Global AppSec Amsterdam

WebAuthn is the new API now widely available in browsers, enabling strong, public-key based authentication that has the potential to strengthen, if not replace, password-based authentication mediums. It further allows for convenient and fast authentications with via biometric readers built into devices, like Apple’s Touch ID. But now the device itself can be the authentication medium; how does WebAuthn deal with all of the potential privacy implications therein? How do users and relying parties deal with lost, or stolen devices? In this talk I will give an overview of WebAuthn, and then do a deep dive into the security properties of the API, and how it delegates responsibilities to browsers, authenticators, relying parties, and users in order to build a balance between privacy, strength, and convenience.