SecAppDev Academy

SecAppDev original

Passkeys: the future of user authentication

Video and handoutsSecAppDev 2024

AuthenticationWeb security

Abstract

User authentication has been a mess for ages. Attempts to fix it by adding more authentication factors might work, but is quite complex. But what if there’s a world where we can replace this insecure first factor with single strong authentication mechanism? That’s what passkeys promise to do!

This session will dive head-first into passkeys. We not only explore passkeys from a user’s perspective and a developer’s perspective, but we also look at the mechanics under the hood. By the end of this session, you will understand how passkeys work and will know how to use them in your applications.

Handouts available for this lecture

Download

Chapters

  1. Intro
  2. Requirements of User Authentication
  3. Key-Based User Authentication
  4. mTLS
  5. Passkeys from a User’s Perspective
  6. Security requirements of Passkeys
  7. Passkey Demo
  8. Passkeys from a Developer’s view
  9. Deep Dive Into Passkey Creation
  10. Deep Dive into Passkey Usage
  11. Attestations versus Assertions
  12. Conditional Mediation
  13. Conditional Mediation in Action
  14. Passkeys and the Backend
  15. Integrating Passkeys
  16. Key Takeaways
  17. Q & A

In-person course

Philippe De Ryck taught at previous editions of SecAppDev

SecAppDev is an immersive course in secure application development, running annually since 2005. World-renowned faculty from industry and academia deliver in-depth 90-minute lectures and full-day workshops in an intimate setting, typically in early June.

More about SecAppDev

Regular updates, at most twice a month

We will email you about new talks on the SecAppDev Academy, along with updates on the annual in-person course. No tracking, and you can unsubscribe at any time.