:24:31.105>wanna,

527
00:24:33.345 --> 00:24:35.525
<00:24:33.345>um, <00:24:33.545>try <00:24:33.745>and <00:24:33.945>build <00:24:34.145>this <00:24:34.345>into <00:24:34.545>your <00:24:34.745>application.

528
00:24:35.525 --> 00:24:38.165
<00:24:35.525>There <00:24:35.758>are <00:24:35.991>some, <00:24:36.225>some <00:24:36.458>nice, <00:24:36.691>um, <00:24:36.925>tools

529
00:24:38.265 --> 00:24:40.125
<00:24:38.265>and <00:24:38.545>also <00:24:38.825>some, <00:24:39.105>some <00:24:39.385>developer <00:24:39.665>guides

530
00:24:40.125 --> 00:24:42.925
<00:24:40.125>that <00:24:40.300>are <00:24:40.475>really <00:24:40.650>helping, <00:24:40.825>um, <00:24:41.000>understanding <00:24:41.175>what <00:24:41.350>you <00:24:41.525>need

531
00:24:42.925 --> 00:24:45.725
<00:24:42.925>to <00:24:43.125>do <00:24:43.325>and, <00:24:43.524>um, <00:24:43.725>how, <00:24:43.925>how <00:24:44.125>this <00:24:44.325>works.

532
00:24:46.425 --> 00:24:50.005
<00:24:46.425>So, <00:24:46.532>um, <00:24:46.640>time <00:24:46.748>is <00:24:46.855>running <00:24:46.963>out <00:24:47.071>if <00:24:47.178>you <00:24:47.286>want <00:24:47.394>to <00:24:47.501>have <00:24:47.609>a <00:24:47.717>chat <00:24:47.825>about

533
00:24:50.005 --> 00:24:51.525
<00:24:50.005>what, <00:24:50.200>what <00:24:50.395>to <00:24:50.591>do <00:24:50.786>if <00:24:50.982>you <00:24:51.177>really <00:24:51.373>want

534
00:24:51.525 --> 00:24:54.605
<00:24:51.525>to <00:24:51.680>integrate <00:24:51.836>it <00:24:51.991>into <00:24:52.147>your <00:24:52.302>platform, <00:24:52.458>how <00:24:52.613>to <00:24:52.769>enroll, <00:24:52.925>um,

535
00:24:54.735 --> 00:24:55.925
<00:24:54.735>users <00:24:55.270>before <00:24:55.806>then.

536
00:24:56.265 --> 00:24:58.885
<00:24:56.265>Um, <00:24:56.498>just, <00:24:56.731>um, <00:24:56.965>yeah, <00:24:57.198>grab <00:24:57.431>me <00:24:57.665>later.

537
00:24:59.285 --> 00:25:00.765
<00:24:59.285>I <00:24:59.475>will <00:24:59.665>be <00:24:59.855>around, <00:25:00.046>uh, <00:25:00.236>the <00:25:00.426>two <00:25:00.617>days

538
00:25:00.865 --> 00:25:02.485
<00:25:00.865>so <00:25:01.065>we <00:25:01.265>can <00:25:01.465>have <00:25:01.665>a <00:25:01.865>chat <00:25:02.065>about <00:25:02.265>that.

539
00:25:02.995 --> 00:25:06.645
<00:25:02.995>What <00:25:03.111>I <00:25:03.228>want <00:25:03.344>you <00:25:03.461>to <00:25:03.578>take <00:25:03.695>away <00:25:03.811>is <00:25:03.928>that <00:25:04.044>you <00:25:04.161>might <00:25:04.278>have <00:25:04.395>heard

540
00:25:06.645 --> 00:25:08.765
<00:25:06.645>of <00:25:06.845>Web <00:25:07.045>N, <00:25:07.245>but <00:25:07.445>with <00:25:07.645>past <00:25:07.845>keys, <00:25:08.045>it,

541
00:25:08.765 --> 00:25:10.885
<00:25:08.765>this <00:25:08.965>whole <00:25:09.165>thing <00:25:09.365>really <00:25:09.565>gets <00:25:09.765>a <00:25:09.965>new <00:25:10.165>momentum,

542
00:25:11.225 --> 00:25:13.365
<00:25:11.225>and <00:25:11.458>it's <00:25:11.691>really <00:25:11.925>something, <00:25:12.158>uh, <00:25:12.391>for <00:25:12.625>us

543
00:25:13.365 --> 00:25:15.645
<00:25:13.365>as <00:25:13.565>best <00:25:13.765>web <00:25:13.965>developers <00:25:14.165>to, <00:25:14.365>to <00:25:14.565>check <00:25:14.765>out.

544
00:25:16.145 --> 00:25:19.285
<00:25:16.145>It, <00:25:16.285>it <00:25:16.425>becomes <00:25:16.565>more <00:25:16.705>usable <00:25:16.845>for <00:25:16.985>a <00:25:17.125>broader <00:25:17.264>range <00:25:17.405>of <00:25:17.545>people.

545
00:25:19.595 --> 00:25:22.525
<00:25:19.595>Also <00:25:19.770>not <00:25:19.945>tech <00:25:20.120>savvy <00:25:20.295>people <00:25:20.470>are <00:25:20.645>now <00:25:20.820>able <00:25:20.995>to,

546
00:25:22.585 --> 00:25:24.845
<00:25:22.585>to <00:25:22.865>use <00:25:23.145>this <00:25:23.425>pa <00:25:23.705>passwordless <00:25:23.985>authentication.

