WebAuthn: Difference between revisions
m fix link |
m change ref name for consistency |
||
| Line 1: | Line 1: | ||
'''WebAuthn''' ('''Web Authentication''') is an effort by the [[World Wide Web Consortium]] (W3C),<ref name=" | '''WebAuthn''' ('''Web Authentication''') is an effort by the [[World Wide Web Consortium]] (W3C),<ref name="W3C-WebAuthn">{{cite web |url=https://www.w3.org/TR/webauthn/ |title=Web Authentication: An API for accessing Public Key Credentials Level 1 |author=Balfanz, et al. |publisher=W3C |date=2019-01-17 |accessdate=2019-01-23}}</ref><ref>{{cite web |url=https://www.w3.org/blog/webauthn/ |title=Web Authentication Working Group |accessdate=2018-05-11 |publisher=W3C}}</ref> with input from the [[FIDO Alliance]],<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|accessdate=2018-05-11}}</ref> to standardize an interface for [[public-key authentication]] of users to web-based applications and services. It implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between websites and [[web browser|web browsers]] when exchanging user credentials. | ||
WebAuthn can be used in a single-factor capacity, whereby the user does not have to provide any additional information, such as username and passwords. However, for additional security, the party asking for authentication can still require those characteristics, effectively making this a [[multi-factor authentication]] scheme. Optionally, this can also be combined with other authentication factors, such as gestures or [[biometric]] verification, which improves overall security, while it is still unnecessary for users to type in long, complex strings of characters. | WebAuthn can be used in a single-factor capacity, whereby the user does not have to provide any additional information, such as username and passwords. However, for additional security, the party asking for authentication can still require those characteristics, effectively making this a [[multi-factor authentication]] scheme. Optionally, this can also be combined with other authentication factors, such as gestures or [[biometric]] verification, which improves overall security, while it is still unnecessary for users to type in long, complex strings of characters. | ||
| Line 8: | Line 8: | ||
== Application and device support == | == Application and device support == | ||
The WebAuthn Level 1 standard was published as a Proposed Recommendation by the [[Web Authentication Working Group]] on January 17, 2019.<ref name=" | The WebAuthn Level 1 standard was published as a Proposed Recommendation by the [[Web Authentication Working Group]] on January 17, 2019.<ref name="W3C-WebAuthn" /> The desktop version of [[Google Chrome]] has supported WebAuthn since version 67.<ref name="chrome-support">{{cite web|url=https://developers.google.com/web/updates/2018/05/webauthn|title=Enabling Strong Authentication with WebAuthn|first=Christiaan |last=Brand|website=Google Developers|date=2018-06-03|accessdate=2018-06-25}}</ref> [[Firefox|Mozilla Firefox]], which had not fully supported the previous FIDO U2F standard, included and enabled WebAuthn in Firefox version 60, released on May 9, 2018.<ref>{{cite web|url=https://www.cnet.com/news/firefox-moves-browsers-into-the-post-password-future-with-webauthn/|title=Firefox moves browsers into post-password future with WebAuthn tech|first=Stephen|last=Shankland|website=CNET|date=2018-05-09|accessdate=2018-05-11}}</ref> The current [[Windows Insider]] release of [[Microsoft Edge]] implements a version of WebAuthn that works with both [[Windows Hello]] as well as external Security Keys.<ref>{{cite web|url=https://blogs.windows.com/windowsexperience/2018/05/31/announcing-windows-10-insider-preview-build-17682/#oHYCS0GkF95OMzKH.97|title=Announcing Windows 10 Insider Preview Build 17682|author=Sarkar, et. al.|publisher=Microsoft|date=2018-05-23|accessdate=2018-06-25}}</ref> Support that matches the published standard is expected later in 2018.<ref name="chrome-support"/> | ||
Existing FIDO U2F Security Keys are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older hardware tokens are unable to store.<ref name=" | Existing FIDO U2F Security Keys are largely compatible with the WebAuthn standard, though WebAuthn added the ability to reference a unique per-account "user handle" identifier, which older hardware tokens are unable to store.<ref name="W3C-WebAuthn" /> One of the first FIDO2-compatible [[authenticator]]s was the second-generation [[YubiKey|Security Key]] by Yubico, announced on April 10, 2018.<ref>{{cite press release|url=https://www.yubico.com/press-releases/280530/|title=Yubico Launches New Developer Program and Security Key for FIDO2 and WebAuthn W3C Specifications|date=2018-04-10|accessdate=2018-05-11}}</ref> | ||
[[Dropbox (service)|Dropbox]] announced support for WebAuthn logins (as a 2nd factor) on May 8, 2018.<ref>{{cite web|url=https://blogs.dropbox.com/tech/2018/05/introducing-webauthn-support-for-secure-dropbox-sign-in/|title=Introducing WebAuthn support for secure Dropbox sign in|first=Brad|last=Girardeau|publisher=Dropbox|work=Dropbox Tech Blog|date=2018-05-08|accessdate=2018-05-11}}</ref> | [[Dropbox (service)|Dropbox]] announced support for WebAuthn logins (as a 2nd factor) on May 8, 2018.<ref>{{cite web|url=https://blogs.dropbox.com/tech/2018/05/introducing-webauthn-support-for-secure-dropbox-sign-in/|title=Introducing WebAuthn support for secure Dropbox sign in|first=Brad|last=Girardeau|publisher=Dropbox|work=Dropbox Tech Blog|date=2018-05-08|accessdate=2018-05-11}}</ref> | ||