WebAuthn: Difference between revisions
Caveat the "password replacement" wording |
Rewrite authenticator paragraph in lead section |
||
| Line 45: | Line 45: | ||
It solves many of the issues of traditional [[password]]-based authentication by verifying the user's identity with [[digital signatures]].<ref name="imperialviolet-webauthn">{{cite web |url=https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html |title=A Tour of WebAuthn}}</ref> | It solves many of the issues of traditional [[password]]-based authentication by verifying the user's identity with [[digital signatures]].<ref name="imperialviolet-webauthn">{{cite web |url=https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html |title=A Tour of WebAuthn}}</ref> | ||
WebAuthn is often touted as a complete replacement for passwords, eliminating the need to send passwords over the internet or store them on servers. However, most websites that support WebAuthn still utilize passwords in some way.<ref name="arstechnica-not-usable">{{cite web |last1=Goodin |first1=Dan |title=Passkey technology is elegant, but it’s most definitely not usable security |url=https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/?utm_source=chatgpt.com |publisher=Ars Technica |access-date=3 July 2025}}</ref> | WebAuthn is often touted as a complete replacement for passwords, eliminating the need to send passwords over the internet or store them on servers. However, most websites that support WebAuthn still utilize passwords in some way.<ref name="arstechnica-not-usable">{{cite web |last1=Goodin |first1=Dan |title=Passkey technology is elegant, but it’s most definitely not usable security |url=https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/?utm_source=chatgpt.com |publisher=Ars Technica |access-date=3 July 2025}}</ref> | ||
In order to use WebAuthn, users require a compatible authenticator. The standard does not specify how the [[private key|keys]] required for signing are to be stored, so a variety of authenticator types can be used. The most common authenticator type is a platform authenticator, which is built into the [[operating system]] of the device. Common platform authenticators include [[Android]], [[Apple Keychain]] and [[Windows Hello]]. These make use of hardware security features (such as [[trusted execution environment|TEE]] and [[Trusted Platform Module|TPM]]), and often sync credentials between devices for ease-of-use. Another common authenticator type is a roaming authenticator, where a separate hardware device authenticates the user by connecting over [[USB]], [[Bluetooth Low Energy]], or [[near-field communications]] (NFC). Most [[smartphones]] can be used as roaming authenticators, and dedicated physical [[security token|security keys]] are also used. WebAuthn is effectively backward compatible with FIDO [[Universal 2nd Factor]] (U2F).<ref>{{cite web |title=WebAuthn / CTAP: Modern Authentication |url=https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |publisher=[[World Wide Web Consortium]] |access-date=11 March 2019 |date=10 December 2018}}</ref> | |||
Like legacy U2F, Web Authentication is resilient to verifier impersonation; that is, it is resistant to phishing attacks,<ref>{{cite web |last1=Kan |first1=Michael |title=Google: Phishing Attacks That Can Beat Two-Factor Are on the Rise |url=https://www.pcmag.com/news/367026/google-phishing-attacks-that-can-beat-two-factor-are-on-the |publisher=PC Magazine |access-date=8 March 2019 |date=7 March 2019}}</ref> but unlike U2F, WebAuthn [[Passwordless authentication|does not require]] a traditional password.<ref>{{Cite web |date=2018-04-10 |title=Practical passwordless authentication comes a step closer with WebAuthn |url=https://arstechnica.com/gadgets/2018/04/practical-passwordless-authentication-comes-a-step-closer-with-webauthn/ |access-date=2024-10-16 |website=[[Ars Technica]] |language=en-US}}</ref> Moreover, a roaming hardware authenticator is resistant to malware since the private key material is at no time accessible to software running on the host machine. | Like legacy U2F, Web Authentication is resilient to verifier impersonation; that is, it is resistant to phishing attacks,<ref>{{cite web |last1=Kan |first1=Michael |title=Google: Phishing Attacks That Can Beat Two-Factor Are on the Rise |url=https://www.pcmag.com/news/367026/google-phishing-attacks-that-can-beat-two-factor-are-on-the |publisher=PC Magazine |access-date=8 March 2019 |date=7 March 2019}}</ref> but unlike U2F, WebAuthn [[Passwordless authentication|does not require]] a traditional password.<ref>{{Cite web |date=2018-04-10 |title=Practical passwordless authentication comes a step closer with WebAuthn |url=https://arstechnica.com/gadgets/2018/04/practical-passwordless-authentication-comes-a-step-closer-with-webauthn/ |access-date=2024-10-16 |website=[[Ars Technica]] |language=en-US}}</ref> Moreover, a roaming hardware authenticator is resistant to malware since the private key material is at no time accessible to software running on the host machine. | ||
