INTROL Logs

IDaaS means outsourcing login/identity management to a cloud provider; federated identity means one set of credentials at a trusted provider logs you into many independent applications. IDaaS (Identity-as-a-Service): instead of building and securing your own auth (registration, p...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

rp identifies the website the credential belongs to (its ID/domain) — binding each credential to one origin is what makes WebAuthn phishing-resistant. The rp field names the relying party (e.g. id: "webauthn.io"). The credential the authenticator creates is scoped to that relying...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

Logging in needs two things at once: possession of the device that holds the private key (factor 1) plus a local PIN or biometric to unlock it (factor 2) — so a single tap already combines "something you have" and "something you are/know." A passkey login feels like one step, but...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

WebAuthn replaces the shared-secret password with public-key cryptography, so there is no password to phish, reuse, guess, or steal from a server breach. As of the FS26 source, passwords were still the most common login method despite glaring weaknesses — "123456" and "password"...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

pubKeyCredParams is the relying party's ordered list of acceptable public-key algorithms; alg: -7 is the COSE identifier for ES256 (ECDSA with the P-256 curve and SHA-256). When the relying party requests a credential, it lists which signature algorithms it will accept in pubKeyC...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

Each passkey is bound to the exact domain (origin) it was created for; the browser/OS will only offer it to that domain, so a look-alike site simply cannot trigger the real credential. The c't article uses the paypa1.com example: the website's domain is baked into the credential...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

The User Agent (browser), the Relying Party (the website you log into), and the Authenticator (the device holding the keys, e.g. a TPM chip or YubiKey). WebAuthn (a W3C standard published March 2019) coordinates three roles: Party What it is Role User Agent the browser Med...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

It's the central return object from the authenticator to the website, containing the newly created public key plus metadata that lets the relying party verify and trust the credential. The attestationObject is what completes registration on the client side. It bundles: the publi...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

Synced passkeys are copied between your devices via the platform vendor's cloud (Apple/Google/Microsoft), end-to-end encrypted before upload, so the provider itself cannot read or use them — but it ties you to that ecosystem. Plain WebAuthn keys are device-bound (lose the device,...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026

A platform authenticator is built into the device (e.g. a TPM chip with Windows Hello); a cross-platform authenticator is an external device you can move between machines (e.g. a YubiKey, USB key, or smartphone). WebAuthn lets the relying party request an authenticatorAttachment:...

Quiz: INTROL / Web Authentication: Cookies, OAuth 2.0 / OIDC & WebAuthn | updated: Jul 30, 2026