WebAuthn: Difference between revisions

Line 45:

Although WebAuthn is often touted as a complete replacement for passwords, most websites that implement it continue to use passwords in some capacity.<ref name="arstechnica-not-usable">{{cite web |last1=Goodin |first1=Dan |title=Passkey technology is elegant, but it’s most definitely not usable security |url=https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ |publisher=Ars Technica |access-date=3 July 2025 |archive-date=3 July 2025 |archive-url=https://web.archive.org/web/20250703130434/https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ |url-status=live }}</ref>

To use WebAuthn, users require a compatible authenticator. The standard does not specify how to store the [[private key|keys]] required for signing, so a variety of authenticator types can be used. The most common authenticator type is a platform authenticator, which is built into the [[operating system]] of the device. Common platform authenticators include [[Android (operating system)|Android]], [[Apple Keychain]] and [[Windows Hello]]. These make use of hardware security features (such as [[trusted execution environment|TEE]] and [[Trusted Platform Module|TPM]]), and often sync credentials between devices for ease-of-use. Another common authenticator type is a roaming authenticator, where a separate hardware device authenticates the user by connecting over [[USB]], [[Bluetooth Low Energy]], or [[near-field communications]] (NFC). Most [[smartphones]] can be used as roaming authenticators, and dedicated physical [[security token|security keys]] are also used. WebAuthn is effectively backward compatible with FIDO [[Universal 2nd Factor]] (U2F) as they both use the [[CTAP]] protocol.<ref>{{cite web |title=WebAuthn / CTAP: Modern Authentication |url=https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |publisher=[[World Wide Web Consortium]] |access-date=11 March 2019 |date=10 December 2018 |archive-date=4 December 2020 |archive-url=https://web.archive.org/web/20201204162731/https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |url-status=live }}</ref> [[Password manager|Password managers]] can also be used as an authenticator, often with cloud sync.<ref>{{Cite web |date=2023-06-01 |title=Will Passkeys Kill Password Managers? |url=https://www.corbado.com/blog/passkeys-vs-password-managers |access-date=2025-09-18 |website=Corbado |language=en}}</ref> Where credentials sync is not viable or possible, WebAuthn Hybrid Transport can be used to access credentials stored on another authenticator such as a smartphone.<ref name="Corbado-HybridTransport">{{Cite news |date=2023-11-08 |title=WebAuthn Passkey QR Codes & Bluetooth: Hybrid Transport |url=https://www.corbado.com/blog/webauthn-passkey-qr-code |access-date=2025-09-18 |work=Corbado |language=en}}</ref>

To use WebAuthn, users require a compatible authenticator. The standard does not specify how to store the [[private key|keys]] required for signing, so a variety of authenticator types can be used. The most common authenticator type is a platform authenticator, which is built into the [[operating system]] of the device. Common platform authenticators include [[Android (operating system)|Android]], [[Apple Keychain]] and [[Windows Hello]]. These make use of hardware security features (such as [[trusted execution environment|TEE]] and [[Trusted Platform Module|TPM]]), and often sync credentials between devices for ease-of-use. Another common authenticator type is a roaming authenticator, where a separate hardware device authenticates the user by connecting over [[USB]], [[Bluetooth Low Energy]], or [[near-field communications]] (NFC). Most [[smartphones]] can be used as roaming authenticators, and dedicated physical [[security token|security keys]] are also used. WebAuthn is effectively backward compatible with [[FIDO Alliance|FIDO]] [[Universal 2nd Factor]] (U2F) as they both use the [[CTAP]] protocol.<ref>{{cite web |title=WebAuthn / CTAP: Modern Authentication |url=https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |publisher=[[World Wide Web Consortium]] |access-date=11 March 2019 |date=10 December 2018 |archive-date=4 December 2020 |archive-url=https://web.archive.org/web/20201204162731/https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |url-status=live }}</ref> [[Password manager|Password managers]] can also be used as an authenticator, often with cloud sync.<ref>{{Cite web |date=2023-06-01 |title=Will Passkeys Kill Password Managers? |url=https://www.corbado.com/blog/passkeys-vs-password-managers |access-date=2025-09-18 |website=Corbado |language=en}}</ref> Where credentials sync is not viable or possible, WebAuthn Hybrid Transport can be used to access credentials stored on another authenticator such as a smartphone.<ref name="Corbado-HybridTransport">{{Cite news |date=2023-11-08 |title=WebAuthn Passkey QR Codes & Bluetooth: Hybrid Transport |url=https://www.corbado.com/blog/webauthn-passkey-qr-code |access-date=2025-09-18 |work=Corbado |language=en}}</ref>

