INTROL Logs

A platform authenticator is built into the device (e.g. a TPM chip with Windows Hello); a cross-platform authenticator is an external device you can move between machines (e.g. a YubiKey, USB key, or smartphone). WebAuthn lets the relying party request an authenticatorAttachment:...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

The browser calls navigator.credentials.get, the authenticator signs the server's challenge with the private key, and allowCredentials tells the browser which credential ID(s) the server expects to be used. * WebAuthn login: allowCredentials names the key; the signed challenge i...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

A dedicated FIDO2 security key (a special USB stick, from ~30 euros as reported by the German computing magazine c't in 2023) can store passkeys; even on sites that don't support full passkey login, such a key can be registered as a phishing-resistant second factor. The coverage...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

A TPM is a dedicated hardware security chip on the motherboard that performs cryptographic operations and guards keys — in WebAuthn it acts as the platform authenticator that generates and stores the private key. * The TPM seals the key in hardware and signs on-chip. * A TPM pro...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

The client sends back the challenge signed by the private key; the relying party verifies that signature using the public key it stored at registration — a valid signature proves possession of the private key. This is asymmetric cryptography doing the heavy lifting: Only the pri...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

"Resident keys," also called "discoverable credentials" — the authenticator stores enough account info to present the right credential itself, so the site needs neither a username nor a password. Normally a WebAuthn login starts by sending a username so the server can return the...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

No — the PIN/biometric only unlocks the local authenticator (the TPM); it never leaves the device or touches the internet. The real authentication is the TPM's cryptographic signature. There's a crucial two-layer distinction: Unlocking element (usability layer): the PIN, fingerp...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

No — they solve different problems. WebAuthn handles authentication (proving who you are at login); OAuth handles authorization (delegating access to APIs/resources). They are complementary, not competing: WebAuthn OAuth 2.0 Solves Authentication — replace the password at...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

Cookies/passwords store a reusable secret on the server; OAuth centralizes it at an identity provider; WebAuthn stores only a public key server-side while the private key never leaves the user's device. * Where the secret lives per mechanism: WebAuthn stores only a useless-to-st...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

The authenticator generates a new public/private key pair; the private key stays sealed on the device, and only the public key (inside an attestation object) is sent to the relying party. * WebAuthn registration: the device keeps the private key, sends only the public key. * The...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026