![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321067/SLIDES_SPEAKERS-keynote.001.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11327303/SLIDES_SPEAKERS-keynote_2.001.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11327304/SLIDES_SPEAKERS-keynote_2.002.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
https://slides.com/elpete/itb2024-cbsecurity-passkeys
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11327308/passkeys_logo.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11327308/passkeys_logo.png)
Competition
Who has the most Passkeys?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
What this talk is
- An intro to passkeys and passwordless authentication
- Overview of the CBSecurity Passkeys module
- Demo of integrating passkeys into a new ColdBox application
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
What this talk isn't
- Introduction to CBSecurity
- Deep Dive of all Passkeys options
- Framework-agnostic (requires CBSecurity and ColdBox)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321072/SLIDES_SPEAKERS-keynote.004.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Authentication
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
-
Username and Password
-
Single-use Links (Email login)
-
Two Factor Authentication
-
Security Keys or Cards
Authentication
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
The Problems with Passwords
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11334764/Screenshot_2024-05-14_at_11.07.11_AM.png)
Source: The United States of P@ssw0rd$
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11334776/Screenshot_2024-05-14_at_11.05.36_AM.png)
Source: The United States of P@ssw0rd$
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11334790/Screenshot_2024-05-14_at_11.05.39_AM.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11334793/Screenshot_2024-05-14_at_11.05.58_AM.png)
Source: The United States of P@ssw0rd$
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11334795/Screenshot_2024-05-14_at_11.06.02_AM.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Source: The United States of P@ssw0rd$
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11334802/Screenshot_2024-05-14_at_11.06.06_AM.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11334733/Screenshot_2024-05-14_at_11.02.50_AM.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11334733/Screenshot_2024-05-14_at_11.02.50_AM.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
So what's the solution?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Password Rules?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Password Manager?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11334819/Screenshot_2024-05-14_at_11.19.11_AM.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11334795/Screenshot_2024-05-14_at_11.06.02_AM.png)
Source: The United States of P@ssw0rd$ (2019)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11334823/Screenshot_2024-05-14_at_11.21.20_AM.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Friction
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Phishing
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
How do Passkeys solve the problems with Passwords?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
- No passwords to remember
- Unique passkey per site
- Two-factor by default
- Cannot be phished
- Built on Public / Private key pairs
Benefits of Passkeys
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Webauthn
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Passkeys
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Webauthn
Passkeys
==
Techincal Name
Marketing
Webauthn
Passkeys
!==
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Adoption
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11335008/580b57fcd9996e24bc43c516-3087520785.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11335000/Google-Symbol-1893977628.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11335002/28350-5-microsoft-logo-photos-2761097778.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11335005/amazon-logo-png-4128x2322_abf78dd4_transparent-3188215335.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11335006/logo-firefox-2048-773212378.png)
In less than a year, passkeys have been used to authenticate people more than 1 billion times across over 400 million Google Accounts.
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Paid Solutions
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
The "Ortus Solutions"
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11334881/CBSecurity-L.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11334885/ColdBoxLogo2015.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
CBSecurity Passkeys
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11334881/CBSecurity-L.png)
SUPER COOL LOGO
COMING SOON!
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
CBSecurity Passkeys
- Builds on CBSecurity and CBAuth
- Uses your Authentication Provider to log users in
- Requires CBSecurity 3+ and CBAuth 6.1+
- Built on top of webauthn-server-core by Yubico
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
CBSecurity Passkeys
- All required Java dependencies in a single jar
- Handlers for registering new Passkeys and authenticating using Passkeys
- JavaScript resources for registering new Passkeys and authenticating using Passkeys
- Required interface for storing and retrieving Passkeys from an external store (e.g. database)
Provides:
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Installation
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
box install cbsecurity-passkeys
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
component {
this.javaSettings = {
loadPaths : [ expandPath( "./modules/cbsecurity-passkeys/lib" ) ],
loadColdFusionClassPath : true,
reloadOnChange : false
};
}
Load Java Dependencies
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
schema.create( "cbsecurity_passkeys", ( t ) => {
t.increments( "id" );
t.unsignedInteger( "userId" ).references( "id" ).onTable( "users" );
t.raw( "credentialId BLOB" );
t.raw( "publicKey BLOB" );
t.unsignedInteger( "signCount" );
t.bit( "backupEligible" );
t.bit( "backupState" );
t.raw( "attestationObject BLOB" );
t.text( "clientDataJSON" );
t.datetime( "lastUsedTimestamp" ).nullable();
} );
(OPTIONAL)
Migrate Database Table
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Configuration
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Module Settings
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
moduleSettings = {
"cbsecurity-passkeys" : {
// WireBox mapping to the component
// implementing the ICredentialRepository interface
"credentialRepositoryMapping": "",
// The identifier for the relying party (your application)
"relyingPartyId" : CGI.SERVER_NAME,
// The display name for the relying party (your application)
"relyingPartyName" : controller.getSetting( "appName" ),
// The allowed origins to send you Passkeys.
