WebAuthn: Difference between revisions

WebAuthn as well as CTAP are both outgrowths of the FIDO2 project<ref name="fido2"/>, which  tries to standardize on secure and password-less authentication schemes and goes beyond the scope of browsers and the Web. It is based upon previous work done by the FIDO Alliance, in particular the [[Universal Authentication Framework]] (UAF) and Universal 2nd Factor (U2F) standards.

The WebAuthn Level 1 standard was published as a Candidate Recommendation by the [[Web Authentication Working Group]] on March 20, 2018.<ref name="webauthn"/> The desktop version of [[Google Chrome]] has supported WebAuthn since version 67.<ref name="chrome-support">{{cite web|url=https://developers.google.com/web/updates/2018/05/webauthn|title=Enabling Strong Authentication with WebAuthn|first=Christiaan |last=Brand|website=Google Developers|date=2018-06-03|accessdate=2018-06-25}}</ref> [[Firefox|Mozilla Firefox]], which had not fully supported the previous FIDO U2F standard, included and enabled WebAuthn in Firefox version 60, released on May 9, 2018.<ref>{{cite web|url=https://www.cnet.com/news/firefox-moves-browsers-into-the-post-password-future-with-webauthn/|title=Firefox moves browsers into post-password future with WebAuthn tech|first=Stephen|last=Shankland|website=CNET|date=2018-05-09|accessdate=2018-05-11}}</ref> The current [[Windows Insider]] release of [[Microsoft Edge]] implements a version of WebAuthn that works with both [[Windows Hello]] as well as external Security Keys.<ref>{{cite web|url=https://blogs.windows.com/windowsexperience/2018/05/31/announcing-windows-10-insider-preview-build-17682/#oHYCS0GkF95OMzKH.97|title=Announcing Windows 10 Insider Preview Build 17682|author=Sarkar, et. al.|publisher=Microsoft|date=2018-05-23|accessdate=2018-06-25}}</ref> Support that matches the published standard is expected later in 2018.<ref name="chrome-support"/>

[[Dropbox (service)|Dropbox]] announced support for WebAuthn logins (as a 2nd factor) on May 8, 2018.<ref>{{cite web|url=https://blogs.dropbox.com/tech/2018/05/introducing-webauthn-support-for-secure-dropbox-sign-in/|title=Introducing WebAuthn support for secure Dropbox sign in|first=Brad|last=Girardeau|publisher=Dropbox|work=Dropbox Tech Blog|date=2018-05-08|accessdate=2018-05-11}}</ref>

The WebAuthn API extends the Credential Management <code>navigator.credentials.create()</code> and <code>navigator.credentials.get()</code> [[JavaScript]] methods so they accept a <code>publicKey</code> parameter. The <code>create()</code> method is used for registering public key authenticators as part of associating them with user accounts (possibly at initial account creation time, but more likely when adding a new security device to an existing account), and the <code>get()</code> method is used for authenticating (such as when logging in).

The API does not allow direct access to or manipulation of private keys, beyond requesting their initial creation.

In August 2018, a team of researchers from Paragon Initiative Enterprises did a security audit of the upcoming WebAuthn standard. While they could not find any specific exploits, they revealed some serious weaknesses in the way the underlying cryptography is used and mandated by the standard.<ref name="paragon-blog">{{cite web|url=https://paragonie.com/blog/2018/08/security-concerns-surrounding-webauthn-don-t-implement-ecdaa-yet|title=Security Concerns Surrounding WebAuthn: Don't Implement ECDAA (Yet)|publisher=Paragon Initiative Enterprises Blog|date=2018-08-23|accessdate=2018-10-09}}</ref>

Despite these shortcomings the researchers from Paragon Initiative Enterprises still encourage users to continue to use WebAuthn but have come up with some recommendations for potential implementors and developers of the standard that they hope can be implemented before the standard is finalized. Avoiding such mistakes as early as possible would prevent the industry from any challenges that are introduced by broken standards and the need for [[Backward_compatibility|backwards compatibility]].

{{reflist}}

*[https://www.w3.org/TR/webauthn/ Web Authentication: An API for accessing Public Key Credentials Level 1]

*[https://www.w3.org/Webauthn/ Web Authentication Working Group]