WebAuthn: Difference between revisions
Merging references with RefMan |
No edit summary |
||
| Line 70: | Line 70: | ||
''Passkey'' is the [[de facto]] [[Technical language|non-technical]] term for a saved sign-in credential, a piece of [[cryptographic]] information that is capable of being used to authenticate a user using the WebAuthn standard.<ref name="docsrs-webauthnrs"/><ref name="imperialviolet-webauthn"/> Most user interfaces that support using WebAuthn refer to it as supporting ''passkeys''.<ref name="arstechnica-not-usable"/> | ''Passkey'' is the [[de facto]] [[Technical language|non-technical]] term for a saved sign-in credential, a piece of [[cryptographic]] information that is capable of being used to authenticate a user using the WebAuthn standard.<ref name="docsrs-webauthnrs"/><ref name="imperialviolet-webauthn"/> Most user interfaces that support using WebAuthn refer to it as supporting ''passkeys''.<ref name="arstechnica-not-usable"/> | ||
Due to the open-ended nature of the WebAuthn specification, a passkey can be stored on software or hardware that is capable of authenticating a user. This includes technology like [[Windows Hello]] which works by using facial recognition to authenticate users,<ref>{{Cite web |last=|title=Support for Passkeys in Windows|url=https://learn.microsoft.com/en-us/windows/security/identity-protection/passkeys/|access-date=2026-06-06|website=learn.microsoft.com|language=en-us}}</ref><ref>{{Cite web |title=Configure Windows Hello - Microsoft Support|url=https://support.microsoft.com/en-us/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0|access-date=2026-06-06|website=support.microsoft.com}}</ref> [[Bitwarden]] which authenticates users through a [[browser extension]]<ref>{{Cite web |title=Log In With Passkeys|url=https://bitwarden.com/help/login-with-passkeys/|access-date=2026-06-06|website=Bitwarden|language=en}}</ref> or [[YubiKey]]s that allow a user to authenticate using a physical hardware token.<ref>{{Cite web |last=|first=|last2=|title=Stop changing weak passwords. Start replacing them with passkeys|url=https://www.pcworld.com/article/2591499/stop-changing-weak-passwords-start-replacing-them-with-passkeys.html|access-date=2026-06-06|website=PCWorld|language=en}}</ref> The cryptographic keys stored by the software are only available to use for the browser once the software or hardware | Due to the open-ended nature of the WebAuthn specification, a passkey can be stored on software or hardware that is capable of authenticating a user. This includes technology like [[Windows Hello]] which works by using facial recognition to authenticate users,<ref>{{Cite web |last=|title=Support for Passkeys in Windows|url=https://learn.microsoft.com/en-us/windows/security/identity-protection/passkeys/|access-date=2026-06-06|website=learn.microsoft.com|language=en-us}}</ref><ref>{{Cite web |title=Configure Windows Hello - Microsoft Support|url=https://support.microsoft.com/en-us/windows/configure-windows-hello-dae28983-8242-bb2a-d3d1-87c9d265a5f0|access-date=2026-06-06|website=support.microsoft.com}}</ref> [[Bitwarden]] which authenticates users through a [[browser extension]]<ref>{{Cite web |title=Log In With Passkeys|url=https://bitwarden.com/help/login-with-passkeys/|access-date=2026-06-06|website=Bitwarden|language=en}}</ref> or [[YubiKey]]s that allow a user to authenticate using a physical hardware token.<ref>{{Cite web |last=|first=|last2=|title=Stop changing weak passwords. Start replacing them with passkeys|url=https://www.pcworld.com/article/2591499/stop-changing-weak-passwords-start-replacing-them-with-passkeys.html|access-date=2026-06-06|website=PCWorld|language=en}}</ref> The cryptographic keys stored by the software are only available to use for the browser once the software or hardware has authenticated the user.<ref name="arstechnica-not-usable"/> | ||
When Apple first prominently introduced passkeys to the public in 2022,<ref>{{cite news |last1=Clemons|first1=Taylor|title=WWDC 2022: Apple announces Passkey feature to eliminate passwords across platforms|url=https://www.zdnet.com/article/wwdc-2022-apple-announces-passkey-feature/|access-date=4 July 2025|publisher=ZD Net|date=6 June 2022|archive-date=6 June 2023|archive-url=https://web.archive.org/web/20230606212207/https://www.zdnet.com/article/wwdc-2022-apple-announces-passkey-feature/|url-status=live}}</ref> they emphasized integrations with their own products. This, combined with the lack of clear communication from other companies, led to speculation that passkeys were proprietary to Apple.<ref>{{cite news |last1=Shakir|first1=Umar|title=Reminder: passkeys are not just from Apple|url=https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fido-alliance-passwordless-google-microsoft|access-date=4 July 2025|publisher=The Verge|date=6 August 2022|archive-date=24 September 2023|archive-url=https://web.archive.org/web/20230924231545/https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fido-alliance-passwordless-google-microsoft|url-status=live}}</ref> As browsers and websites began to implement WebAuthn, the inconsistent feature-sets have often resulted in a variety of understandings of what exactly counted as a passkey.<ref name="arstechnica-not-usable"/> | When Apple first prominently introduced passkeys to the public in 2022,<ref>{{cite news |last1=Clemons|first1=Taylor|title=WWDC 2022: Apple announces Passkey feature to eliminate passwords across platforms|url=https://www.zdnet.com/article/wwdc-2022-apple-announces-passkey-feature/|access-date=4 July 2025|publisher=ZD Net|date=6 June 2022|archive-date=6 June 2023|archive-url=https://web.archive.org/web/20230606212207/https://www.zdnet.com/article/wwdc-2022-apple-announces-passkey-feature/|url-status=live}}</ref> they emphasized integrations with their own products. This, combined with the lack of clear communication from other companies, led to speculation that passkeys were proprietary to Apple.<ref>{{cite news |last1=Shakir|first1=Umar|title=Reminder: passkeys are not just from Apple|url=https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fido-alliance-passwordless-google-microsoft|access-date=4 July 2025|publisher=The Verge|date=6 August 2022|archive-date=24 September 2023|archive-url=https://web.archive.org/web/20230924231545/https://www.theverge.com/2022/8/5/23293643/apple-passkeys-fido-alliance-passwordless-google-microsoft|url-status=live}}</ref> As browsers and websites began to implement WebAuthn, the inconsistent feature-sets have often resulted in a variety of understandings of what exactly counted as a passkey.<ref name="arstechnica-not-usable"/> | ||