30 秒でわかる
Eli Holderness explains how public-key credentials and authenticators support WebAuthn, and introduces the relationship between WebAuthn, CTAP and FIDO2.
- 1Password challengesPasswords create usability and storage challenges.
- 2Key pairsA private key signs a challenge that a public key can verify.
- 3Hardware authenticatorsHardware keys can provide a possession factor.
- 4Web standardsWebAuthn and CTAP are part of FIDO2.
- 5PasskeysPasskeys may be device-bound or synchronized.
ポイント
- Passwords create usability and storage challenges.
- A private key signs a challenge that a public key can verify.
- Hardware keys can provide a possession factor.
- WebAuthn and CTAP are part of FIDO2.
- Passkeys may be device-bound or synchronized.
チャプターごとに整えた全文を読む
Beyond passwords
Keys, authenticators and web standards.
I introduce WebAuthn and passwordless authentication in this short excerpt from a 2023 GOTO talk. The full talk covers the details and tradeoffs beyond this overview.
Passwords can be difficult for people to manage and for services to store securely. Breaches of credential databases illustrate why authentication design matters.
Public-key cryptography uses a private key and a corresponding public key. An authenticator can sign a challenge with the private key, and the service can verify the signature using the public key.
Hardware security keys can hold private keys and provide a possession factor. Depending on the authenticator and configuration, another factor such as a PIN or biometric can also be used.
WebAuthn defines the web interface for creating and using public-key credentials; CTAP describes communication with compatible authenticators. Together these are part of the FIDO2 ecosystem.
Hardware keys are designed to keep their private keys on the device. Passkeys can also be device-bound or synchronized across devices, depending on the implementation; the security and recovery experience differs.
The full talk goes on to discuss practical usability, drawbacks and possible future authentication experiences.
同じチャンネルの記事
39:12EN
GOTO Conferences· 2026年10月28日Cate Huston: How Rigour Supports AI-Assisted Development VelocityCate Huston · TwillA two-person team’s experience with release gates, automated checks, prioritization and the cost of shipping faster.
22:33ENGOTO Conferences· 2026年10月26日William Schor: From Unit Tests to Synthetic Canaries at NetflixWilliam Schor · NetflixHow generated workloads and production-like infrastructure help test a distributed key-value service.
34:11ENGOTO Conferences· 2026年10月23日Anatoliy Bilenko and Alberto Carretero: Making Database Protocols Reliable with Formal Methods and AIAnatoliy Bilenko, Alberto Carretero · CanonicalCanonical’s database engineers connect executable specifications, model-based tests, failure exploration, and reconstructed execution histories—and explain why none of these techniques proves a real system correct on its own.
28:15ENGOTO Conferences· 2026年10月22日Steve Poole on Open-Source Security and AI’s Maintenance ChallengeOlimpiu Pop, Steve PooleWhy faster vulnerability discovery increases pressure on maintainers, dependency users and upgrade processes.
46:36ENGOTO Conferences· 2026年10月21日Don Syme: Building Agentic Automation Around Human CollaborationDon Syme · GitHubContinuous AI, repository workflows and the guardrails needed for unattended software maintenance.
28:23ENGOTO Conferences· 2026年10月19日Learning Ash: Declarative Elixir Apps, Testing and ExtensibilityChristian Alexander, Rebecca Le, Zach DanielRebecca Le and Zach Daniel explain how their book and the framework evolved together.