| Line 98: | Line 97: | ||
For the purposes of illustration, we assume the authenticator is a roaming hardware authenticator (see below for other options). In any case, the authenticator is a multi-factor [[Cryptography|cryptographic]] authenticator that uses [[Cryptography#Public-key cryptography|public-key cryptography]] to sign an authentication assertion targeted at the WebAuthn Relying Party. Assuming the authenticator uses a [[Personal identification number|PIN]] for user verification, the authenticator itself is ''something you have'' while the PIN is ''something you know''. | For the purposes of illustration, we assume the authenticator is a roaming hardware authenticator (see below for other options). In any case, the authenticator is a multi-factor [[Cryptography|cryptographic]] authenticator that uses [[Cryptography#Public-key cryptography|public-key cryptography]] to sign an authentication assertion targeted at the WebAuthn Relying Party. Assuming the authenticator uses a [[Personal identification number|PIN]] for user verification, the authenticator itself is ''something you have'' while the PIN is ''something you know''. | ||
To initiate the WebAuthn authentication flow,<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API |at=Section [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Authentication Authentication] |publisher=[[Mozilla]] |access-date=18 March 2019}}</ref> the WebAuthn Relying Party indicates its intentions to the WebAuthn Client (i.e., the browser) via [[JavaScript]]. The WebAuthn Client communicates with the authenticator using a JavaScript [[API]] implemented in the browser. A roaming authenticator conforms to the FIDO [[Client to Authenticator Protocol]]. | To initiate the WebAuthn authentication flow,<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API |at=Section [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Authentication Authentication] |publisher=[[Mozilla]] |access-date=18 March 2019}}</ref> the WebAuthn Relying Party indicates its intentions to the WebAuthn Client (i.e., the browser) via [[JavaScript]]. The WebAuthn Client communicates with the authenticator using a JavaScript [[API]] implemented in the browser. A roaming authenticator conforms to the FIDO [[Client to Authenticator Protocol]] (CTAP).<ref name="FIDO-CTAP">{{cite web |editor1-last=Brand |editor1-first=Christiaan |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Ehrensvärd |editor3-first=Jakob |editor4-last=Jones |editor4-first=Michael B. |editor5-last=Kumar |editor5-first=Akshay |editor6-last=Lindemann |editor6-first=Rolf |editor7-last=Powers |editor7-first=Adam |editor8-last=Verrept |editor8-first=Johan |title=Client to Authenticator Protocol (CTAP) |url=https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |publisher=FIDO Alliance |access-date=7 March 2019 |date=30 January 2019}}</ref> | ||
WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (e.g., implemented on a smartphone) or a platform authenticator (i.e., an authenticator implemented directly on the WebAuthn Client Device) may be used. Relevant examples of platform authenticators include [[Windows Hello]]<ref>{{cite web |last1=Simons |first1=Alex |title=Secure password-less sign-in for your Microsoft account using a security key or Windows Hello |url=https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/ |publisher=[[Microsoft]] |access-date=6 March 2019 |date=20 November 2018}}</ref> and the [[Android (operating system)|Android operating system]].<ref>{{cite web |title=Android Now FIDO2 Certified, Accelerating Global Migration Beyond Passwords |url=https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |publisher=[[FIDO Alliance]] |access-date=6 March 2019 |location=BARCELONA |date=25 February 2019}}</ref> | WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (e.g., implemented on a smartphone) or a platform authenticator (i.e., an authenticator implemented directly on the WebAuthn Client Device) may be used. Relevant examples of platform authenticators include [[Windows Hello]]<ref>{{cite web |last1=Simons |first1=Alex |title=Secure password-less sign-in for your Microsoft account using a security key or Windows Hello |url=https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/ |publisher=[[Microsoft]] |access-date=6 March 2019 |date=20 November 2018}}</ref> and the [[Android (operating system)|Android operating system]].<ref>{{cite web |title=Android Now FIDO2 Certified, Accelerating Global Migration Beyond Passwords |url=https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |publisher=[[FIDO Alliance]] |access-date=6 March 2019 |location=BARCELONA |date=25 February 2019}}</ref> | ||