Passwordless Authentication with WebAuthn
Presented by
Tran Trong Thanh
Principal Software Engineer - Web Platform
Press Space for next page
Passwordless Authentication with WebAuthn
Presented by
Tran Trong Thanh
Principal Software Engineer - Web Platform
Press Space for next page
1
2
Why Passwordless Authentication?
(Why passwords are problematic?)
3
4
5
6
As service provider,
what can we do to reduce password risks?
- Rely on 3rd party authentication provider (FB Login, Google Login…)
- Enforce MFA on "unknown" devices (SMS OTP verification)
- Go full passwordless with time based OTP (email, SMS, Zalo, TOTP Authenticator)
There is a better way...
7
Introducing
WebAuthn
8
What is WebAuthn?
"Web Authentication"
- Browser API for passwordless authentication
- Strong authentiction using public key cryptography
- Specification developed by W3C[1] and FIDO[2] Alliance[3]
- Scoped, site specific credentials
W3C Recommendation since 2019 ↩︎
FIDO stands for Fast IDentity Online ↩︎
Members from Google, Mozilla, Microsoft, Yubico, and others ↩︎
9
Demo of WebAuthn
10
Registration
Try this demo at: webauthn.chotot.org
11
Authentication
Try this demo at: webauthn.chotot.org
12
How WebAuthn works
13
Registration / Attestation
14
Registration / Attestation
15
Registration / Attestation
16
Registration / Attestation
17
Registration / Attestation
18
Registration / Attestation
19
Registration / Attestation
20
Registration / Attestation
21
Sign in / Assertion
22
Sign in / Assertion
23
Sign in / Assertion
24
Sign in / Assertion
25
Sign in / Assertion
26
Sign in / Assertion
27
Sign in / Assertion
28
Sign in / Assertion
29
WebAuthn 101
30
Authenticator Types
| WebAuthn Spec Name | Authenticator | Examples |
|---|---|---|
| "Platform Authenticator" | Built in to the device | Windows Hello, Touch ID, Face ID Android fingerprint scanner |
| "Roaming Authenticator" | External security keys | Yubikey, VinCSS FIDO2 key |
31
Browser Supports
Platform 
Authenticator [1]
| Browsers | Android 7+ | iOS 14.5+ | Windows 10+ | macOS Big Sur+ | Desktop Linux | |
|---|---|---|---|---|---|---|
 | Chrome | ✅ | ✅ | ✅ | ✅ | - |
 | Safari | N/A | ✅ | N/A | ✅ | N/A |
 | Firefox | ✅ | ✅ | ✅ | Roaming | - |
 | Edge | ✅ | ✅ | ✅ | ✅ | - |
 | Samsung Internet | ✅ | N/A | N/A | N/A | N/A |
 | Cốc Cốc | ❌ | ❌ | Roaming[2] | Roaming | - |
Based on webauthn.me with 2023 updates ↩︎
Cốc Cốc only support Roaming Authenticator on desktop (as of v.122) ↩︎
32
Some platforms already sync passkeys across devices automatically via their ID accounts[1]:
- macOS, iOS, iPad OS stored passkeys on iCloud Keychain and sync with Apple ID
- Android store passkeys on Google Password Manager and sync with Google account
- Windows Hello’s passkeys are still device-bound, but sync passkey is planned
- Some browser extensions can act as Passkey provider and able to sync across devices: Bitwarden, LastPass…
on macOS Chrome
33
Conclusion
Benefits of WebAuthn
- Minimizes login friction
- The only web-based method that is phishing resistant
- Cost effective than one time password
- As secured as MFA
- What you have (device)
- What you are (fingerprint, face) or what you know (pin, screen pattern)
Challenges
- Device & browser support
- Enrollment UX is new and unexplored
- Cryptography & encryption are difficult to work with
- Still need fallback methods
34
Thank you
Questions?
References:
- MDN Web Authentication API
- https://webauthn.guide
- https://webauthn.me
- https://passkeys.dev
- These slides are available at int3ractive.com/r/chotot-webauthn
35