--- title: "WebAuthn" description: "5 posts about WebAuthn, summarised, each linking to the original." --- # WebAuthn > 5 posts about WebAuthn, summarised, each linking to the original. ## Articles ### [Use Passkeys Wherever You Sign in to Uber](https://yomu.fyi/post/use-passkeys-wherever-you-sign-in-to-uber.md) - Company: [Uber](https://yomu.fyi/company/uber.md) - Published: May 26, 2026 - Type: Explainer Uber rolled out passkey authentication across mobile apps and websites, allowing users to sign in without passwords. Passkeys use a device-generated public-private key pair: the server stores the public key, while the device’s password manager protects the private key and requires biometric, PIN, or pattern authorization. Registration sends creation options and a challenge to the authenticator, which returns an attestation for server validation; sign-in similarly returns a signed assertion that the server verifies with the stored public key. This design keeps private keys and user authorization data on the authenticator, improving resistance to phishing, credential stuffing, brute force, and replay attacks. Uber reported low initial adoption and noted inconsistent browser and device support, user education needs, and technical complexity; it plans to use adoption data and post-authentication prompts to improve onboarding. ### [It's Time to Evolve Authentication Security](https://yomu.fyi/post/it-s-time-to-evolve-authentication-security.md) - Company: [Okta](https://yomu.fyi/company/okta.md) - Author: Alisa Duncan - Published: Aug 6, 2025 - Type: Explainer Identity-based attacks and compromised credentials are driving a need for stronger authentication, while security requirements must be balanced against user friction and application sensitivity. The guidance recommends phishing-resistant factors, including smart cards, biometric-capable hardware, FIDO2 with WebAuthn, and Passkeys, while warning against security questions, SMS codes, email TOTP, and password antipatterns. It also advises using strong MFA as a backup, dynamic authentication policies and threat detection, and OAuth 2.1/OIDC through an identity provider, with step-up authentication to maintain assurances during a session. For application integration, the recommended approach is to redirect users to an Okta-hosted Sign-In Widget through vetted OIDC client libraries or Okta SDKs, reducing implementation errors in PKCE and token verification while supporting evolving standards. ### [Embracing passwordless authentication with Grab’s Passkey](https://yomu.fyi/post/embracing-passwordless-authentication-with-grab-s-passkey.md) - Company: [Grab](https://yomu.fyi/company/grab.md) - Author: Ocean Nguyen - Published: Dec 26, 2024 - Type: Problem & solution Grab’s Passkey adds passwordless authentication to its app to address phishing, keystroke-logging, brute-force, and other security threats associated with passwords plus the friction of OTP-based login. Built on the FIDO standard and implemented through WebAuthn, the flow uses a backend, frontend, and authenticator: the authenticator creates and stores a passkey, while Grab stores the public key and metadata. Registration uses a server-generated challenge and parameters including rp.id, user information, resident-key requirements, and supported public-key algorithms; sign-in returns a credential whose signature is verified against the stored public key. Google Password Manager and iCloud Keychain can sync passkeys across supported devices, and users authenticate with their screen lock rather than entering a password or waiting for an OTP. The implementation is described as faster, smoother, phishing-resistant login with potential savings on third-party authentication and messaging costs, while Grab plans to evaluate web login expansion through adoption, feedback, and usage data. ### [We're Living in a Passwordless World](https://yomu.fyi/post/we-re-living-in-a-passwordless-world.md) - Company: [Okta](https://yomu.fyi/company/okta.md) - Author: Alisa Duncan - Published: Aug 30, 2023 - Type: Tutorial Passwords and SMS one-time passwords are presented as vulnerable authentication methods, while the post explains how FIDO and W3C standards support passwordless, phishing-resistant sign-in. It contrasts passwords, SMS OTP, TOTP, and U2F security keys, then introduces FIDO2, which combines WebAuthn with CTAP2 and asymmetric cryptography. The registration and authentication walkthrough describes the Relying Party, client, server, browser, and authenticator interactions, including device-based PINs and biometrics. Passkeys build on WebAuthn and can work across compatible browsers and devices, with migration within some vendor ecosystems described as an additional convenience. Developers can call navigator.credentials.create and navigator.credentials.get directly or use libraries, while Identity Providers such as Okta can provide FIDO2 support through configuration. ### [Unlock Identity Expertise with Our New Developer Podcast!](https://yomu.fyi/post/unlock-identity-expertise-with-our-new-developer-podcast.md) - Company: [Okta](https://yomu.fyi/company/okta.md) - Author: E. Dunham - Published: Jun 8, 2023 - Type: Announcement Okta’s Workforce Developer Advocacy Team has launched a monthly Workforce Identity Developer Podcast for education about identity and development for customers using Okta as their identity provider. The first highlighted episodes cover Workforce Identity, security history, phishing-resistant MFA, and the relative benefits and drawbacks of WebAuthN and Passkeys; another compares OAuth application integrations with older SSWS tokens. A further episode discusses building SaaS for enterprise customers, including the “Enterprise-Ready MVP,” broadening “Okta Developers” to people building code for Okta customers, and extreme enterprise use cases. Audio is available on Casted, while new content and feedback are supported through social channels, YouTube, and comments on the developer forum.