WebAuthn: Difference between revisions
No edit summary |
Adding information about #WebAuthn Hybrid Transport #VulcanSphere |
||
| Line 46: | Line 46: | ||
Although WebAuthn is often touted as a complete replacement for passwords, most websites that implement it continue to use passwords in some capacity.<ref name="arstechnica-not-usable">{{cite web |last1=Goodin |first1=Dan |title=Passkey technology is elegant, but it’s most definitely not usable security |url=https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ |publisher=Ars Technica |access-date=3 July 2025 |archive-date=3 July 2025 |archive-url=https://web.archive.org/web/20250703130434/https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ |url-status=live }}</ref> | Although WebAuthn is often touted as a complete replacement for passwords, most websites that implement it continue to use passwords in some capacity.<ref name="arstechnica-not-usable">{{cite web |last1=Goodin |first1=Dan |title=Passkey technology is elegant, but it’s most definitely not usable security |url=https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ |publisher=Ars Technica |access-date=3 July 2025 |archive-date=3 July 2025 |archive-url=https://web.archive.org/web/20250703130434/https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ |url-status=live }}</ref> | ||
To use WebAuthn, users require a compatible authenticator. The standard does not specify how to store the [[private key|keys]] required for signing, so a variety of authenticator types can be used. The most common authenticator type is a platform authenticator, which is built into the [[operating system]] of the device. Common platform authenticators include [[Android (operating system)|Android]], [[Apple Keychain]] and [[Windows Hello]]. These make use of hardware security features (such as [[trusted execution environment|TEE]] and [[Trusted Platform Module|TPM]]), and often sync credentials between devices for ease-of-use. Another common authenticator type is a roaming authenticator, where a separate hardware device authenticates the user by connecting over [[USB]], [[Bluetooth Low Energy]], or [[near-field communications]] (NFC). Most [[smartphones]] can be used as roaming authenticators, and dedicated physical [[security token|security keys]] are also used. WebAuthn is effectively backward compatible with FIDO [[Universal 2nd Factor]] (U2F) as they both use the [[CTAP]] protocol.<ref>{{cite web |title=WebAuthn / CTAP: Modern Authentication |url=https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |publisher=[[World Wide Web Consortium]] |access-date=11 March 2019 |date=10 December 2018 |archive-date=4 December 2020 |archive-url=https://web.archive.org/web/20201204162731/https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |url-status=live }}</ref> [[Password manager|Password managers]] can also be used as authenticator, often with cloud sync.<ref>{{Cite web |date=2023-06-01 |title=Will Passkeys Kill Password Managers? |url=https://www.corbado.com/blog/passkeys-vs-password-managers |access-date=2025-09-18 |website=Corbado |language=en}}</ref> | To use WebAuthn, users require a compatible authenticator. The standard does not specify how to store the [[private key|keys]] required for signing, so a variety of authenticator types can be used. The most common authenticator type is a platform authenticator, which is built into the [[operating system]] of the device. Common platform authenticators include [[Android (operating system)|Android]], [[Apple Keychain]] and [[Windows Hello]]. These make use of hardware security features (such as [[trusted execution environment|TEE]] and [[Trusted Platform Module|TPM]]), and often sync credentials between devices for ease-of-use. Another common authenticator type is a roaming authenticator, where a separate hardware device authenticates the user by connecting over [[USB]], [[Bluetooth Low Energy]], or [[near-field communications]] (NFC). Most [[smartphones]] can be used as roaming authenticators, and dedicated physical [[security token|security keys]] are also used. WebAuthn is effectively backward compatible with FIDO [[Universal 2nd Factor]] (U2F) as they both use the [[CTAP]] protocol.<ref>{{cite web |title=WebAuthn / CTAP: Modern Authentication |url=https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |publisher=[[World Wide Web Consortium]] |access-date=11 March 2019 |date=10 December 2018 |archive-date=4 December 2020 |archive-url=https://web.archive.org/web/20201204162731/https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |url-status=live }}</ref> [[Password manager|Password managers]] can also be used as authenticator, often with cloud sync.<ref>{{Cite web |date=2023-06-01 |title=Will Passkeys Kill Password Managers? |url=https://www.corbado.com/blog/passkeys-vs-password-managers |access-date=2025-09-18 |website=Corbado |language=en}}</ref> Where credentials sync is not viable or possible, WebAuthn Hybrid Transport can be used to access credentials stored on another authenticator such as smartphones.<ref name="Corbado-HybridTransport">{{Cite news |date=2023-11-08 |title=WebAuthn Passkey QR Codes & Bluetooth: Hybrid Transport |url=https://www.corbado.com/blog/webauthn-passkey-qr-code |access-date=2025-09-18 |work=Corbado |language=en}}</ref> | ||
