INTROL Logs

A TPM is a dedicated hardware security chip on the motherboard that performs cryptographic operations and guards keys — in WebAuthn it acts as the platform authenticator that generates and stores the private key. * The TPM seals the key in hardware and signs on-chip. * A TPM pro...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

The client sends back the challenge signed by the private key; the relying party verifies that signature using the public key it stored at registration — a valid signature proves possession of the private key. This is asymmetric cryptography doing the heavy lifting: Only the pri...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

"Resident keys," also called "discoverable credentials" — the authenticator stores enough account info to present the right credential itself, so the site needs neither a username nor a password. Normally a WebAuthn login starts by sending a username so the server can return the...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

No — the PIN/biometric only unlocks the local authenticator (the TPM); it never leaves the device or touches the internet. The real authentication is the TPM's cryptographic signature. There's a crucial two-layer distinction: Unlocking element (usability layer): the PIN, fingerp...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

No — they solve different problems. WebAuthn handles authentication (proving who you are at login); OAuth handles authorization (delegating access to APIs/resources). They are complementary, not competing: WebAuthn OAuth 2.0 Solves Authentication — replace the password at...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

Cookies/passwords store a reusable secret on the server; OAuth centralizes it at an identity provider; WebAuthn stores only a public key server-side while the private key never leaves the user's device. * Where the secret lives per mechanism: WebAuthn stores only a useless-to-st...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

The authenticator generates a new public/private key pair; the private key stays sealed on the device, and only the public key (inside an attestation object) is sent to the relying party. * WebAuthn registration: the device keeps the private key, sends only the public key. * The...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

Advantages: phishing-resistant, no shared secret to steal, great login experience. Disadvantages: hardware dependency and portability/integration challenges. Weighing it up against passwords and cookies: Advantages Security — no shared secret transmitted or stored; the private k...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

It calls the API and presents the Access Token in the request's Authorization header; the API validates the token and, if the scopes allow, returns the data. Once the app has obtained the access token (the preceding step of the flow), it makes the "magic API call" — the last two...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

The challenge is a fresh random value the authenticator must sign; signing it proves possession of the private key right now and blocks replay attacks. This is classic challenge-response authentication: The server (relying party) issues a random, single-use challenge. The authen...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026