Emil Lundberg
- Editor of the W3C Web Authentication specification
- Maintainer of java-webauthn-server, Yubico's open-source relying-party library
Bio
Emil Lundberg is a software engineer at Yubico and an editor of the W3C Web Authentication specification. He also maintains java-webauthn-server, the open-source library many JVM applications use to implement the relying-party side of WebAuthn.
Profile built from public W3C and project records.
Where their work shows up
Writing the specification and maintaining a conformant implementation of it is an unusually useful combination: the ambiguities that survive review surface immediately in code, and the fixes go back into the text. Attestation handling, credential-ID management, and the relying-party verification steps are where most WebAuthn integrations go wrong, and a well-maintained library is what keeps that from being every team's problem. See Yubico and the best phishing-resistant MFA ranking.
Related on Start with Identity
- GlossaryPasskey
A passkey is a WebAuthn public-key credential that replaces a password. Possession of the authenticator plus a user verification step proves identity, with no s
- GlossaryPhishing-Resistant MFA
Multi-factor methods that cannot be relayed or replayed by a phishing site, principally FIDO2 security keys and passkeys. Recommended by NIST and CISA over OTP
- GlossaryFIDO2
FIDO2 is a set of specifications from the FIDO Alliance plus W3C. It combines WebAuthn (the browser API) with CTAP (the client-to-authenticator protocol) to ena
- CVEStrongKey FIDO Server credential-type confusion, passkey bypass
StrongKey FIDO Server 4.10.0-4.15.0 confused discoverable and non-discoverable credentials. An attacker can complete passkey authentication as the victim. High.
- CVEWindows stores WebAuthn assertions in cleartext event logs
The Windows Event Logging Service wrote WebAuthn assertions in the clear, readable by unprivileged or remote users. SpecterOps / Grafnetter chained it at Black
- ExpertChairman
Nat Sakimura has chaired the OpenID Foundation for many years and is a primary author of the OpenID Connect specifications and the FAPI security profile used by