Project Update
TLDR: This project needs a new maintainer.
A Brief Personal History
Since I released this package almost three years ago, I have enjoyed the process of learning about Passkeys and creating tools that could be used in my favorite web framework. When I started seriously pursuing a career in software development, web security was surfacing in headlines with increasing frequency. The Snowden leaks, stolen government laptops with personally identifiable information, unprotected data repositories, the pace of credential thefts - all these stories made the prospect of this career even more intimidating than it already was.
So, security has always been front of mind for me. When employers, clients, and users use the applications we create, we have a responsibility to protect their data with all of the tools at hand. We also have a responsibility to push for and adopt better tools. This is why WebauthnComponents was created. The first W3 spec for the WebAuthn spec dates back to 2019 with iterations continuing in the years since.
What makes Passkeys interesting is that it’s a rare security mechanism that is actually user-friendly. Multifactor authentication via SMS, Email, OTP codes were vulnerable to interception, and hardware devices would likely never get mass adoption. By integrating devices, operating systems, and cloud accounts Passkeys made a specialist-oriented technology much more palatable for people who may never need to understand the implementation details.
Passkeys Take Flight
This project started as an experiment to see if I could understand the WebAuthn API and add support for Phoenix LiveView applications. Did I mention it’s my favorite framework?
Over the summer of 2022, I spent most of my spare time learning the API and writing code that would eventually be released at ElixirConf the same year. This was the first time I had deeply read a W3 spec after needing more information than MDN docs provided.
There were several skills I picked up in the course of building WebauthnComponents:
- Digesting W3 specs
- Building Mermaid sequence graphs
- Creating stateful LiveComponents
- Marshaling data between clients, components, LiveViews, contexts, and the database
- Releasing a package
- Supporting the community
The Cost of Coasting
To varying degrees, I feel confident in those skills. The conversations in this thread and the contributions in the repo are good indicators that this was time well spent.
However, that last skill, supporting the community, is where I have the least confidence now. The list of issues and PRs may be relatively short, but the amount time they require is not. At least, it is not an amount of time I have now. There are a few reasons I have less time to carry this project forward, but the one I’ll share here is that I started a new role in April which is both thrilling and consuming as an engineer. I hope to share more in the future, but for now I can say I have less mental and temporal bandwidth than I did in the past.
As a result, issues and pull requests have languished in the repo this year. The fact that they exist is a reward in itself. They mean that you and others like you have taken time to use the package, report problems, investigate the code, and share contributions.
One cost is that I am further from the initial problem than I was three years ago. Passkeys will continue to roll out to more and more services, and the world will benefit. However, I am no longer in an environment where Passkeys are a useful component. This means I spend very little time with the technology other than as an end user. That makes maintaining the package more difficult than I expected.
What’s Next
All of this is to say I am looking for a new maintainer or group of maintainers to adopt WebauthnComponents. I have put this off for a bit because it is important to get it right. Although it may not have the broad impact of the XZ debacle, a bad actor could still do significant damage by compromising a package responsible for creating web credentials.
Instead of hunting for a new maintainer, I decided to post here. The community can play an important role in vetting and encouraging whoever takes up ownership of this project.
The Plan
My expectations for this process are:
| Duration |
Task |
| TBD |
Nominations |
| TBD |
Decision |
| 1-3 months |
Onboarding & collaboration |
| 1 month |
Handoff |
Nominations
Feel free to discuss this project with the people you know in DMs, at conferences (ahem ElixirConf), and in this thread. Keep in mind this is a place for encouragement.
Onboarding & Collaboration
I will coordinate with the new maintainer(s) via direct communication asynchronously and through scheduled calls as needed. If you become a maintainer of WebauthnComponents, I will do everything I can to set you up for success. Rest assured this project has not required a tremendous amount of time since its initial release. That may change as it becomes more widely used.
The length of this phase depends largely on schedules, which can be complicated to align during holiday season.
Handoff
During this phase, I will step back from contributions. We will determine in more detail what level of involvement to expect, and I will be available for reviews and discussions.
Gratitude
Thank you to everyone who has spent time with WebauthnComponents. I hope to see this work carried forward and improved in ways I couldn’t even imagine. Here’s to the future!
Relevant Links
On my side, I’ll continue to maintain Wax (which is more or less finished), desperately waiting for someone to review all of it 
as written in the 