547
00:25:25.425 --> 00:25:29.445
<00:25:25.425>Um, <00:25:25.580>it's <00:25:25.736>a <00:25:25.891>bit, <00:25:26.047>uh, <00:25:26.202>unclear <00:25:26.358>how <00:25:26.513>this <00:25:26.669>affects <00:25:26.825>the,

548
00:25:29.445 --> 00:25:32.605
<00:25:29.445>the <00:25:29.600>standard <00:25:29.756>itself <00:25:29.911>and <00:25:30.067>the <00:25:30.222>web <00:25:30.378>of, <00:25:30.533>uh, <00:25:30.689>and <00:25:30.845>independency

549
00:25:32.605 --> 00:25:36.285
<00:25:32.605>because <00:25:32.780>it's <00:25:32.955>now <00:25:33.130>again, <00:25:33.305>concentrating <00:25:33.480>on, <00:25:33.655>on <00:25:33.830>the <00:25:34.005>platforms,

550
00:25:36.625 --> 00:25:39.485
<00:25:36.625>but <00:25:36.765>that's <00:25:36.905>something <00:25:37.045>we, <00:25:37.185>we <00:25:37.325>will <00:25:37.465>see <00:25:37.605>in, <00:25:37.745>in <00:25:37.885>the <00:25:38.025>future.

551
00:25:40.185 --> 00:25:42.005
<00:25:40.185>So <00:25:40.465>that's <00:25:40.745>it <00:25:41.024>from <00:25:41.304>my <00:25:41.585>side.

552
00:25:42.225 --> 00:25:43.245
<00:25:42.225>Uh, <00:25:42.454>thank <00:25:42.684>you <00:25:42.913>very <00:25:43.142>much,

553
00:25:43.785 --> 00:25:45.805
<00:25:43.785>and <00:25:43.985>I <00:25:44.185>am <00:25:44.385>happy <00:25:44.585>to <00:25:44.785>answer <00:25:44.985>some <00:25:45.185>questions.

554
00:25:47.055 --> 00:25:48.685
<00:25:47.055>There <00:25:47.288>have <00:25:47.521>been <00:25:47.755>a <00:25:47.988>lot <00:25:48.221>of <00:25:48.455>questions,

555
00:25:48.785 --> 00:25:50.525
<00:25:48.785>but <00:25:48.985>I <00:25:49.185>think <00:25:49.385>you <00:25:49.585>answered <00:25:49.785>some <00:25:49.985>of <00:25:50.185>them

556
00:25:50.585 --> 00:25:52.085
<00:25:50.585>during <00:25:51.035>the <00:25:51.485>talk <00:25:51.935>already.

557
00:25:52.405 --> 00:25:55.085
<00:25:52.405>That's <00:25:52.545>Good. <00:25:52.685>Some <00:25:52.825>of <00:25:52.965>the <00:25:53.105>questions <00:25:53.245>came <00:25:53.385>up <00:25:53.524>with <00:25:53.665>web <00:25:53.805>au

558
00:25:55.185 --> 00:25:58.725
<00:25:55.185>and <00:25:55.360>pass, <00:25:55.534>uh, <00:25:55.710>key, <00:25:55.885>uh, <00:25:56.060>solve <00:25:56.235>some <00:25:56.409>of <00:25:56.585>those.

559
00:25:59.225 --> 00:26:02.045
<00:25:59.225>Uh, <00:25:59.380>but <00:25:59.536>still, <00:25:59.691>uh, <00:25:59.847>one <00:26:00.002>of <00:26:00.158>the <00:26:00.313>basic <00:26:00.469>question <00:26:00.625>is

560
00:26:02.275 --> 00:26:05.125
<00:26:02.275>what <00:26:02.475>happens <00:26:02.675>if <00:26:02.875>you <00:26:03.075>lose <00:26:03.275>your <00:26:03.475>authentication <00:26:03.675>factor,

561
00:26:05.585 --> 00:26:07.085
<00:26:05.585>be <00:26:05.777>it <00:26:05.970>a <00:26:06.163>stick <00:26:06.356>or <00:26:06.549>something <00:26:06.742>like <00:26:06.935>that.

562
00:26:07.505 --> 00:26:10.285
<00:26:07.505>Uh, <00:26:07.645>how <00:26:07.785>do <00:26:07.925>you <00:26:08.065>report? <00:26:08.205>What <00:26:08.345>are <00:26:08.485>your <00:26:08.625>recovery <00:26:08.765>options? <00:26:08.905>Yeah,

563
00:26:10.395 --> 00:26:11.395
<00:26:10.395>Yeah, <00:26:10.695>good <00:26:10.995>question. <00:26:11.295>That's

564
00:26:11.395 --> 00:26:14.165
<00:26:11.395>a <00:26:11.628>question <00:26:11.861>that <00:26:12.095>comes, <00:26:12.328>uh, <00:26:12.561>most <00:26:12.795>often.

565
00:26:14.285 --> 00:26:16.325
<00:26:14.285>I, <00:26:14.425>I <00:26:14.565>would <00:26:14.705>say, <00:26:14.845>if <00:26:14.985>I <00:26:15.125>talk <00:26:15.265>about <00:26:15.405>passkey, <00:26:15.545>so <00:26:15.685>what,

566
00:26:16.325 --> 00:26:18.845
<00:26:16.325>what <00:26:16.500>happens <00:26:16.675>if <00:26:16.850>you <00:26:17.025>lose, <00:26:17.200>uh, <00:26:17.375>your, <00:26:17.550>your <00:26:17.725>authentication?

567
00:26:19.425 --> 00:26:21.525
<00:26:19.425>Um, <00:26:19.658>so <00:26:19.891>the, <00:26:20.125>the <00:26:20.358>standard <00:26:20.591>itself <00:26:20.825>does

568
00:26:21.525 --> 00:26:22.645
<00:26:21.525>not <00:26:21.777>say <00:26:22.029>anything <00:26:22.281>about <00:26:22.533>it.

569
00:26:22.705 --> 00:26:25.885
<00:26:22.705>The <00:26:22.905>standard <00:26:23.105>is <00:26:23.304>just <00:26:23.504>about <00:26:23.705>this <00:26:23.905>two <00:26:24.105>ceremonies.