// Defaults to the server name, if empty.
// (Non-standard ports need to be specified explicitly)
"allowedOrigins": []
}
};
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
ICredentialRepository
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
ICredentialRepository
- Defines the methods needed to register and authenticate Passkeys
- An example implementation using Quick is available in the module.
resources/examples/Passkey.cfc
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
ICredentialRepository
public string function getUsernameForUser( required any user ) {}
public string function getDisplayNameForUser( required any user ) {}
public any function getUserHandleForUser( required any user ) {}
public array function getCredentialIdsForUsername( required string username ) {}
public any function getUserHandleForUsername( required string username ) {}
public string function getUsernameForUserHandle( required any userHandle ) {}
public struct function lookup( required any credentialId, required any userHandle ) {}
public array function lookupAll( required any credentialId ) {}
public void function storeCredentialForUser( /* ... */ ) {}
public void function updateCredentialForUser( /* ... */ ) {}
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Usage
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Server-side
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Implement ICredentialRepository
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Client-side
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Detecting Passkey Support
<cfoutput>
<div>
<div class="jumbotron mt-sm-5 p-4">
<h1>Passkey Demo</h1>
</div>
<form id="passkey-form" action="#event.buildLink( "passkeys.new" )#" method="GET" style="display: none;">
<button type="submit" class="btn btn-primary">Create Passkey</button>
</form>
</div>
</cfoutput>
<script src="/modules_app/cbsecurity-passkeys/includes/js/passkeys.js"></script>
<script>
if (window.cbSecurity.passkeys.isSupported()) {
document.getElementById("passkey-form").style.display = "block";
}
</script>
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Registering Passkeys
<cfoutput>
<div>
<div class="jumbotron mt-sm-5 p-4">
<h1>Creating a Passkey...</h1>
</div>
</div>
<script src="/modules/cbsecurity-passkeys/includes/passkeys.js"></script>
<script>
window.cbSecurity.passkeys.register();
</script>
</cfoutput>
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Logging in with a Passkey
<cfoutput>
<h3>Log In</h3>
<small>or <a href="#event.buildLink( "registrations.new" )#">register for an account</a></small>
<hr />
<form id="loginForm" method="POST" action="#event.buildLink( "login" )#">
<input type="hidden" name="_token" value="#csrfGenerateToken()#" />
<div class="form-group">
<label for="username">Email Address:</label>
<input name="email" type="text" class="form-control" id="email" autocomplete="username webauthn" />
</div>
<div class="form-group">
<label for="password">Password:</label>
<input name="password" type="password" class="form-control" id="password" autocomplete="current-password webauthn"/>
</div>
<div class="form-group">
<button type="submit" class="btn btn-primary">Log In</button>
</div>
</form>
<button id="passkeyLoginButton" type="button" class="btn btn-primary" style="display: none;">Log in with Passkey</button>
</cfoutput>
<script src="/modules_app/cbsecurity-passkeys/includes/passkeys.js"></script>
<script>
if ( window.cbSecurity.passkeys.isSupported() ) {
const passkeyLoginButton = document.getElementById( "passkeyLoginButton" );
passkeyLoginButton.style.display = "block";
passkeyLoginButton.addEventListener( "click", function() {
window.cbSecurity.passkeys.login(document.forms.loginForm.email.value);
});
}
</script>
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
Demo
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321070/SLIDES_SPEAKERS-keynote.005.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11327308/passkeys_logo.png)
Competition Results
So who has the most Passkeys?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/847439/images/11321246/SLIDES_SPEAKERS-keynote.007.png)
ITB 2024 — CBSecurity Passkeys
By Eric Peterson
ITB 2024 — CBSecurity Passkeys
- 118