Unlocking the Web: Exploring WebAuthn & Beyond • Eli Holderness & Mark Rendle
Jan 5, 2024
auto_awesome
Mark Rendle interviews Eli Holderness, a developer advocate at Scaleway, about WebAuthn and the future of web authentication. They discuss topics such as public key cryptography, hardware security tokens, passwordless authentication challenges, data privacy, and the potential impact of WebAssembly on cloud computing. The conversation also touches on preferences in search engines, data bunkers, quantum computers, and casual interests in linguistics and retro gaming.
WebAuthn utilizes hardware security tokens to provide secure and standardized authentication on the web without passwords, but usability concerns and the risk of losing tokens remain.
The use of pass keys as authentic factors for logging into websites simplifies the authentication process but raises concerns about centralizing user authentication credentials and data privacy.
Deep dives
WebAuthn: Authenticating without passwords
WebAuthn is a set of specifications developed by the Worldwide Web Consortium (W3C) that allows for secure and standardized authentication on the web without passwords. It utilizes hardware security tokens, such as USB sticks or NFC-enabled devices, that contain private keys and perform all cryptographic operations on the device itself. These tokens can be used as a security factor, confirming the user's identity without the need for passwords. The tokens communicate with the browser using the client to authenticator protocol (CTAP), ensuring a seamless user experience without compromising security. While WebAuthn provides an innovative and secure approach, there are usability concerns, such as keeping track of the hardware tokens and the risk of losing them.
Pass keys: Storing private keys in the cloud
Pass keys are private-public key pairs stored in the cloud, offered as a joint venture between Google, Microsoft, and Apple. These pass keys are encrypted with the user's cloud account password and can be used as authentic factors for logging into websites. When a user wants to log in, the website asks for permission to use the pass key stored in the cloud. The user then verifies their identity using a hardware token on their phone, such as Face ID on an iPhone. This approach provides protection against device loss and simplifies the authentication process. However, it also centralizes the user's authentication credentials, raising concerns about data privacy and putting all eggs in one basket.
WebAssembly and Modular Cloud Services
WebAssembly (Wasm) is a binary instruction format that allows developers to run high-performance code written in languages like C, C++, and Rust in the browser. It opens up possibilities for rethinking the browser's capabilities and enables modular and portable cloud services. With WebAssembly, developers can declare their requirements, such as the need for key-value caches or column stores, in a manifest and deploy their code to any provider that can meet those requirements. This allows for more flexibility and reduces vendor lock-in. However, it also presents challenges in terms of managing dependencies and ensuring compatibility across different providers.
Eli Holderness - Developer Advocate at Scaleway Mark Rendle - Creator of Visual ReCode with 7 Microsoft MVP Awards & 30+ Years of Experience Building Software
DESCRIPTION Mark Rendle interviews Eli Holderness, a developer advocate at Scaleway, about WebAuthn and the future of web authentication. Eli explains the intricacies of WebAuthn, delving into public key cryptography and hardware security tokens.
The conversation extends to broader topics, including data privacy, the challenges of passwordless authentication, and the potential impact of WebAssembly on cloud computing.
The interview provides insights into the evolving landscape of web development, security, and cloud services, offering a glimpse into the advancements and challenges faced by developers and cloud providers.