Like legacy U2F, WebAuthn is resistant to [[phishing|phishing attacks]]<ref>{{cite web |last1=Kan |first1=Michael |title=Google: Phishing Attacks That Can Beat Two-Factor Are on the Rise |url=https://www.pcmag.com/news/367026/google-phishing-attacks-that-can-beat-two-factor-are-on-the |publisher=PC Magazine |access-date=8 March 2019 |date=7 March 2019 |archive-date=8 March 2019 |archive-url=https://web.archive.org/web/20190308035745/https://www.pcmag.com/news/367026/google-phishing-attacks-that-can-beat-two-factor-are-on-the |url-status=live }}</ref> as the authenticator only offers credentials that were registered on the [[same-origin policy|same website]]. However, unlike U2F, WebAuthn can be implemented in a [[passwordless authentication|passwordless]] manner.<ref>{{Cite web |date=2018-04-10 |title=Practical passwordless authentication comes a step closer with WebAuthn |url=https://arstechnica.com/gadgets/2018/04/practical-passwordless-authentication-comes-a-step-closer-with-webauthn/ |access-date=2024-10-16 |website=[[Ars Technica]] |language=en-US |archive-date=1 January 2025 |archive-url=https://web.archive.org/web/20250101102456/https://arstechnica.com/gadgets/2018/04/practical-passwordless-authentication-comes-a-step-closer-with-webauthn/ |url-status=live }}</ref> Moreover, a roaming hardware authenticator resists malware, since the keys are stored on a separate device, which prevents the malware from accessing them directly. | Like legacy U2F, WebAuthn is resistant to [[phishing|phishing attacks]]<ref>{{cite web |last1=Kan |first1=Michael |title=Google: Phishing Attacks That Can Beat Two-Factor Are on the Rise |url=https://www.pcmag.com/news/367026/google-phishing-attacks-that-can-beat-two-factor-are-on-the |publisher=PC Magazine |access-date=8 March 2019 |date=7 March 2019 |archive-date=8 March 2019 |archive-url=https://web.archive.org/web/20190308035745/https://www.pcmag.com/news/367026/google-phishing-attacks-that-can-beat-two-factor-are-on-the |url-status=live }}</ref> as the authenticator only offers credentials that were registered on the [[same-origin policy|same website]]. However, unlike U2F, WebAuthn can be implemented in a [[passwordless authentication|passwordless]] manner.<ref>{{Cite web |date=2018-04-10 |title=Practical passwordless authentication comes a step closer with WebAuthn |url=https://arstechnica.com/gadgets/2018/04/practical-passwordless-authentication-comes-a-step-closer-with-webauthn/ |access-date=2024-10-16 |website=[[Ars Technica]] |language=en-US |archive-date=1 January 2025 |archive-url=https://web.archive.org/web/20250101102456/https://arstechnica.com/gadgets/2018/04/practical-passwordless-authentication-comes-a-step-closer-with-webauthn/ |url-status=live }}</ref> Moreover, a roaming hardware authenticator resists malware, since the keys are stored on a separate device, which prevents the malware from accessing them directly. | ||
| Line 109: | Line 109: | ||
Authenticator is a multi-factor [[Cryptography|cryptographic]] authenticator that uses [[Cryptography#Public-key cryptography|public-key cryptography]] to sign an authentication assertion targeted at the WebAuthn Relying Party. Assuming the authenticator uses either a [[Facial recognition system|facial recognition]], fingerprint or PIN for user verification, the authenticator itself is ''something you have'' while the facial recognition and fingerprint (biometric) are ''something you are'' and the PIN is ''something you know''. | Authenticator is a multi-factor [[Cryptography|cryptographic]] authenticator that uses [[Cryptography#Public-key cryptography|public-key cryptography]] to sign an authentication assertion targeted at the WebAuthn Relying Party. Assuming the authenticator uses either a [[Facial recognition system|facial recognition]], fingerprint or PIN for user verification, the authenticator itself is ''something you have'' while the facial recognition and fingerprint (biometric) are ''something you are'' and the PIN is ''something you know''. | ||
To initiate the WebAuthn authentication flow,<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API |at=Section [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Authentication Authentication] |publisher=[[Mozilla]] |access-date=18 March 2019 |archive-date=28 November 2020 |archive-url=https://web.archive.org/web/20201128172824/https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |url-status=live }}</ref> the WebAuthn Relying Party indicates its intentions to the WebAuthn Client (i.e., the browser) via [[JavaScript]]. The WebAuthn Client communicates with the authenticator using a JavaScript [[API]] implemented in the browser. A roaming authenticator conforms to the FIDO [[Client to Authenticator Protocol]] (CTAP) | To initiate the WebAuthn authentication flow,<ref>{{cite web |url=https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |title=Web Authentication API |at=Section [https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API#Authentication Authentication] |publisher=[[Mozilla]] |access-date=18 March 2019 |archive-date=28 November 2020 |archive-url=https://web.archive.org/web/20201128172824/https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API |url-status=live }}</ref> the WebAuthn Relying Party indicates its intentions