Deploying webauthn

Case Studies

• Cloudflare
• Figma: Thread 1, Thread 2
• Gitlab
• Google: "Security Keys: Practical Cryptographic Second Factors for the Modern Web"
• Palantir: Part 1, Part 2, Part 3
• Panther
• Twitter
• Discord Blog , BSidesSF 2023: WebAuthn, Yubikeys, and You, Blog: Support for Customers
• USDA

Other Compilations

• Scott Piper's Tweet Thread
• Clint Gibler's TLDRSec coverage

Research

• Challenges with Passwordless FIDO2 in an Enterprise Setting: A Usability Study
• Why Aren’t We Using Passkeys? Obstacles Companies Face Deploying FIDO2 Passwordless Authentication (Extended Version)

Anecdata

Christopher Glyer

I was talking to a CISO the other day and he mentioned that when his org implemented MFA with the MSFT authenticator app it reduced their aggregate number of security incidents by ~25%.
The rollout of Yubikeys for all employees reduced # of security incidents another 25%.