John Bradley
- Co-author of WebAuthn and FIDO2 specifications
- Co-author of OpenID Connect and multiple OAuth RFCs
- Former board member of the OpenID Foundation
Bio
John Bradley is senior standards architect at Yubico and one of the few people whose name appears across both the federation and the authenticator halves of modern identity: OpenID Connect and OAuth on one side, WebAuthn and FIDO2 on the other. He was previously a senior technical architect at Ping Identity and served on the OpenID Foundation board.
Profile built from public specification, foundation, and employer records.
Where their work shows up
Passkeys work because the credential is bound to an origin and never leaves the authenticator, which is what makes phishing resistance a property of the protocol rather than a property of the user's attention. That guarantee lives in the WebAuthn and CTAP specifications he helped write. See the implementing passkeys in the enterprise guide and Yubico.
Related on Start with Identity
- GlossaryPasskey
A passkey is a WebAuthn public-key credential that replaces a password. Possession of the authenticator plus a user verification step proves identity, with no s
- GlossaryPhishing-Resistant MFA
Multi-factor methods that cannot be relayed or replayed by a phishing site, principally FIDO2 security keys and passkeys. Recommended by NIST and CISA over OTP
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b