570
00:26:26.105 --> 00:26:28.045
<00:26:26.105>Um, <00:26:26.260>but <00:26:26.416>in <00:26:26.571>the <00:26:26.727>end, <00:26:26.882>it's, <00:26:27.038>it's <00:26:27.193>the <00:26:27.349>same <00:26:27.505>as

571
00:26:28.045 --> 00:26:29.725
<00:26:28.045>what <00:26:28.278>happens <00:26:28.511>if <00:26:28.745>you <00:26:28.978>forget <00:26:29.211>a <00:26:29.445>password.

572
00:26:29.785 --> 00:26:33.765
<00:26:29.785>So <00:26:29.940>you <00:26:30.096>need <00:26:30.251>some <00:26:30.407>kind <00:26:30.562>of <00:26:30.718>processes <00:26:30.873>in <00:26:31.029>your <00:26:31.185>application.

573
00:26:34.265 --> 00:26:38.085
<00:26:34.265>Um, <00:26:34.392>how <00:26:34.519>to <00:26:34.646>enroll <00:26:34.774>a <00:26:34.901>user <00:26:35.028>again, <00:26:35.155>if <00:26:35.283>he <00:26:35.410>forgot <00:26:35.537>his <00:26:35.665>password,

574
00:26:38.095 --> 00:26:40.445
<00:26:38.095>maybe <00:26:38.295>not <00:26:38.495>with <00:26:38.695>an <00:26:38.895>in <00:26:39.095>secure <00:26:39.295>security <00:26:39.495>question,

575
00:26:40.465 --> 00:26:43.245
<00:26:40.465>but <00:26:40.698>with, <00:26:40.931>for <00:26:41.165>example, <00:26:41.398>validating <00:26:41.631>his <00:26:41.865>email.

576
00:26:43.255 --> 00:26:44.565
<00:26:43.255>Again, <00:26:43.549>getting <00:26:43.844>a <00:26:44.139>link <00:26:44.434>there.

577
00:26:45.025 --> 00:26:46.645
<00:26:45.025>Uh, <00:26:45.305>in <00:26:45.585>enterprise <00:26:45.865>context, <00:26:46.145>you <00:26:46.425>have

578
00:26:47.155 --> 00:26:48.645
<00:26:47.155>different, <00:26:47.490>different <00:26:47.825>kind <00:26:48.160>of <00:26:48.496>methods.

579
00:26:48.705 --> 00:26:50.325
<00:26:48.705>So <00:26:48.938>it <00:26:49.171>highly <00:26:49.405>depends <00:26:49.638>on <00:26:49.871>your <00:26:50.105>application,

580
00:26:50.325 --> 00:26:52.125
<00:26:50.325>but <00:26:50.500>the <00:26:50.675>same <00:26:50.850>things <00:26:51.025>you <00:26:51.200>have <00:26:51.375>to <00:26:51.550>think <00:26:51.725>about

581
00:26:52.195 --> 00:26:54.365
<00:26:52.195>what <00:26:52.395>happens <00:26:52.595>if <00:26:52.794>a <00:26:52.995>user <00:26:53.195>forgets <00:26:53.395>his <00:26:53.595>password?

582
00:26:54.585 --> 00:26:57.365
<00:26:54.585>You <00:26:54.740>have <00:26:54.896>to <00:26:55.051>do, <00:26:55.207>if <00:26:55.362>a <00:26:55.518>user <00:26:55.673>forgets <00:26:55.829>his <00:26:55.985>credential

583
00:26:57.385 --> 00:26:58.485
<00:26:57.385>or <00:26:57.715>loses <00:26:58.044>his <00:26:58.375>credential.

584
00:26:59.515 --> 00:27:02.335
<00:26:59.515>Uh, <00:26:59.715>one <00:26:59.915>thing, <00:27:00.115>a <00:27:00.315>question <00:27:00.515>was <00:27:00.715>about <00:27:00.915>usability.

585
00:27:02.695 --> 00:27:05.175
<00:27:02.695>I <00:27:02.928>think <00:27:03.161>Pasky <00:27:03.395>make <00:27:03.628>that <00:27:03.861>this <00:27:04.095>matter.

586
00:27:05.565 --> 00:27:07.895
<00:27:05.565>Will <00:27:05.845>your <00:27:06.125>grandmother <00:27:06.405>use <00:27:06.685>PAs <00:27:06.965>keys?

587
00:27:07.895 --> 00:27:09.455
<00:27:07.895>Because <00:27:08.128>the <00:27:08.361>question <00:27:08.595>was <00:27:08.828>when <00:27:09.061>web <00:27:09.295>author

588
00:27:09.555 --> 00:27:11.375
<00:27:09.555>or <00:27:09.788>the, <00:27:10.021>how <00:27:10.255>will <00:27:10.488>the <00:27:10.721>user <00:27:10.955>react

589
00:27:11.395 --> 00:27:13.655
<00:27:11.395>and <00:27:11.595>leave <00:27:11.795>the <00:27:11.995>e-commerce <00:27:12.195>side <00:27:12.395>PAs <00:27:12.595>keys <00:27:12.795>easier,

590
00:27:13.795 --> 00:27:15.175
<00:27:13.795>but <00:27:14.105>still, <00:27:14.416>do <00:27:14.726>you <00:27:15.037>think?

591
00:27:15.775 --> 00:27:18.615
<00:27:15.775>I <00:27:15.930>think <00:27:16.086>my, <00:27:16.241>my <00:27:16.397>grandmother <00:27:16.552>will <00:27:16.708>not, <00:27:16.863>uh, <00:27:17.019>take <00:27:17.175>it.

