In 30 seconds
Eli Holderness explains how public-key credentials and authenticators support WebAuthn, and introduces the relationship between WebAuthn, CTAP and FIDO2.
- 1Password challengesPasswords create usability and storage challenges.
- 2Key pairsA private key signs a challenge that a public key can verify.
- 3Hardware authenticatorsHardware keys can provide a possession factor.
- 4Web standardsWebAuthn and CTAP are part of FIDO2.
- 5PasskeysPasskeys may be device-bound or synchronized.
Takeaways
- Passwords create usability and storage challenges.
- A private key signs a challenge that a public key can verify.
- Hardware keys can provide a possession factor.
- WebAuthn and CTAP are part of FIDO2.
- Passkeys may be device-bound or synchronized.
Read the edited text by chapter
Beyond passwords
Keys, authenticators and web standards.
I introduce WebAuthn and passwordless authentication in this short excerpt from a 2023 GOTO talk. The full talk covers the details and tradeoffs beyond this overview.
Passwords can be difficult for people to manage and for services to store securely. Breaches of credential databases illustrate why authentication design matters.
Public-key cryptography uses a private key and a corresponding public key. An authenticator can sign a challenge with the private key, and the service can verify the signature using the public key.
Hardware security keys can hold private keys and provide a possession factor. Depending on the authenticator and configuration, another factor such as a PIN or biometric can also be used.
WebAuthn defines the web interface for creating and using public-key credentials; CTAP describes communication with compatible authenticators. Together these are part of the FIDO2 ecosystem.
Hardware keys are designed to keep their private keys on the device. Passkeys can also be device-bound or synchronized across devices, depending on the implementation; the security and recovery experience differs.
The full talk goes on to discuss practical usability, drawbacks and possible future authentication experiences.
More from this channel
39:12EN
GOTO Conferences· Oct 28, 2026Cate Huston: How Rigour Supports AI-Assisted Development VelocityCate Huston · TwillA two-person team’s experience with release gates, automated checks, prioritization and the cost of shipping faster.
22:33ENGOTO Conferences· Oct 26, 2026William Schor: From Unit Tests to Synthetic Canaries at NetflixWilliam Schor · NetflixHow generated workloads and production-like infrastructure help test a distributed key-value service.
34:11ENGOTO Conferences· Oct 23, 2026Anatoliy Bilenko and Alberto Carretero: Making Database Protocols Reliable with Formal Methods and AIAnatoliy Bilenko, Alberto Carretero · CanonicalCanonical’s database engineers connect executable specifications, model-based tests, failure exploration, and reconstructed execution histories—and explain why none of these techniques proves a real system correct on its own.
28:15ENGOTO Conferences· Oct 22, 2026Steve Poole on Open-Source Security and AI’s Maintenance ChallengeOlimpiu Pop, Steve PooleWhy faster vulnerability discovery increases pressure on maintainers, dependency users and upgrade processes.
46:36ENGOTO Conferences· Oct 21, 2026Don Syme: Building Agentic Automation Around Human CollaborationDon Syme · GitHubContinuous AI, repository workflows and the guardrails needed for unattended software maintenance.
28:23ENGOTO Conferences· Oct 19, 2026Learning Ash: Declarative Elixir Apps, Testing and ExtensibilityChristian Alexander, Rebecca Le, Zach DanielRebecca Le and Zach Daniel explain how their book and the framework evolved together.