A Passwordless Future! Passkeys for Java Developers

Weak passwords remain one of the major causes of breaches and security incidents. The Web Authentication standard provides a robust framework for passwordless authentication using passkeys. Passkeys are the latest revolution in authentication. You may have used it with Google or GitHub. But what exactly is it and how does it work?
Join me on an illustrated journey to learn everything about passkeys.

We will dive into the core concepts of passkeys, their architecture, and their pros and cons. We will see how Passkey leverages public key cryptography and biometrics/hardware authenticators to offer enhanced security and usability while eliminating the vulnerabilities associated with traditional password-based systems.

We will explore how Java developers can leverage WebAuthn Java libraries to implement passkeys in their apps. We will also learn to use passkeys with Spring Security and external Identity providers. There will be demos, showing step-by-step integration of passkeys into Java web applications.

Transcript

1. A Passwordless Future! Passkeys and WebAuthn for Java developers Deepu K Sasidharan
2. @oktaDev | @deepu105 | deepu.tech ➔ JHipster co-chair ➔ Java Champion ➔ Creator of KDash, JDL Studio, JWT UI ➔ OSS aficionado, polyglot dev, author, speaker ➔ Developer Advocate @ Okta Hi, I’m Deepu K Sasidharan @deepu105@mastodon.social deepu.tech @deepu105 deepu05
3. @oktaDev | @deepu105 | deepu.tech Why passwordless?
4. @oktaDev | @deepu105 | deepu.tech The password problem
5. @oktaDev | @deepu105 | deepu.tech Verizon Data Breach Investigation Report
6. @oktaDev | @deepu105 | deepu.tech The human problem
7. @oktaDev | @deepu105 | deepu.tech Phishing Knowledge-based Remote replay Data breach Reuse & share Password management
8. @oktaDev | @deepu105 | deepu.tech Passwordless Biometric Magic links OTPs Push notifications
9. @oktaDev | @deepu105 | deepu.tech Passwordless future == Passkeys
10. @oktaDev | @deepu105 | deepu.tech Public-key cryptography Pair of mathematically linked keys
11. @oktaDev | @deepu105 | deepu.tech
12. @oktaDev | @deepu105 | deepu.tech
13. @oktaDev | @deepu105 | deepu.tech Authenticator Can create and store public-private key pairs
14. @oktaDev | @deepu105 | deepu.tech Roaming authenticators Removable device via USB, NFC, Bluetooth • Yubikey • Google Titan • Smartphones Platform authenticators Built into the device • TouchID • FaceID • Smartphone authenticators • Windows Hello
15. @oktaDev | @deepu105 | deepu.tech == Authentication standard Based on public key cryptography. FIDO
16. @oktaDev | @deepu105 | deepu.tech FIDO2 WebAuthentication (WebAuthn) Client to Authenticator Protocol (CTAP)
17. @oktaDev | @deepu105 | deepu.tech == W3C standard WebAuthn is the standard that allows for passkeys implementation WebAuthn
18. @oktaDev | @deepu105 | deepu.tech Illustration based on https://webauthn.me/introduction
19. @oktaDev | @deepu105 | deepu.tech Client to Authenticator Protocol Communicate with authenticators over USB, NFC, and Bluetooth
20. @oktaDev | @deepu105 | deepu.tech
21. @oktaDev | @deepu105 | deepu.tech == Discoverable passwordless FIDO credentials It uses asymmetric public key cryptography Passkeys
22. @oktaDev | @deepu105 | deepu.tech Passkeys Synced Device-bound • Private key synced between devices in same ecosystem and backed up to cloud • Better usability • One time enrollment • Can be restored on device loss or on new device • Less secure than device-bound passkeys • Private key stored only on the device • Not as convenient as synced passkeys • Each device needs enrollment • No recovery or backups • Most secure option
23. @oktaDev | @deepu105 | deepu.tech How does the magic happen?
24. @oktaDev | @deepu105 | deepu.tech Registration flow
25. @oktaDev | @deepu105 | deepu.tech Authentication flow
26. @oktaDev | @deepu105 | deepu.tech Why passkeys?
27. @oktaDev | @deepu105 | deepu.tech Phishing Knowledge-based Remote replay Data breach Reuse & share Password management