592
00:27:18.795 --> 00:27:20.655
<00:27:18.795>Uh, <00:27:19.145>um, <00:27:19.495>I, <00:27:19.845>I'm <00:27:20.195>afraid,

593
00:27:20.835 --> 00:27:24.455
<00:27:20.835>but <00:27:20.962>I'm, <00:27:21.089>I'm, <00:27:21.216>um, <00:27:21.344>positive <00:27:21.471>that <00:27:21.598>my, <00:27:21.725>my <00:27:21.853>parents <00:27:21.980>will <00:27:22.107>do <00:27:22.235>so

594
00:27:24.455 --> 00:27:28.375
<00:27:24.455>and <00:27:24.571>that <00:27:24.688>they, <00:27:24.804>they <00:27:24.921>can, <00:27:25.038>can <00:27:25.155>use <00:27:25.271>it <00:27:25.388>soon <00:27:25.504>to <00:27:25.621>yeah, <00:27:25.738>get <00:27:25.855>rid

595
00:27:28.375 --> 00:27:30.215
<00:27:28.375>of <00:27:28.841>their <00:27:29.308>insecure <00:27:29.775>passwords.

596
00:27:31.495 --> 00:27:34.935
<00:27:31.495>I <00:27:31.695>think <00:27:31.895>another <00:27:32.094>very <00:27:32.294>interesting <00:27:32.495>questions <00:27:32.695>is <00:27:32.895>about

597
00:27:35.045 --> 00:27:37.455
<00:27:35.045>different <00:27:35.325>algorithms, <00:27:35.605>uh, <00:27:35.885>when <00:27:36.165>it <00:27:36.445>comes

598
00:27:37.455 --> 00:27:38.935
<00:27:37.455>to <00:27:38.120>quantum <00:27:38.787>computing.

599
00:27:39.235 --> 00:27:42.855
<00:27:39.235>So, <00:27:39.390>uh, <00:27:39.546>how <00:27:39.701>secure <00:27:39.857>are <00:27:40.012>those <00:27:40.168>algorithms <00:27:40.323>with <00:27:40.479>PA <00:27:40.635>Pasky?

600
00:27:42.955 --> 00:27:46.495
<00:27:42.955>So <00:27:43.129>are <00:27:43.304>there, <00:27:43.480>is <00:27:43.655>there <00:27:43.830>any <00:27:44.004>roadmap <00:27:44.179>for <00:27:44.355>that?

601
00:27:47.545 --> 00:27:50.525
<00:27:47.545>So <00:27:47.685>I, <00:27:47.825>I <00:27:47.965>don't <00:27:48.105>know <00:27:48.245>about <00:27:48.385>anything <00:27:48.525>on <00:27:48.665>the <00:27:48.805>roadmap <00:27:48.945>for,

602
00:27:50.585 --> 00:27:54.005
<00:27:50.585>for <00:27:50.725>the <00:27:50.865>working <00:27:51.005>group, <00:27:51.145>but <00:27:51.285>um, <00:27:51.425>yeah, <00:27:51.565>the <00:27:51.705>server <00:27:51.845>can <00:27:51.985>specify

603
00:27:54.155 --> 00:27:58.245
<00:27:54.155>what <00:27:54.330>algorithms <00:27:54.504>should <00:27:54.680>be <00:27:54.855>used, <00:27:55.030>um, <00:27:55.205>if <00:27:55.379>you, <00:27:55.555>um,

604
00:27:58.945 --> 00:28:00.285
<00:27:58.945>are <00:27:59.246>a <00:27:59.548>bit <00:27:59.849>into <00:28:00.151>cryptography.

605
00:28:01.185 --> 00:28:02.885
<00:28:01.185>So <00:28:01.534>there <00:28:01.885>are <00:28:02.235>some <00:28:02.585>algorithms

606
00:28:02.885 --> 00:28:07.125
<00:28:02.885>that <00:28:03.040>are <00:28:03.196>better <00:28:03.351>behaving <00:28:03.507>when <00:28:03.662>the <00:28:03.818>quantum, <00:28:03.973>uh, <00:28:04.129>collapse <00:28:04.285>is,

607
00:28:07.185 --> 00:28:08.965
<00:28:07.185>is <00:28:07.385>coming, <00:28:07.585>and <00:28:07.784>so <00:28:07.985>others <00:28:08.185>that, <00:28:08.385>that <00:28:08.585>are,

608
00:28:09.185 --> 00:28:10.565
<00:28:09.185>um, <00:28:09.495>not <00:28:09.806>so <00:28:10.116>good <00:28:10.427>way.

609
00:28:10.665 --> 00:28:15.005
<00:28:10.665>Um, <00:28:10.865>yeah, <00:28:11.065>so <00:28:11.264>you, <00:28:11.465>you <00:28:11.665>can, <00:28:11.865>um, <00:28:12.065>yeah,

610
00:28:15.615 --> 00:28:19.325
<00:28:15.615>guide <00:28:15.790>your, <00:28:15.965>your <00:28:16.140>server, <00:28:16.315>um, <00:28:16.490>to <00:28:16.665>use, <00:28:16.840>um, <00:28:17.015>algorithms

611
00:28:19.325 --> 00:28:21.245
<00:28:19.325>that <00:28:19.525>are, <00:28:19.725>that <00:28:19.925>are <00:28:20.125>better <00:28:20.325>for <00:28:20.525>that. <00:28:20.725>Yeah.

612
00:28:22.185 --> 00:28:24.565
<00:28:22.185>And <00:28:22.360>then <00:28:22.534>there <00:28:22.710>was <00:28:22.885>this, <00:28:23.060>uh, <00:28:23.235>not <00:28:23.409>a <00:28:23.585>question,

613
00:28:24.705 --> 00:28:28.885
<00:28:24.705>but <00:28:24.860>a <00:28:25.016>remark <00:28:25.171>that, <00:28:25.327>uh, <00:28:25.482>GitHub <00:28:25.638>already <00:28:25.793>has <00:28:25.949>PA <00:28:26.105>keys

614
00:28:28.905 --> 00:28:31.005
<00:28:28.905>as <00:28:29.138>a <00:28:29.371>better <00:28:29.605>feature, <00:28:29.838>uh, <00:28:30.071>to <00:28:30.305>use.

