Passwords are Dead: WebAuthn for Securing Web Applications

Modern web applications are poised to replace passwords with widely available cryptographic authenticators. The Verizon DBIR cites password misuse or brute force as responsible for more than 80% of all breaches year-over-year, so why do we still use them when alternatives exist? This talk will discuss advances in authentication methods not reliant on passwords, introduce and provide context around the FIDO2/WebAuthn standard, and review current platform support for WebAuthn implementation. Further, it will demonstrate integrating WebAuthn into a React and Python application, and finally discuss security posturing and system design considerations when implementing passwordless authentication systems.