28. @oktaDev | @deepu105 | deepu.tech Easier to maintain Not reusable & shareable* Breach resistant Remote attack resistant Phishing resistant Discoverable
29. @oktaDev | @deepu105 | deepu.tech Passkeys security and usability spectrum
30. @oktaDev | @deepu105 | deepu.tech Challenges
31. @oktaDev | @deepu105 | deepu.tech • OS/Browser support • Cloud vendor reliance • Enterprise use cases • Reset & recovery
32. @oktaDev | @deepu105 | deepu.tech Passkeys in Spring Boot web app using an IdP Auth0 by Okta as IdP
33. @oktaDev | @deepu105 | deepu.tech # Create a Spring Boot web app $ curl -G https://start.spring.io/starter.tgz \ -d dependencies=web,okta -d baseDir=passkey-demo | tar -xzvf - # Add controller for @GetMapping("/") # Create an Auth0 account and configure tenant to enable passkeys # Login to the tenant $ auth0 login # Create an Auth0 app $ auth0 apps create \ /-name "Spring Boot Passkeys" \ /-description "Spring Boot Example" \ /-type regular \ /-callbacks http://localhost:8080/login/oauth2/code/okta \ /-logout-urls http://localhost:8080 \ /-reveal-secrets # Update OIDC credentials # Start the app $ ./gradlew bootRun a0.to/spring-passkey
34. @oktaDev | @deepu105 | deepu.tech Passkeys in Java apps
35. @oktaDev | @deepu105 | deepu.tech WebAuthn4j • FIDO2 conformant • Supports attestation validation • Supports all attestation formats • Suitable for relying party server implementation • Supports passkeys • Used by Keycloak • Has Spring Security support • Kotlin friendly java-webauthn-server • Not 100% FIDO2 conformant • Supports attestation validation • All attestation formats not supported • Suitable for relying party server implementation • Supports passkeys • From Yubico
36. @oktaDev | @deepu105 | deepu.tech Passkeys with Spring Security and WebAuthn4j Spring Boot web app as a relying party server using WebAuthn4j
37. @oktaDev | @deepu105 | deepu.tech WebAuthn4J Spring Security # Clone the repo $ git clone https://github.com/deepu105/webauthn4j-spring-boot-passkeys-demo # Start the app $ ./gradlew bootRun a0.to/spring-webauthn
38. @oktaDev | @deepu105 | deepu.tech Passkeys with Spring Security
39. @oktaDev | @deepu105 | deepu.tech spring-security-webauthn • Provides default registration and login pages • Will become a Spring Security core option • Based on WebAuthn4j • At experimental stage now • Expected in Spring Security 6.4 (November, hopefully)
40. @oktaDev | @deepu105 | deepu.tech How does it differ from WebAuthn MFA?
41. @oktaDev | @deepu105 | deepu.tech Passkeys • Implemented using WebAuthn and FIDO2 • Can be synced or device-bound • Discoverable credentials (Resident keys) • Can be used for account registration as first factor • Enrollment required only once for synced passkeys WebAuthn MFA • Implemented using WebAuthn and FIDO2 • Only device-bound • Non-Discoverable credentials • Can only be second factor after account registration with password • Enrollment required on each device
42. @oktaDev | @deepu105 | deepu.tech https://learnpasskeys.io https://webauthn.me/passkeys https://passkeys.dev https://passkey.org https://fidoalliance.org/passkeys Resources
43. Authorization Authentication Security Single Sign-On | Adaptive Multi-Factor Authentication | Universal Login | Passwordless | Bot Detection & Prevention | Security Center | Breached Password Detection | Brute Force Protection | FGA How we can help: Try Free Today: Free Plan (forever) $0 Up to 7,500 monthly active users. Unlimited user logins. Includes passkeys support*. No credit card required. Special Plans for Startups & Nonprofits Plans for Everyone B2C: your users are consumers B2B: your users are businesses or a mix of businesses and consumers Enterprise: Best for production applications that need to scale - Contact Us Make login our problem. Not yours. a0.to/plg_signup
44. @oktaDev | @deepu105 | deepu.tech Thank You Subscribe to our newsletter a0.to/nl-signup/java Try our free Spring Boot microservices workshop a0.to/spring-boot