Blog

Passkeys 1: How WebAuthn and FIDO2 Work: RP ID, Challenge, Attestation and Assertion

A passkey resists phishing because the browser uses the credential only on origins of its registered RP ID, and the signature covers the clientDataJSON that carries the origin and the challenge. We decode real attestation and assertion data captured in the Bookstore lab with CBOR, verify the signature by hand, and explain the UV, BE and BS flags, synced versus device-bound passkeys and account recovery design.