Beginner LevelAuthentication & Authorization
What are Passkeys (WebAuthn / FIDO2) and how do they eliminate passwords?
❓ Interview Prompt: Explain public-key cryptography authenticators, WebAuthn API, phishing resistance, and hardware authenticators.
Passkeys (built on W3C WebAuthn and FIDO2 standards) are a modern replacement for passwords that use public-key cryptography.
How Passkeys Eliminate Passwords:
1
Key Pair Generation: During registration, the user's local device (TouchID, FaceID, YubiKey, Windows Hello) generates a unique public/private key pair bound specifically to that domain.
2
Public Key Storage: The server stores ONLY the public key.
3
Private Key Isolation: The private key never leaves the user's hardware secure enclave.
4
Challenge Authentication: During login, the server sends a random challenge nonce. The device signs the challenge using its private key after verifying local biometrics.
Primary Advantage:
100% immune to Phishing Attacks because authenticators refuse to sign challenges for mismatched domain origins!
Code Implementation Example
typescript
// Initiating WebAuthn Passkey authentication in browser
async function authenticateWithPasskey(challengeBase64: string) {
const publicKeyCredentialRequestOptions: PublicKeyCredentialRequestOptions = {
challenge: Uint8Array.from(atob(challengeBase64), c => c.charCodeAt(0)),
rpId: window.location.hostname,
userVerification: 'required'
};
// Browser prompts user for TouchID / FaceID / YubiKey
const credential = await navigator.credentials.get({
publicKey: publicKeyCredentialRequestOptions
});
// Send signed assertion to server for verification
return credential;
}💡Invoking WebAuthn browser API for Passkey biometric authentication.
🎯 Interview Key Takeaway
Passkeys replace passwords with public-key cryptography bound to hardware biometrics, providing total immunity to phishing.
#Passkeys#WebAuthn#FIDO2#Passwordless#Beginner
Back to all Authentication & Authorization Questions→