INTROL Logs

The User Agent (browser), the Relying Party (the website you log into), and the Authenticator (the device holding the keys, e.g. a TPM chip or YubiKey). WebAuthn (a W3C standard published March 2019) coordinates three roles: Party What it is Role User Agent the browser Med...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

It's the central return object from the authenticator to the website, containing the newly created public key plus metadata that lets the relying party verify and trust the credential. The attestationObject is what completes registration on the client side. It bundles: the publi...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

Synced passkeys are copied between your devices via the platform vendor's cloud (Apple/Google/Microsoft), end-to-end encrypted before upload, so the provider itself cannot read or use them — but it ties you to that ecosystem. Plain WebAuthn keys are device-bound (lose the device,...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

A platform authenticator is built into the device (e.g. a TPM chip with Windows Hello); a cross-platform authenticator is an external device you can move between machines (e.g. a YubiKey, USB key, or smartphone). WebAuthn lets the relying party request an authenticatorAttachment:...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

The browser calls navigator.credentials.get, the authenticator signs the server's challenge with the private key, and allowCredentials tells the browser which credential ID(s) the server expects to be used. * WebAuthn login: allowCredentials names the key; the signed challenge i...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

A dedicated FIDO2 security key (a special USB stick, from ~30 euros as reported by the German computing magazine c't in 2023) can store passkeys; even on sites that don't support full passkey login, such a key can be registered as a phishing-resistant second factor. The coverage...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

A TPM is a dedicated hardware security chip on the motherboard that performs cryptographic operations and guards keys — in WebAuthn it acts as the platform authenticator that generates and stores the private key. * The TPM seals the key in hardware and signs on-chip. * A TPM pro...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

The client sends back the challenge signed by the private key; the relying party verifies that signature using the public key it stored at registration — a valid signature proves possession of the private key. This is asymmetric cryptography doing the heavy lifting: Only the pri...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

"Resident keys," also called "discoverable credentials" — the authenticator stores enough account info to present the right credential itself, so the site needs neither a username nor a password. Normally a WebAuthn login starts by sending a username so the server can return the...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

No — the PIN/biometric only unlocks the local authenticator (the TPM); it never leaves the device or touches the internet. The real authentication is the TPM's cryptographic signature. There's a crucial two-layer distinction: Unlocking element (usability layer): the PIN, fingerp...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026