WebAuthn: Difference between revisions

Using a username and password has been the standard mechanism for users to prove to a website that they are a specific person.<ref>{{Cite journal |last=Bonneau|first=Joseph|last2=Herley|first2=Cormac|last3=Oorschot|first3=Paul C. van|last4=Stajano|first4=Frank|date=2012|title=The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes|url=https://ieeexplore.ieee.org/document/6234436|journal=2012 IEEE Symposium on Security and Privacy|pages=553–567|doi=10.1109/SP.2012.44}}</ref> However, this methods was known to be flawed. Users often reuse passwords across services,<ref>{{Cite journal |last=Wang|first=Chun|last2=Jan|first2=Steve T.K.|last3=Hu|first3=Hang|last4=Bossart|first4=Douglas|last5=Wang|first5=Gang|date=2018-03-13|title=The Next Domino to Fall: Empirical Analysis of User Passwords across Online Services|url=https://dl.acm.org/doi/10.1145/3176258.3176332|journal=CODASPY '18|language=en|publisher=ACM|pages=196–203|doi=10.1145/3176258.3176332|isbn=978-1-4503-5632-9}}</ref> use weak passwords that can be brute-forced, predicted<ref>{{Cite journal |last=Mazurek|first=Michelle L.|last2=Komanduri|first2=Saranga|last3=Vidas|first3=Timothy|last4=Bauer|first4=Lujo|last5=Christin|first5=Nicolas|last6=Cranor|first6=Lorrie Faith|last7=Kelley|first7=Patrick Gage|last8=Shay|first8=Richard|last9=Ur|first9=Blase|date=2013|title=Measuring password guessability for an entire university|url=http://dl.acm.org/citation.cfm?doid=2508859.2516726|journal=ACM CCS|language=en|publisher=ACM Press|pages=173–186|doi=10.1145/2508859.2516726|isbn=978-1-4503-2477-9}}</ref> or store them in ways that allows for their disclosure (for example writing them down on a piece of paper or a document).<ref>{{Cite conference|publisher=USENIX Association|isbn=978-1-939133-10-6|pages=13–30|last1=Habib|first1=Hana|last2=Naeini|first2=Pardis Emami|last3=Devlin|first3=Summer|last4=Oates|first4=Maggie|last5=Swoopes|first5=Chelse|last6=Bauer|first6=Lujo|last7=Christin|first7=Nicolas|last8=Cranor|first8=Lorrie Faith|title=User behaviors and attitudes under password expiration policies|location=Baltimore, MD|date=2018|conference=Fourteenth Symposium On Usable Privacy and Security (SOUPS 2018)|book-title=}}</ref>

As a result, in 2012, [[Google]] alongside [[Yubico]] started working on a standard called [[Universal 2nd Factor|Universal 2 Factor]] (U2F)<ref>{{Cite web |title=Yubico Company Timeline|url=https://www.yubico.com/why-yubico/yubico-innovation-history/|access-date=2026-06-04|website=Yubico|language=en-US}}</ref> that would allow websites to programatically verify a second-factor about the user by verifying the presence of hardware-based tokens (like [[smart card]]s) on the user. This standard was considered an improvement over existing solutions like time-based [[one-time password]] ([[TOTP - Time-based One-time Password Algorithm|TOTP]]) or SMS-based authentication that still left the user vulnerable to sophisticated [[phishing]] campaigns. The standard was later adopted into a larger industry wide collaboration called the [[FIDO Alliance|FIDO (Fast IDentity Online) Alliance]]. The first draft for this proposed standard was published in 2014.<ref>{{Cite web |date=2014-12-09|title=FIDO Alliance Publishes Final FIDO 1.0 Specifications, First Industry Standards for Universal Strong Authentication|url=https://www.yubico.com/press-releases/fido-alliance-publishes-final-fido-1-0-specifications-first-industry-standards-for-universal-strong-authentication/|access-date=2026-06-04|website=Yubico|language=en-US}}</ref> In 2015, the FIDO Alliance started started developing the [[FIDO2 Project|FIDO 2 Project]], releasing a proposed standard where they sought to improve upon the existing U2F standard by addressing many of its weaknesses.<ref>{{Cite web |date=2015-09-04|title=FIDO Complete Spec 2015-09-04|url=https://fidoalliance.org/specs/fido-v2.0-ps-20150904/FIDO-COMPLETE-v2.0-ps-20150904.pdf|access-date=5 June 2026|website=Fido Alliance}}</ref> For example, the U2F standard still required to use of passwords alongside a second factor which still left websites vulnerable to password leaks and other similar attacks that were common against passwords.<ref name=":0">{{Cite journal |last=Ghorbani Lyastani|first=Sanam|last2=Schilling|first2=Michael|last3=Neumayr|first3=Michaela|last4=Backes|first4=Michael|last5=Bugiel|first5=Sven|date=May 2020|title=Is FIDO2 the Kingslayer of User Authentication? A Comparative Usability Study of FIDO2 Passwordless Authentication|url=https://ieeexplore.ieee.org/document/9152694/|journal=2020 IEEE S&P|publisher=IEEE|pages=268–285|doi=10.1109/SP40000.2020.00047|isbn=978-1-7281-3497-0}}</ref> Additionally, the U2F specification only verified the second factor device and did not perform any user authentication.<ref name=":0" /> This meant that if the second factor device had been stolen or lost anyone with access to the U2F device would be able to bypass the second factor of authentication for accounts linked to the device.<ref name=":0" />

''Passkey'' is the [[de facto]] [[Technical language|non-technical]] term for a saved sign-in credential, a piece of [[cryptographic]] information that is capable of being used to authenticate a user using the WebAuthn standard.<ref name="docsrs-webauthnrs2">{{cite web |last1=Brown|first1=William|title=webauthn-rs docs|url=https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey|website=Docs.rs|publisher=Kanidm Identity Management Project|access-date=3 July 2025|date=April 2024|archive-url=https://web.archive.org/web/20250612151121/https://docs.rs/webauthn-rs/latest/webauthn_rs/#what-is-a-passkey|archive-date=12 June 2025}}</ref><ref name="imperialviolet-webauthn2">{{cite web |last=Langley|first=Adam|date=2024-12-23|title=A Tour of WebAuthn|url=https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html|access-date=2025-08-13|website=Imperial Violet}}</ref> Most user interfaces that support using WebAuthn refer to it as supporting ''passkeys''.<ref name="arstechnica-not-usable2">{{cite web |last1=Goodin|first1=Dan|title=Passkey technology is elegant, but it’s most definitely not usable security|url=https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/|publisher=Ars Technica|access-date=3 July 2025|archive-date=3 July 2025|archive-url=https://web.archive.org/web/20250703130434/https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/|url-status=live}}</ref>