615
00:28:31.065 --> 00:28:34.205
<00:28:31.065>So <00:28:31.265>can, <00:28:31.465>uh, <00:28:31.665>replace <00:28:31.865>your <00:28:32.065>password <00:28:32.265>with <00:28:32.465>that.

616
00:28:35.245 --> 00:28:38.595
<00:28:35.245>Um, <00:28:35.711>yeah, <00:28:36.178>what, <00:28:36.645>uh,

617
00:28:38.655 --> 00:28:41.475
<00:28:38.655>do <00:28:38.830>you <00:28:39.004>have <00:28:39.180>any <00:28:39.355>tips <00:28:39.530>on <00:28:39.705>secure <00:28:39.879>recovery <00:28:40.055>factors?

618
00:28:42.155 --> 00:28:43.395
<00:28:42.155>Passwords <00:28:42.434>as <00:28:42.713>a <00:28:42.992>recovery <00:28:43.271>factor

619
00:28:43.395 --> 00:28:44.595
<00:28:43.395>would <00:28:43.665>undermine <00:28:43.935>the <00:28:44.205>whole <00:28:44.475>concept?

620
00:28:45.915 --> 00:28:47.325
<00:28:45.915>What, <00:28:46.232>what <00:28:46.549>was <00:28:46.866>the <00:28:47.184>Passwords?

621
00:28:47.325 --> 00:28:48.485
<00:28:47.325>Uh, <00:28:47.586>secure <00:28:47.847>recovery <00:28:48.108>factor? <00:28:48.369>Yeah.

622
00:28:48.505 --> 00:28:51.285
<00:28:48.505>So <00:28:48.632>if <00:28:48.759>you <00:28:48.886>have <00:28:49.014>to <00:28:49.141>recover, <00:28:49.268>if <00:28:49.395>you <00:28:49.523>recover <00:28:49.650>with <00:28:49.777>a <00:28:49.905>password,

623
00:28:51.825 --> 00:28:55.005
<00:28:51.825>ah, <00:28:51.980>it <00:28:52.136>was <00:28:52.291>undermine <00:28:52.447>the <00:28:52.602>concept <00:28:52.758>of <00:28:52.913>yeah, <00:28:53.069>hardware <00:28:53.225>security.

624
00:28:55.305 --> 00:28:56.525
<00:28:55.305>So, <00:28:55.579>so <00:28:55.854>the <00:28:56.128>big <00:28:56.403>advantage

625
00:28:56.665 --> 00:28:59.165
<00:28:56.665>or <00:28:56.840>how, <00:28:57.014>how <00:28:57.190>these, <00:28:57.365>uh, <00:28:57.540>credentials <00:28:57.715>are <00:28:57.889>meant <00:28:58.065>is

626
00:28:59.165 --> 00:29:02.365
<00:28:59.165>that <00:28:59.320>you <00:28:59.476>can <00:28:59.631>register <00:28:59.787>multiple <00:28:59.942>credentials <00:29:00.098>for <00:29:00.253>one, <00:29:00.409>for <00:29:00.565>one,

627
00:29:02.505 --> 00:29:04.845
<00:29:02.505>um, <00:29:02.785>site, <00:29:03.065>uh, <00:29:03.345>for <00:29:03.625>one <00:29:03.905>account.

628
00:29:05.265 --> 00:29:07.805
<00:29:05.265>So <00:29:05.420>if <00:29:05.576>you <00:29:05.731>really <00:29:05.887>want <00:29:06.042>to <00:29:06.198>use <00:29:06.353>this <00:29:06.509>hardware <00:29:06.665>tokens,

629
00:29:07.805 --> 00:29:10.005
<00:29:07.805>it's <00:29:07.980>already <00:29:08.155>best <00:29:08.330>practice <00:29:08.505>to <00:29:08.680>have <00:29:08.855>multiple <00:29:09.030>of <00:29:09.205>them

630
00:29:10.145 --> 00:29:11.925
<00:29:10.145>and <00:29:10.378>to <00:29:10.611>have <00:29:10.845>a <00:29:11.078>backup <00:29:11.311>back <00:29:11.545>home.

631
00:29:12.265 --> 00:29:14.965
<00:29:12.265>And <00:29:12.392>if <00:29:12.519>you <00:29:12.646>lose <00:29:12.774>one, <00:29:12.901>then <00:29:13.028>you <00:29:13.155>can <00:29:13.283>switch <00:29:13.410>back <00:29:13.537>to <00:29:13.665>them.

632
00:29:15.505 --> 00:29:18.525
<00:29:15.505>And <00:29:15.705>the <00:29:15.905>same <00:29:16.105>happens <00:29:16.305>for, <00:29:16.505>for <00:29:16.705>pass <00:29:16.905>keys.

633
00:29:18.545 --> 00:29:21.525
<00:29:18.545>You <00:29:18.700>should <00:29:18.856>allow <00:29:19.011>the <00:29:19.167>users <00:29:19.322>to <00:29:19.478>add <00:29:19.633>multiple, <00:29:19.789>maybe <00:29:19.945>one

634
00:29:21.545 --> 00:29:26.005
<00:29:21.545>for <00:29:21.672>their <00:29:21.799>Apple <00:29:21.926>id, <00:29:22.054>maybe <00:29:22.181>one <00:29:22.308>for <00:29:22.435>their, <00:29:22.563>um, <00:29:22.690>Google, <00:29:22.817>um, <00:29:22.945>um,

635
00:29:26.675 --> 00:29:28.685
<00:29:26.675>account <00:29:26.955>so <00:29:27.235>they <00:29:27.514>can <00:29:27.794>be <00:29:28.075>independent

636
00:29:28.685 --> 00:29:32.725
<00:29:28.685>and <00:29:28.825>if <00:29:28.965>they <00:29:29.105>somehow <00:29:29.245>lose <00:29:29.385>access <00:29:29.524>to <00:29:29.665>their <00:29:29.804>whole <00:29:29.945>Apple <00:29:30.085>id,

637
00:29:32.725 --> 00:29:34.165
<00:29:32.725>they <00:29:32.984>might <00:29:33.243>have, <00:29:33.502>have <00:29:33.761>a <00:29:34.021>fallback.