Like legacy U2F, WebAuthn is resistant to [[phishing|phishing attacks]]<ref>{{cite web |last1=Kan |first1=Michael |title=Google: Phishing Attacks That Can Beat Two-Factor Are on the Rise |url=https://www.pcmag.com/news/367026/google-phishing-attacks-that-can-beat-two-factor-are-on-the |publisher=PC Magazine |access-date=8 March 2019 |date=7 March 2019 |archive-date=8 March 2019 |archive-url=https://web.archive.org/web/20190308035745/https://www.pcmag.com/news/367026/google-phishing-attacks-that-can-beat-two-factor-are-on-the |url-status=live }}</ref> as the authenticator only offers credentials that were registered on the [[same-origin policy|same website]]. However, unlike U2F, WebAuthn can be implemented in a [[passwordless authentication|passwordless]] manner.<ref>{{Cite web |date=2018-04-10 |title=Practical passwordless authentication comes a step closer with WebAuthn |url=https://arstechnica.com/gadgets/2018/04/practical-passwordless-authentication-comes-a-step-closer-with-webauthn/ |access-date=2024-10-16 |website=[[Ars Technica]] |language=en-US |archive-date=1 January 2025 |archive-url=https://web.archive.org/web/20250101102456/https://arstechnica.com/gadgets/2018/04/practical-passwordless-authentication-comes-a-step-closer-with-webauthn/ |url-status=live }}</ref> Moreover, a roaming hardware authenticator resists malware, since the keys are stored on a separate device, which prevents the malware from accessing them directly.

