TechPrufer
Get started
Grab
Grab logoGrab · Feature trail

Passwordless Authentication with Passkeys

1 post · Dec 2024

What this trail covers

Grab has introduced Passkey, a passwordless authentication method leveraging the FIDO standard. This system allows users to authenticate using device biometrics or screen locks, enhancing security by being phishing-resistant and eliminating the need to store secrets on Grab's servers. The implementation involves backend and frontend components interacting with user authenticators, with detailed WebAuthn parameters for both passkey creation and sign-in flows. Supported environments include Google Password Manager and iCloud Keychain.

All Grab trails
  1. Embracing passwordless authentication with Grab’s PasskeyThis post details the implementation of Passkey for passwordless authentication at Grab. It explains the underlying FIDO standard, the benefits of Passkey over traditional passwords (phishing resistance, no secret storage on Grab's servers), and its adoption trends. The post provides architectural details on the backend, frontend, and authenticator components, along with sequence diagrams for passkey registration and sign-in. It also highlights notable WebAuthn parameters used in the implementation, such as `challenge`, `excludeCredentials`, `authenticatorSelection`, `allowCredentials`, and `userVerification`, and mentions support for Google Password Manager and iCloud Keychain.