luke.dewitt

$ cd ~/talks/our-password-problem

2024-02-26HalihaxHalifax, NS

Our Password Problem⁠

Passwords are hard to remember, easy to steal, and most people still skip 2FA. Passkeys fix a lot of that: what they are, how WebAuthn works, and the catches.

$ open slides

  1. Our Password Problem
  2. Luke DeWitt Director of Web Services
  3. Passwords What are they good for? - Unintuitive - Impossible to Remember - Password Manager Woes - Password Standards - Who knows the latest? - “Prone” to hacking - 81% of all hacking-related breaches leverage stolen or weak passwords. - “Shared” secret problem
  4. Slow down egghead That’s how I log in to my favorite sites and services!
  5. 47% Less than half of users use 2FA
  6. 2 Factor Authentication ● Something you know ○ Most often a password for your account. ● Something you have ○ Such as a cell phone with a temporary authentication code. ● Something you are ○ Such as your fingerprint or facial recognition.
  7. Passwords 👋
  8. Passkeys 👋
  9. Goodbye, Passwords Hello, Passkeys It’s about damn time - Unique - Public Key Cryptography (WebAuthN) - Private Key remains on device* - Leverages modern tech (ie/ biometrics, ubikeys) - Less Friction - Technically multifactor - Promoted by the major players in the industry - Google, Apple
  11. Quick History on WebAuthN - First proposed in 2013, Finalized in 2019 - Secure authentication on the web without requiring passwords - Joint effort between the FIDO Alliance the W3C - Fast IDentity Online Alliance - Universal 2nd Factor (U2F) - Universal Authentication Framework (UAF) - FIDO2
  12. * About that asterisk… - Unique per device would indicate unique per device - Passkey on your laptop != passkey on your phone != passkey on your tablet - Secret keys are being synced to the cloud now so you don’t have to worry about logging in and setting a new - iCloud, Google Password Manager, 1Password - Still… this isn’t ideal.
  13. WebAuthN Support - Platform Authenticators
  14. WebAuthN Support Roaming Authenticators
  15. Mobile
  16. How does it work? 💻
  17. 1. A user signs in to the website. 2. Once the user is signed in, they request to create a passkey on the frontend, for example, by pressing a "Create a passkey" button. 3. The frontend requests information from the backend to create a passkey, such as user information, a challenge, and the credential IDs to exclude. 4. The frontend calls navigator.credentials.create() to create a passkey. This…
  18. So I lied … you still need a password… kind of… - But remember that a lot of these passkeys will be stored in the cloud, so that helps… - … but some people won’t trust the cloud - Adoption concerns?
  19. Demo / Code 🧮
  20. Another Demo 💻 https://webauthn.m e
  21. Thanks for coming! 👏
1 / 21
download pdf ↓

$ cat notes.md

Passwords: what are they good for?

They’re unintuitive, impossible to remember, and the rules keep changing. Password managers help, until they don’t. They’re a shared secret, so anyone who gets a copy is you: 81% of hacking-related breaches use stolen or weak passwords. And fewer than half of users turn on two-factor authentication.

Hello, passkeys

A passkey is a unique key pair per site, built on public key cryptography (WebAuthn). The private key stays with you and the site only ever stores the public one. You unlock it with what your device already has, like a fingerprint, your face or a security key. That means less friction, and it’s technically multi-factor on its own. Google and Apple are pushing hard for it.

A quick history of WebAuthn

First proposed in 2013 and finalized in 2019, WebAuthn is a joint effort between the W3C and the FIDO (Fast IDentity Online) Alliance, building on U2F, UAF and FIDO2.

About that asterisk

“The private key remains on the device” was the original promise: a passkey on your laptop isn’t the passkey on your phone. Now passkeys sync through iCloud, Google Password Manager and 1Password, so you don’t have to set one up on every device. That’s convenient, but not quite the original idea.

How registration works

  1. The user signs in to the site.
  2. They ask to create a passkey, say with a “Create a passkey” button.
  3. The frontend asks the backend for what it needs: user info, a challenge, and the credential IDs to exclude.
  4. The frontend calls navigator.credentials.create().
  5. The user consents with their device’s screen lock, and the promise resolves with a public key credential.
  6. The frontend sends that credential to the backend, which stores the credential ID and public key on the user’s account.

From web.dev’s guide to passkey registration.

So I lied

You still kind of need a password, at least for now. Synced passkeys help, but some people won’t trust the cloud, and adoption is still the open question.

Want to try it? webauthn.me walks you through the whole flow.

visitor@whatadewitt: ~