to the WebAuthn Client (i.e., the browser) via [[JavaScript]]. The WebAuthn Client communicates with the authenticator using a JavaScript [[API]] implemented in the browser. A roaming authenticator conforms to the FIDO [[Client to Authenticator Protocol]] (CTAP),<ref name="FIDO-CTAP">{{cite web |editor1-last=Brand |editor1-first=Christiaan |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Ehrensvärd |editor3-first=Jakob |editor4-last=Jones |editor4-first=Michael B. |editor5-last=Kumar |editor5-first=Akshay |editor6-last=Lindemann |editor6-first=Rolf |editor7-last=Powers |editor7-first=Adam |editor8-last=Verrept |editor8-first=Johan |title=Client to Authenticator Protocol (CTAP) |url=https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |publisher=FIDO Alliance |access-date=7 March 2019 |date=30 January 2019 |archive-date=8 March 2019 |archive-url=https://web.archive.org/web/20190308081859/https://fidoalliance.org/specs/fido-v2.0-ps-20190130-pub/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html |url-status=dead }}</ref> and connected over [[USB]], [[Bluetooth Low Energy]], or [[near-field communications]] (NFC). | ||
WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (e.g., implemented on a smartphone) or a platform authenticator (i.e., an authenticator implemented directly on the WebAuthn Client Device) may be used. Relevant examples of platform authenticators include [[Windows Hello]]<ref>{{cite web |last1=Simons |first1=Alex |title=Secure password-less sign-in for your Microsoft account using a security key or Windows Hello |url=https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/ |publisher=[[Microsoft]] |access-date=6 March 2019 |date=20 November 2018}}</ref> and the [[Android (operating system)|Android operating system]].<ref>{{cite web |title=Android Now FIDO2 Certified, Accelerating Global Migration Beyond Passwords |url=https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |publisher=[[FIDO Alliance]] |access-date=6 March 2019 |location=BARCELONA |date=25 February 2019 |archive-date=7 March 2019 |archive-url=https://web.archive.org/web/20190307054402/https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |url-status=live }}</ref> | WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (e.g., implemented on a smartphone) or a platform authenticator (i.e., an authenticator implemented directly on the WebAuthn Client Device) may be used. Relevant examples of platform authenticators include [[Windows Hello]]<ref>{{cite web |last1=Simons |first1=Alex |title=Secure password-less sign-in for your Microsoft account using a security key or Windows Hello |url=https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/ |publisher=[[Microsoft]] |access-date=6 March 2019 |date=20 November 2018}}</ref> and the [[Android (operating system)|Android operating system]].<ref>{{cite web |title=Android Now FIDO2 Certified, Accelerating Global Migration Beyond Passwords |url=https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |publisher=[[FIDO Alliance]] |access-date=6 March 2019 |location=BARCELONA |date=25 February 2019 |archive-date=7 March 2019 |archive-url=https://web.archive.org/web/20190307054402/https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |url-status=live }}</ref> | ||
WebAuthn Hybrid Transport allows WebAuthn Client to access credential stored on another authenticator such as a smartphone, useful in certain situations where credential sync is not viable.<ref name="Corbado-HybridTransport" /> | |||
There is a lingering misunderstanding among users that biometric data is transmitted over the network in the same manner as passwords, which is not the case.<ref>{{cite web |title=Touch ID and Beyond: Duo's Plans for WebAuthn |url=https://duo.com/blog/touchid-webauthn |publisher=Duo Security |access-date=8 March 2019 |date=5 March 2019 |archive-date=21 March 2020 |archive-url=https://web.archive.org/web/20200321174132/https://duo.com/blog/touchid-webauthn |url-status=live }}</ref><ref>{{cite web |last1=Steele |first1=Nick |title=How WebAuthn aims to solve the password problem |url=https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |publisher=Help Net Security |access-date=8 March 2019 |date=27 February 2019 |archive-date=28 September 2020 |archive-url=https://web.archive.org/web/20200928210027/https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |url-status=live }}</ref> | There is a lingering misunderstanding among users that biometric data is transmitted over the network in the same manner as passwords, which is not the case.<ref>{{cite web |title=Touch ID and Beyond: Duo's Plans for WebAuthn |url=https://duo.com/blog/touchid-webauthn |publisher=Duo Security |access-date=8 March 2019 |date=5 March 2019 |archive-date=21 March 2020 |archive-url=https://web.archive.org/web/20200321174132/https://duo.com/blog/touchid-webauthn |url-status=live }}</ref><ref>{{cite web |last1=Steele |first1=Nick |title=How WebAuthn aims to solve the password problem |url=https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |publisher=Help Net Security |access-date=8 March 2019 |date=27 February 2019 |archive-date=28 September 2020 |archive-url=https://web.archive.org/web/20200928210027/https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |url-status=live }}</ref> | ||