PASSKEYS AND WEBAUTHN EXPLAINED

Summary from the TLDR InfoSec newsletter

This walkthrough covers passkey registration and login end-to-end, from server-issued challenges and stored public keys to SimpleWebAuthn verification in Node. Phishing resistance comes from RP ID scoping, which browsers enforce, but servers must still verify alongside exact origin, challenge freshness, and user verification. Teams tend to underestimate single-use challenges, concurrent login tabs, credential management screens, and recovery paths that end up weaker than the login they back up.