Webauthn is a standard allowing browsers to communicate between an authenticator device and a web server to perform cryptographic authentication. Seen as the future of login and "the end of passwords" by microsoft and many others, this standard and it's behaviour will only become more important - and relevant - in the field of security. In this talk we'll explore the benefits of webauthn to end users and deployments, how webauthn works, and we'll dive into some of the darker cobweb ridden corners that yield some surprising - and common - mistakes in implementations. For defense, you'll walk away knowing more about why webauthn is the future of auth and how to avoid common pitfalls that may impact your deployments. For offense, you'll learn about ways to bypass or reduce the strength of webauthn when incorrectly implemented.