Passkey Authentication Explained
Source: YouTube · Destination Certification · published Nov 4, 2026 · 24:45
This video walks through the complete WebAuthn pass key authentication process, following user Alice as she logs into her bank (piggybank.com), explaining the roles, messages, digital signatures, and verification checks involved 0:00-0:19.
Key Takeaways:
• Four roles are required: the user (Alice), the authenticator (software on her device managing the private key and creating digital signatures), the client (browser + OS), and the service (piggybank.com) 1:10-1:53.
• The login starts when the service sends a fresh random challenge and requirements (RP ID, user verification) back to the client; the challenge prevents replay attacks since old responses won't match a new challenge 2:03-2:33.
• Pass keys are discoverable credentials—Alice's authenticator can find the right pass key for piggybank.com without her typing a username first; the credential stores her private key, the RP ID, her user handle, and a credential ID 4:36-5:20.
• Alice approves use of the pass key with a local check (PIN, fingerprint, or Face ID); this happens entirely on her device—her biometrics or PIN are never sent to the website 12:51-13:18.
• The authenticator signs a combination of authenticator data and hashed client data (containing challenge and origin) with Alice's private key; the response includes the signature, credential ID, and user handle, but never the private key 15:45-17:15.
• The service verifies the type, challenge, and origin in the client data, checks the RP ID hash, user present/verified flags, and validates the signature with Alice's registered public key; a non-increasing signature counter can warn of a cloned authenticator but isn't definitive proof 19:31-22:33.
Overall, pass key authentication proves Alice's identity using a signature made with her private key while her private key, PIN, and biometrics never travel over the internet—a core reason pass keys are secure 23:56-24:28.
Sources:
- 0:00 Introduction to the video's goal of explaining pass key authentication
- 1:10 Definition of the four required roles for pass keys
- 2:03 Overview of the process and the role of the fresh challenge
- 4:36 Discoverable credentials and pass key contents
- 12:51 Local user verification and consent before signing
- 15:45 Creation of the digital signature and response contents
- 19:31 Service-side verification checks, including the signature counter
- 23:56 Summary of why pass keys are secure
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Identity & Access Management. Commonly maps to: Identity and Access Management (IAM), Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
You've heard that pass keys are the future of authentication and you want to understand how a pass key can authenticate you to a website. What actually happens behind the scenes, what convinces the website to let you in. If you'd like to understand the whole process, but you're not stoked to read the super riveting official web offend standard, then this is the video for you. I've read the whole standard so you don't have to. We'll follow a user, Alice, as she uses her pass key to log into her bank, piggy bank.com. I'll introduce the four required roles for pass keys, give you a quick overview of the process, and then we'll dive into all the details of the messages exchanged, the data in those messages, the digital signature, and all the checks that have to pass, all the fun stuff. If you …