@@ Line 45: / Line 45: @@
 Although WebAuthn is often touted as a complete replacement for passwords, most websites that implement it continue to use passwords in some capacity.<ref name="arstechnica-not-usable">{{cite web |last1=Goodin |first1=Dan |title=Passkey technology is elegant, but it’s most definitely not usable security |url=https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ |publisher=Ars Technica |access-date=3 July 2025 |archive-date=3 July 2025 |archive-url=https://web.archive.org/web/20250703130434/https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ |url-status=live }}</ref>
-To use WebAuthn, users require a compatible authenticator. The standard does not specify how to store the [[private key|keys]] required for signing, so a variety of authenticator types can be used. The most common authenticator type is a platform authenticator, which is built into the [[operating system]] of the device. Common platform authenticators include [[Android (operating system)|Android]], [[Apple Keychain]] and [[Windows Hello]]. These make use of hardware security features (such as [[trusted execution environment|TEE]] and [[Trusted Platform Module|TPM]]), and often sync credentials between devices for ease-of-use. Another common authenticator type is a roaming authenticator, where a separate hardware device authenticates the user by connecting over [[USB]], [[Bluetooth Low Energy]], or [[near-field communications]] (NFC). Most [[smartphones]] can be used as roaming authenticators, and dedicated physical [[security token|security keys]] are also used. WebAuthn is effectively backward compatible with FIDO [[Universal 2nd Factor]] (U2F) as they both use the [[CTAP]] protocol.<ref>{{cite web |title=WebAuthn / CTAP: Modern Authentication |url=https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |publisher=[[World Wide Web Consortium]] |access-date=11 March 2019 |date=10 December 2018 |archive-date=4 December 2020 |archive-url=https://web.archive.org/web/20201204162731/https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |url-status=live }}</ref> [[Password manager|Password managers]] can also be used as an authenticator, often with cloud sync.<ref>{{Cite web |date=2023-06-01 |title=Will Passkeys Kill Password Managers? |url=https://www.corbado.com/blog/passkeys-vs-password-managers |access-date=2025-09-18 |website=Corbado |language=en}}</ref> Where credentials sync is not viable or possible, WebAuthn Hybrid Transport can be used to access credentials stored on another authenticator such as a smartphone.<ref name="Corbado-HybridTransport">{{Cite news |date=2023-11-08 |title=WebAuthn Passkey QR Codes & Bluetooth: Hybrid Transport |url=https://www.corbado.com/blog/webauthn-passkey-qr-code |access-date=2025-09-18 |work=Corbado |language=en}}</ref>
+To use WebAuthn, users require a compatible authenticator. The standard does not specify how to store the [[private key|keys]] required for signing, so a variety of authenticator types can be used. The most common authenticator type is a platform authenticator, which is built into the [[operating system]] of the device. Common platform authenticators include [[Android (operating system)|Android]], [[Apple Keychain]] and [[Windows Hello]]. These make use of hardware security features (such as [[trusted execution environment|TEE]] and [[Trusted Platform Module|TPM]]), and often sync credentials between devices for ease-of-use. Another common authenticator type is a roaming authenticator, where a separate hardware device authenticates the user by connecting over [[USB]], [[Bluetooth Low Energy]], or [[near-field communications]] (NFC). Most [[smartphones]] can be used as roaming authenticators, and dedicated physical [[security token|security keys]] are also used. WebAuthn is effectively backward compatible with [[FIDO Alliance|FIDO]] [[Universal 2nd Factor]] (U2F) as they both use the [[CTAP]] protocol.<ref>{{cite web |title=WebAuthn / CTAP: Modern Authentication |url=https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |publisher=[[World Wide Web Consortium]] |access-date=11 March 2019 |date=10 December 2018 |archive-date=4 December 2020 |archive-url=https://web.archive.org/web/20201204162731/https://www.w3.org/Security/201812-Auth-ID/05_-_Day_1_-_Understanding_WebAuthn,_CTAP,_EAT,_FIDO_and_Authenticators.pdf |url-status=live }}</ref> [[Password manager|Password managers]] can also be used as an authenticator, often with cloud sync.<ref>{{Cite web |date=2023-06-01 |title=Will Passkeys Kill Password Managers? |url=https://www.corbado.com/blog/passkeys-vs-password-managers |access-date=2025-09-18 |website=Corbado |language=en}}</ref> Where credentials sync is not viable or possible, WebAuthn Hybrid Transport can be used to access credentials stored on another authenticator such as a smartphone.<ref name="Corbado-HybridTransport">{{Cite news |date=2023-11-08 |title=WebAuthn Passkey QR Codes & Bluetooth: Hybrid Transport |url=https://www.corbado.com/blog/webauthn-passkey-qr-code |access-date=2025-09-18 |work=Corbado |language=en}}</ref>
 Like legacy U2F, WebAuthn is resistant to [[phishing|phishing attacks]]<ref>{{cite web |last1=Kan |first1=Michael |title=Google: Phishing Attacks That Can Beat Two-Factor Are on the Rise |url=https://www.pcmag.com/news/367026/google-phishing-attacks-that-can-beat-two-factor-are-on-the |publisher=PC Magazine |access-date=8 March 2019 |date=7 March 2019 |archive-date=8 March 2019 |archive-url=https://web.archive.org/web/20190308035745/https://www.pcmag.com/news/367026/google-phishing-attacks-that-can-beat-two-factor-are-on-the |url-status=live }}</ref> as the authenticator only offers credentials that were registered on the [[same-origin policy|same website]]. However, unlike U2F, WebAuthn can be implemented in a [[passwordless authentication|passwordless]] manner.<ref>{{Cite web |date=2018-04-10 |title=Practical passwordless authentication comes a step closer with WebAuthn |url=https://arstechnica.com/gadgets/2018/04/practical-passwordless-authentication-comes-a-step-closer-with-webauthn/ |access-date=2024-10-16 |website=[[Ars Technica]] |language=en-US |archive-date=1 January 2025 |archive-url=https://web.archive.org/web/20250101102456/https://arstechnica.com/gadgets/2018/04/practical-passwordless-authentication-comes-a-step-closer-with-webauthn/ |url-status=live }}</ref> Moreover, a roaming hardware authenticator resists malware, since the keys are stored on a separate device, which prevents the malware from accessing them directly.

WebAuthn: Difference between revisions

~2026-13788-02 (talk)