Design Passwordless Auth - System Design | WinJob

Problem statement: enterprise passwordless identity

Replace passwords with WebAuthn passkeys while keeping B2B SSO and regulated recovery paths.

Numbers to state early

Metric A: 800M accounts
Metric B: FIDO2 primary
Metric C: p99 250ms ceremony

Mechanism

The hot path for User → Browser → RP keeps private keys off the server. For problem statement: enterprise passwordless identity, state 800M accounts when the interviewer pushes on scale.

Failure and edge cases

Clock skew on authenticators, duplicate Idempotency-Key finish calls, HSM throttle during Black Friday login, and tenant mis-binding RP ID to the wrong custom domain.

When discussing Problem statement: enterprise passwordless identity, lead with phishing resistance and challenge single-use semantics—not generic "auth best practices." Cite 800M accounts before drawing components.

Design pressure specific to passkeys

Operators running Browser under Problem statement: enterprise passwordless identity must assume partial HSM regions: deny new enrollments, allow verify with cached keys, and never log assertion payloads. B2B tenants need FIDO2 primary enforced at the API gateway.

Java

javaOne Dark Pro

1 public final class WebAuthnChallenge {
2   private final String challengeId;
3   private final byte[] challengeBytes;
4   private final Instant expiresAt;
5  
6   public WebAuthnChallenge(String challengeId, byte[] challengeBytes, Instant expiresAt) {
7     this.challengeId = challengeId;
8     this.challengeBytes = challengeBytes;
9     this.expiresAt = expiresAt;
10   }
11  
12   public boolean isExpired(Instant now) {
13     return now.isAfter(expiresAt);
14   }
15 }

Python

pythonOne Dark Pro

1 from dataclasses import dataclass
2 from datetime import datetime, timezone
3  
4 @dataclass(frozen=True)
5 class WebAuthnChallenge:
6     challenge_id: str
7     challenge_bytes: bytes
8     expires_at: datetime
9  
10     def is_expired(self, now: datetime) -> bool:
11         return now > self.expires_at.replace(tzinfo=timezone.utc)

TypeScript

typescriptOne Dark Pro

1 export interface WebAuthnChallenge {
2   challengeId: string;
3   challengeBytes: Uint8Array;
4   expiresAt: Date;
5 }
6  
7 export function isExpired(challenge: WebAuthnChallenge, now = new Date()): boolean {
8   return now.getTime() > challenge.expiresAt.getTime();
9 }

Why interviewers care

Passwordless Auth interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for Problem statement: enterprise passwordless identity that proves you understand real outages, not happy-path diagrams.

Key Highlights

•800M accounts
•User → RP
•Replace passwords with WebAuthn passkeys while keeping B2B SSO and regulated recovery paths.

1	public final class WebAuthnChallenge {
2	private final String challengeId;
3	private final byte[] challengeBytes;
4	private final Instant expiresAt;
5
6	public WebAuthnChallenge(String challengeId, byte[] challengeBytes, Instant expiresAt) {
7	this.challengeId = challengeId;
8	this.challengeBytes = challengeBytes;
9	this.expiresAt = expiresAt;
10	}
11
12	public boolean isExpired(Instant now) {
13	return now.isAfter(expiresAt);
14	}
15	}

1	from dataclasses import dataclass
2	from datetime import datetime, timezone
3
4	@dataclass(frozen=True)
5	class WebAuthnChallenge:
6	challenge_id: str
7	challenge_bytes: bytes
8	expires_at: datetime
9
10	def is_expired(self, now: datetime) -> bool:
11	return now > self.expires_at.replace(tzinfo=timezone.utc)

1	export interface WebAuthnChallenge {
2	challengeId: string;
3	challengeBytes: Uint8Array;
4	expiresAt: Date;
5	}
6
7	export function isExpired(challenge: WebAuthnChallenge, now = new Date()): boolean {
8	return now.getTime() > challenge.expiresAt.getTime();
9	}