638
00:29:34.345 --> 00:29:37.285
<00:29:34.345>But <00:29:34.472>in <00:29:34.599>the <00:29:34.726>end, <00:29:34.854>if <00:29:34.981>you <00:29:35.108>store <00:29:35.235>the <00:29:35.363>pass <00:29:35.490>keys <00:29:35.617>in <00:29:35.745>the

639
00:29:38.845 --> 00:29:41.805
<00:29:38.845>platform <00:29:39.020>accounts, <00:29:39.195>then <00:29:39.370>it <00:29:39.545>falls <00:29:39.720>back <00:29:39.895>to <00:29:40.070>having <00:29:40.245>access

640
00:29:41.805 --> 00:29:44.005
<00:29:41.805>to <00:29:42.005>your <00:29:42.205>Google <00:29:42.405>account <00:29:42.605>or <00:29:42.805>your <00:29:43.005>Apple <00:29:43.205>account.

641
00:29:44.065 --> 00:29:48.125
<00:29:44.065>So <00:29:44.240>it's, <00:29:44.415>it's <00:29:44.590>done <00:29:44.765>their, <00:29:44.940>their, <00:29:45.115>uh, <00:29:45.290>task <00:29:45.465>to,

642
00:29:48.145 --> 00:29:49.925
<00:29:48.145>to <00:29:48.378>maintain <00:29:48.611>that, <00:29:48.845>I <00:29:49.078>would <00:29:49.311>say. <00:29:49.545>Yeah.

643
00:29:50.615 --> 00:29:52.825
<00:29:50.615>Another <00:29:50.965>important <00:29:51.315>question <00:29:51.665>is <00:29:52.015>similar

644
00:29:52.925 --> 00:29:55.945
<00:29:52.925>to <00:29:53.158>some <00:29:53.391>two <00:29:53.625>factor <00:29:53.858>authentication <00:29:54.091>problems, <00:29:54.325>uh,

645
00:29:56.085 --> 00:29:58.145
<00:29:56.085>are <00:29:56.435>task <00:29:56.785>keys <00:29:57.135>still <00:29:57.485>fishable?

646
00:29:58.345 --> 00:30:00.465
<00:29:58.345>I <00:29:58.520>think <00:29:58.695>that <00:29:58.870>you, <00:29:59.045>you <00:29:59.220>get <00:29:59.395>a <00:29:59.570>QR <00:29:59.745>code

647
00:30:00.465 --> 00:30:02.665
<00:30:00.465>where <00:30:00.665>you <00:30:00.865>think <00:30:01.064>you <00:30:01.264>will, <00:30:01.465>you <00:30:01.665>do <00:30:01.865>something,

648
00:30:02.925 --> 00:30:04.625
<00:30:02.925>but <00:30:03.125>you <00:30:03.325>have <00:30:03.524>attackers <00:30:03.725>man <00:30:03.925>in <00:30:04.125>the <00:30:04.325>middle

649
00:30:04.765 --> 00:30:07.225
<00:30:04.765>and <00:30:04.940>they <00:30:05.115>send <00:30:05.290>you <00:30:05.465>ADA <00:30:05.640>different <00:30:05.815>QR <00:30:05.990>code <00:30:06.165>Yeah.

650
00:30:07.225 --> 00:30:08.425
<00:30:07.225>To <00:30:07.585>sign <00:30:07.945>something. <00:30:08.304>So,

651
00:30:08.575 --> 00:30:09.575
<00:30:08.575>Yeah. <00:30:09.475>So

652
00:30:09.575 --> 00:30:12.985
<00:30:09.575>pass <00:30:09.925>keys, <00:30:10.275>um, <00:30:10.625>in <00:30:10.975>or,

653
00:30:12.985 --> 00:30:15.865
<00:30:12.985>or <00:30:13.125>web <00:30:13.264>path <00:30:13.405>n <00:30:13.544>itself <00:30:13.685>is, <00:30:13.824>is <00:30:13.965>not <00:30:14.104>ible <00:30:14.245>or <00:30:14.385>not?

654
00:30:16.285 --> 00:30:17.585
<00:30:16.285>No, <00:30:16.577>it's, <00:30:16.870>it's <00:30:17.162>not <00:30:17.455>fishable

655
00:30:17.585 --> 00:30:20.465
<00:30:17.585>because <00:30:17.785>the <00:30:17.985>credentials <00:30:18.185>that <00:30:18.385>are <00:30:18.585>created <00:30:18.785>are <00:30:18.985>created

656
00:30:20.525 --> 00:30:21.665
<00:30:20.525>for <00:30:20.867>a <00:30:21.209>particular <00:30:21.551>site.

657
00:30:22.045 --> 00:30:25.345
<00:30:22.045>So <00:30:22.200>if <00:30:22.356>I, <00:30:22.511>um, <00:30:22.667>create <00:30:22.822>credentials <00:30:22.978>for <00:30:23.133>google <00:30:23.289>pro <00:30:23.445>com,

658
00:30:25.535 --> 00:30:28.065
<00:30:25.535>then <00:30:25.690>this <00:30:25.846>credential <00:30:26.001>is <00:30:26.157>really <00:30:26.312>just <00:30:26.468>for <00:30:26.623>google <00:30:26.779>pro <00:30:26.935>com.

659
00:30:28.165 --> 00:30:30.305
<00:30:28.165>And <00:30:28.398>if, <00:30:28.631>uh, <00:30:28.865>a <00:30:29.098>site <00:30:29.331>tricks <00:30:29.565>me

660
00:30:30.305 --> 00:30:33.065
<00:30:30.305>and <00:30:30.480>it <00:30:30.655>looks, <00:30:30.830>uh, <00:30:31.005>totally <00:30:31.180>identical, <00:30:31.355>then, <00:30:31.530>uh, <00:30:31.705>Google,

661
00:30:33.805 --> 00:30:38.065
<00:30:33.805>but, <00:30:33.960>um, <00:30:34.116>and, <00:30:34.271>and <00:30:34.427>do <00:30:34.582>some <00:30:34.738>type <00:30:34.893>squatting <00:30:35.049>or <00:30:35.205>whatever.

