WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2023 • Nov 10, 2023

Passwordless future: WebAuthn and Passkeys in practice

Clemens Hübner

Traditional passwords and SMS 2FA are failing modern security standards. Master the navigator.credentials API to implement passkeys and deliver frictionless, phishing-resistant logins across all devices.

Pause
Mute Enter Fullscreen
#1 about 4 min

Shortcomings of passwords and secondary authentication factors

Traditional memorized secrets and basic two-factor methods remain highly susceptible to phishing.

#2 about 2 min

Exploring possession and biometric authentication factors

Hardware tokens and biometric data provide stronger authentication by removing memorization burdens.

#3 about 2 min

Introduction to the WebAuthn JavaScript API architecture

WebAuthn acts as a standardized browser interface to securely handle challenge-response cryptography without transmitting secrets.

#4 about 2 min

Demonstration of passwordless registration and login

A practical implementation showcases how users interact with hardware keys during the registration and authentication flow.

#5 about 5 min

Understanding WebAuthn registration and authentication ceremonies

The underlying protocol relies on public key cryptography to generate credentials and verify digital signatures.

#6 about 5 min

Browser support timeline and early usability challenges

Despite widespread technical support, initial adoption struggled due to hardware portability limits and user education barriers.

#7 about 4 min

Platform integration and synchronization using passkeys

Major tech ecosystems rebrand webauthn credentials as synchronized passkeys to solve device constraints.

#8 about 2 min

Implementing cross-device login via QR codes

A hybrid mechanism allows secure authentication across device boundaries via proximity and local communication channels.

#9 about 4 min

Accelerating adoption through developer resources and user education

Implementing modern passwordless solutions requires careful planning around ecosystem constraints and guiding users through new workflows.

#10 about 3 min

Handling lost authenticators and future cryptographic standards

Fallback workflows for lost physical tokens rely on traditional email verification protocols while waiting for quantum-resistant updates.

#11 about 2 min

Establishing secure recovery factors without password fallbacks

Registering multiple hardware tokens or ecosystem passkeys prevents complete account lockout during device loss.

#12 about 3 min

Phishing protection and proximity checks for cross-device authentication

WebAuthn strictly binds credentials to originating domains to thwart traditional phishing and man-in-the-middle attacks.

Matching moments

1:53 min

Overcoming barriers to passwordless authentication adoption

Christoph Menzel Christoph Menzel · World Congress 2026 Europe

3:49 min

Navigating authentication challenges and third-party password managers

Christian Heilmann Christian Heilmann +1 · World Congress 2026 North America

4:13 min

Hardware keys and mitigating persistent password vulnerabilities

Chris Heilmann Chris Heilmann +2 · LIVE

2:09 min

Replacing traditional website logins with biometric web passkeys

Gift Egwuenu · World Congress 2023

3:04 min

Introducing passkeys and the web authentication protocol components

Paweł Łukaszuk · LIVE

1:22 min

Securing application access with WebAuthn and physical FIDO keys

Gift Egwuenu · World Congress 2023

More from World Congress 2023

The year 3000, a brief history of Web Development thumbnail
25:30
over 2 years ago

The year 3000, a brief history of Web Development

Lorenzo Pieri

Demografie nutzen um jedem Bewerber das passende Angebot zu machen! thumbnail
8:52
almost 3 years ago

Demografie nutzen um jedem Bewerber das passende Angebot zu machen!

Nathalie Gierth

Guided Memory Management: Rust's Ownership Model thumbnail
0:18
almost 3 years ago

Guided Memory Management: Rust's Ownership Model

Stefan Baumgartner

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail
30:07
almost 3 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Building Reliable Serverless Applications with AWS CDK and Testing thumbnail
25:18
almost 3 years ago

Building Reliable Serverless Applications with AWS CDK and Testing

Raphael Manke

Fifty Shades of Kubernetes Autoscaling thumbnail
30:26
almost 3 years ago

Fifty Shades of Kubernetes Autoscaling

Mario-Leander Reimer

Upcoming sessions on this topic

Open session

Supply Chain Security for the Everyday Engineer

  • Pradumna Saraf

    Kestra Technologies

    Quality Assurance Engineer

Open session

Build a Zero-Cost AI Agent in Your Browser

  • Aishwarya Mathuria

    Adobe

    Computer Scientist

  • Nishant Thakur

    Adobe

    Senior Computer Scientist

Open session

Shipping MCP to Real Users: Scaling, Auth, and the PII Leak You Didn't See Coming

  • Hadar Geva

    Myop

    CTO & Co-founder

Open session

ULTRON: Your Agent Has No Hands - Real-Time Voice, MCP, and Ten Phones on Stage

  • Sagar Tamang

    Two Spoon Technologies

    AI Engineer

Open session

How Google built a Consistent, Global Authorization System with Zanzibar (and you can too!)

  • Sohan Maheshwar

    AuthZed

    Lead Developer Advocate

Open session

Designing for Every Direction: Logical CSS for Global, Adaptive, and Effortlessly Reversible UIs

  • Vidhya Krishnamoorthy

    Morgan Stanley

    VP, Software Engineering Manager

Related videos

Passwordless Web 1.5 thumbnail
30:21
LIVE • about 2 years ago

Passwordless Web 1.5

Paweł Łukaszuk

Going Beyond Passwords: The Future of User Authentication thumbnail
27:55
World Congress 2023 • about 3 years ago

Going Beyond Passwords: The Future of User Authentication

Gift Egwuenu

Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls thumbnail
31:16
World Congress 2026 Europe • 3 months ago

Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls

Martina Kraus

MFA? Game over! Watch your protection collapse – live thumbnail
28:30
World Congress 2026 Europe • 3 months ago

MFA? Game over! Watch your protection collapse – live

Christoph Menzel

Accelerating Authentication Architecture: Taking Passwordless to the Next Level thumbnail
49:52
LIVE • about 3 years ago

Accelerating Authentication Architecture: Taking Passwordless to the Next Level

Yedidya Schwartz

No More Post-its: Boost your login security with APIs thumbnail
16:05
World Congress 2024 • about 2 years ago

No More Post-its: Boost your login security with APIs

Alvaro Navarro

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.