662
00:30:38.205 --> 00:30:40.905
<00:30:38.205>So <00:30:38.345>I'm <00:30:38.485>really <00:30:38.625>tricked <00:30:38.764>into, <00:30:38.905>I <00:30:39.044>would <00:30:39.185>enter <00:30:39.324>my <00:30:39.465>password <00:30:39.605>here.

663
00:30:41.165 --> 00:30:43.745
<00:30:41.165>The <00:30:41.340>browser <00:30:41.514>still <00:30:41.690>recognizes, <00:30:41.865>no, <00:30:42.040>this <00:30:42.215>is <00:30:42.389>not <00:30:42.565>Google.

664
00:30:44.005 --> 00:30:47.305
<00:30:44.005>Um, <00:30:44.160>you <00:30:44.316>are <00:30:44.471>not <00:30:44.627>allowed <00:30:44.782>to <00:30:44.938>use <00:30:45.093>this <00:30:45.249>credentials <00:30:45.405>here.

665
00:30:47.325 --> 00:30:49.105
<00:30:47.325>So <00:30:47.791>that's <00:30:48.258>technically <00:30:48.725>enforced.

666
00:30:49.105 --> 00:30:50.705
<00:30:49.105>It's <00:30:49.385>not <00:30:49.665>possible <00:30:49.945>to <00:30:50.225>use <00:30:50.505>web

667
00:30:50.765 --> 00:30:52.305
<00:30:50.765>and <00:30:51.111>credentials <00:30:51.458>on <00:30:51.804>different <00:30:52.151>side.

668
00:30:52.655 --> 00:30:57.105
<00:30:52.655>Then <00:30:52.810>they <00:30:52.966>were <00:30:53.121>originally <00:30:53.277>created <00:30:53.432>for, <00:30:53.588>with <00:30:53.743>this <00:30:53.899>QR <00:30:54.055>code.

669
00:30:57.105 --> 00:30:58.345
<00:30:57.105>That's <00:30:57.477>a <00:30:57.849>bit <00:30:58.221>different

670
00:30:58.345 --> 00:31:01.705
<00:30:58.345>because <00:30:58.520>there <00:30:58.695>are, <00:30:58.870>yeah, <00:30:59.045>you <00:30:59.220>have <00:30:59.395>this <00:30:59.570>attack <00:30:59.745>vector

671
00:31:01.805 --> 00:31:05.185
<00:31:01.805>of <00:31:01.980>I <00:31:02.155>creating, <00:31:02.330>um, <00:31:02.505>um, <00:31:02.680>this, <00:31:02.855>this <00:31:03.030>QR <00:31:03.205>code

672
00:31:05.205 --> 00:31:06.945
<00:31:05.205>and <00:31:05.438>I <00:31:05.671>giving <00:31:05.905>in <00:31:06.138>to <00:31:06.371>someone <00:31:06.605>else

673
00:31:07.405 --> 00:31:10.545
<00:31:07.405>and <00:31:07.532>he <00:31:07.659>would, <00:31:07.786>um, <00:31:07.914>locks, <00:31:08.041>locks <00:31:08.168>me <00:31:08.295>in <00:31:08.423>using <00:31:08.550>this <00:31:08.677>QR <00:31:08.805>code.

674
00:31:10.965 --> 00:31:14.225
<00:31:10.965>We <00:31:11.120>saw <00:31:11.276>that <00:31:11.431>there <00:31:11.587>are <00:31:11.742>some <00:31:11.898>dialogues <00:31:12.053>on <00:31:12.209>the <00:31:12.365>phone

675
00:31:14.225 --> 00:31:17.225
<00:31:14.225>where <00:31:14.425>you <00:31:14.625>have <00:31:14.824>to, <00:31:15.024>um, <00:31:15.225>yeah, <00:31:15.425>uh, <00:31:15.625>allow

676
00:31:17.225 --> 00:31:18.545
<00:31:17.225>that <00:31:17.522>this <00:31:17.819>is <00:31:18.116>really <00:31:18.413>happening,

677
00:31:18.645 --> 00:31:21.305
<00:31:18.645>but <00:31:18.800>for <00:31:18.956>some <00:31:19.111>users <00:31:19.267>this <00:31:19.422>might <00:31:19.578>not <00:31:19.733>not <00:31:19.889>be <00:31:20.045>enough.

678
00:31:21.685 --> 00:31:26.385
<00:31:21.685>But <00:31:21.840>also, <00:31:21.996>um, <00:31:22.151>this, <00:31:22.307>this <00:31:22.462>new, <00:31:22.618>um, <00:31:22.773>authentication <00:31:22.929>method, <00:31:23.085>um,

679
00:31:26.855 --> 00:31:28.905
<00:31:26.855>enforce <00:31:27.135>some <00:31:27.415>kind <00:31:27.695>of <00:31:27.975>proximity <00:31:28.255>check.

680
00:31:29.005 --> 00:31:33.425
<00:31:29.005>So <00:31:29.132>it <00:31:29.259>is <00:31:29.386>checked <00:31:29.514>that <00:31:29.641>the <00:31:29.768>two <00:31:29.895>devices <00:31:30.023>are <00:31:30.150>near <00:31:30.277>each <00:31:30.405>other.

681
00:31:33.775 --> 00:31:35.905
<00:31:33.775>It's <00:31:33.975>not <00:31:34.175>really <00:31:34.375>clear <00:31:34.575>how <00:31:34.775>the <00:31:34.975>different, <00:31:35.175>um,

682
00:31:36.665 --> 00:31:37.665
<00:31:36.665>platforms <00:31:36.965>are <00:31:37.264>doing <00:31:37.565>this.

683
00:31:37.805 --> 00:31:41.745
<00:31:37.805>So <00:31:37.932>network <00:31:38.059>would <00:31:38.186>be <00:31:38.314>one <00:31:38.441>idea <00:31:38.568>that <00:31:38.695>is <00:31:38.823>some <00:31:38.950>kind <00:31:39.077>of <00:31:39.205>spoof.

684
00:31:42.445 --> 00:31:45.145
<00:31:42.445>Um, <00:31:42.600>Bluetooth <00:31:42.756>low <00:31:42.911>energy <00:31:43.067>is <00:31:43.222>something <00:31:43.378>I <00:31:43.533>saw <00:31:43.689>that <00:31:43.845>is,

685
00:31:45.145 --> 00:31:48.225
<00:31:45.145>that <00:31:45.320>is, <00:31:45.495>um, <00:31:45.670>using, <00:31:45.845>so <00:31:46.020>I'm <00:31:46.195>very <00:31:46.370>excited <00:31:46.545>how,

686
00:31:48.325 --> 00:31:51.745
<00:31:48.325>how <00:31:48.465>this <00:31:48.605>works <00:31:48.745>out <00:31:48.885>and <00:31:49.025>how, <00:31:49.165>what <00:31:49.305>attacks <00:31:49.445>come, <00:31:49.585>come <00:31:49.725>over

687
00:31:51.775 --> 00:31:53.025
<00:31:51.775>with <00:31:52.150>this <00:31:52.525>QR <00:31:52.900>method.

688
00:31:53.165 --> 00:31:56.945
<00:31:53.165>Uh, <00:31:53.305>I'm <00:31:53.445>not, <00:31:53.585>not <00:31:53.725>a <00:31:53.865>hundred <00:31:54.004>percent <00:31:54.145>convinced <00:31:54.284>of <00:31:54.425>this <00:31:54.565>method,

689
00:31:57.125 --> 00:31:59.145
<00:31:57.125>but <00:31:57.325>that's, <00:31:57.525>if <00:31:57.725>you <00:31:57.925>do <00:31:58.125>not <00:31:58.325>use <00:31:58.525>this,

690
00:31:59.455 --> 00:32:01.625
<00:31:59.455>then <00:31:59.735>you <00:32:00.014>are <00:32:00.294>totally <00:32:00.574>fishing <00:32:00.855>proof,

691
00:32:01.625 --> 00:32:04.865
<00:32:01.625>because <00:32:01.800>that's <00:32:01.975>one <00:32:02.150>main <00:32:02.325>feature <00:32:02.500>of, <00:32:02.675>of <00:32:02.850>Web <00:32:03.025>saying

692
00:32:05.235 --> 00:32:06.235
<00:32:05.235>Thank <00:32:05.459>you <00:32:05.685>very <00:32:05.909>much. <00:32:06.135>We

693
00:32:06.235 --> 00:32:08.625
<00:32:06.235>are <00:32:06.409>totally <00:32:06.584>out <00:32:06.760>of <00:32:06.935>time. <00:32:07.110>Yes. <00:32:07.284>One <00:32:07.459>more <00:32:07.635>thing.

694
00:32:09.045 --> 00:32:12.465
<00:32:09.045>Uh, <00:32:09.172>some <00:32:09.299>people <00:32:09.426>missed <00:32:09.554>the <00:32:09.681>QR <00:32:09.808>code, <00:32:09.935>it <00:32:10.063>was <00:32:10.190>gone <00:32:10.317>too <00:32:10.445>fast.

695
00:32:12.845 --> 00:32:14.665
<00:32:12.845>Can <00:32:13.078>you <00:32:13.311>maybe, <00:32:13.545>uh, <00:32:13.778>show <00:32:14.011>it <00:32:14.245>again

696
00:32:14.665 --> 00:32:16.945
<00:32:14.665>and <00:32:14.792>maybe <00:32:14.919>they <00:32:15.046>can <00:32:15.174>come <00:32:15.301>around <00:32:15.428>and <00:32:15.555>have <00:32:15.683>it <00:32:15.810>from <00:32:15.937>your <00:32:16.065>screen,

697
00:32:17.005 --> 00:32:18.865
<00:32:17.005>or <00:32:17.205>if <00:32:17.405>you <00:32:17.605>can <00:32:17.805>share <00:32:18.005>his <00:32:18.205>screen <00:32:18.405>again?

698
00:32:19.175 --> 00:32:20.505
<00:32:19.175>Yeah, <00:32:19.574>quickly. <00:32:19.973>Yeah. <00:32:20.372>Yeah.

699
00:32:20.845 --> 00:32:23.785
<00:32:20.845>That's <00:32:20.972>the <00:32:21.099>QR <00:32:21.226>code. <00:32:21.354>Now <00:32:21.481>you <00:32:21.608>can <00:32:21.735>get <00:32:21.863>the, <00:32:21.990>the <00:32:22.117>QR <00:32:22.245>code.

700
00:32:23.995 --> 00:32:26.505
<00:32:23.995>Thank <00:32:24.135>you <00:32:24.274>very <00:32:24.415>much, <00:32:24.554>cl <00:32:24.695>It's <00:32:24.834>great <00:32:24.975>talk. <00:32:25.114>Thank <00:32:25.254>you. <00:32:25.395>Right.

701
00:32:26.645 --> 00:32:29.305
<00:32:26.645>That's <00:32:26.820>was <00:32:26.995>really <00:32:27.170>a <00:32:27.345>rush <00:32:27.520>for <00:32:27.695>you. <00:32:27.870>That's <00:32:28.045>true.

702
00:32:29.305 --> 00:32:30.545
<00:32:29.305>It's <00:32:29.528>very <00:32:29.751>great. <00:32:29.974>Thank <00:32:30.197>you. <00:32:30.421>Thank

703
00:32:30.545 --> 00:32:30.585
You.