WebAuthn: Difference between revisions
Importing Wikidata short description: "Public-key authentication standard" (Shortdesc helper) |
No edit summary |
||
| Line 1: | Line 1: | ||
{{short description|Public-key authentication standard}} | {{short description|Public-key authentication standard}} | ||
'''WebAuthn''' ('''Web Authentication''') is | '''WebAuthn''' ('''Web Authentication''') is a [[Web standard]] by the [[World Wide Web Consortium]] (W3C),<ref name="W3C-WebAuthn">{{cite web |editor1-last=Balfanz |editor1-first=Dirk |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Hodges |editor3-first=Jeff |editor4-last=Jones |editor4-first=J.C. |editor5-last=Jones |editor5-first=Michael B. |editor6-last=Kumar |editor6-first=Akshay |editor7-last=Liao |editor7-first=Angelo |editor8-last=Lindemann |editor8-first=Rolf |editor9-last=Lundberg |editor9-first=Emil |title=Web Authentication: An API for accessing Public Key Credentials Level 1 |url=https://www.w3.org/TR/2019/REC-webauthn-1-20190304/ |publisher=World Wide Web Consortium (W3C) |date=4 March 2019 |accessdate=4 March 2019}}</ref><ref>{{cite web |url=https://www.w3.org/blog/webauthn/ |title=Web Authentication Working Group |accessdate=2018-05-11 |publisher=W3C}}</ref> with input from the [[FIDO Alliance]],<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|accessdate=2018-05-11}}</ref> to standardize an interface for [[public-key authentication]] of users to web-based applications and services. It implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between websites and [[web browser|web browsers]] when exchanging user credentials. | ||
WebAuthn can be used in a single-factor capacity, whereby the user does not have to provide any additional information, such as username and passwords. However, for additional security, the party asking for authentication can still require those characteristics, effectively making this a [[multi-factor authentication]] scheme. Optionally, this can also be combined with other authentication factors, such as gestures or [[biometric]] verification, which improves overall security, while it is still unnecessary for users to type in long, complex strings of characters. | WebAuthn can be used in a single-factor capacity, whereby the user does not have to provide any additional information, such as username and passwords. However, for additional security, the party asking for authentication can still require those characteristics, effectively making this a [[multi-factor authentication]] scheme. Optionally, this can also be combined with other authentication factors, such as gestures or [[biometric]] verification, which improves overall security, while it is still unnecessary for users to type in long, complex strings of characters. | ||
| Line 8: | Line 8: | ||
WebAuthn as well as CTAP are both outgrowths of the [[FIDO2 Project]], which tries to standardize on secure and password-less authentication schemes and goes beyond the scope of browsers and the Web. It is based upon previous work done by the FIDO Alliance, in particular the [[Universal Authentication Framework]] (UAF) and Universal 2nd Factor (U2F) standards. | WebAuthn as well as CTAP are both outgrowths of the [[FIDO2 Project]], which tries to standardize on secure and password-less authentication schemes and goes beyond the scope of browsers and the Web. It is based upon previous work done by the FIDO Alliance, in particular the [[Universal Authentication Framework]] (UAF) and Universal 2nd Factor (U2F) standards. | ||
WebAuthn was approved as a standard on March 3, 2019.<ref>{{Cite web |url=https://venturebeat.com/2019/03/04/w3c-approves-webauthn-as-the-web-standard-for-password-free-logins/ |title=W3C Approves WebAuthn as the Web Standard for Password-Free Logins |last=Protalinski |first=Emil |date=Marcy 4, 2019}}</ref> | |||
== Application and device support == | == Application and device support == | ||
The WebAuthn Level 1 standard was published as a W3C Recommendation by the [[Web Authentication Working Group]] on 4 March 2019.<ref name="W3C-WebAuthn" /><ref>{{cite web |title=W3C and FIDO Alliance Finalize Web Standard for Secure, Passwordless Logins |url=https://www.w3.org/2019/03/pressrelease-webauthn-rec.html.en |publisher=[[World Wide Web Consortium]] (W3C) |accessdate=4 March 2019 |date=4 March 2019}}</ref> The desktop version of [[Google Chrome]] has supported WebAuthn since version 67.<ref name="chrome-support">{{cite web|url=https://developers.google.com/web/updates/2018/05/webauthn|title=Enabling Strong Authentication with WebAuthn|first=Christiaan |last=Brand|website=Google Developers|date=2018-06-03|accessdate=2018-06-25}}</ref> [[Firefox|Mozilla Firefox]], which had not fully supported the previous FIDO U2F standard, included and enabled WebAuthn in Firefox version 60, released on May 9, 2018.<ref>{{cite web|url=https://www.cnet.com/news/firefox-moves-browsers-into-the-post-password-future-with-webauthn/|title=Firefox moves browsers into post-password future with WebAuthn tech|first=Stephen|last=Shankland|website=CNET|date=2018-05-09|accessdate=2018-05-11}}</ref> The current [[Windows Insider]] release of [[Microsoft Edge]] implements a version of WebAuthn that works with both [[Windows Hello]] as well as external Security Keys.<ref>{{cite web|url=https://blogs.windows.com/windowsexperience/2018/05/31/announcing-windows-10-insider-preview-build-17682/#oHYCS0GkF95OMzKH.97|title=Announcing Windows 10 Insider Preview Build 17682|author=Sarkar, et. al.|publisher=Microsoft|date=2018-05-23|accessdate=2018-06-25}}</ref> Support that matches the published standard is expected later in 2018.<ref name="chrome-support"/> | The WebAuthn Level 1 standard was published as a W3C Recommendation by the [[Web Authentication Working Group]] on 4 March 2019.<ref name="W3C-WebAuthn" /><ref>{{cite web |title=W3C and FIDO Alliance Finalize Web Standard for Secure, Passwordless Logins |url=https://www.w3.org/2019/03/pressrelease-webauthn-rec.html.en |publisher=[[World Wide Web Consortium]] (W3C) |accessdate=4 March 2019 |date=4 March 2019}}</ref> The desktop version of [[Google Chrome]] has supported WebAuthn since version 67.<ref name="chrome-support">{{cite web|url=https://developers.google.com/web/updates/2018/05/webauthn|title=Enabling Strong Authentication with WebAuthn|first=Christiaan |last=Brand|website=Google Developers|date=2018-06-03|accessdate=2018-06-25}}</ref> [[Firefox|Mozilla Firefox]], which had not fully supported the previous FIDO U2F standard, included and enabled WebAuthn in Firefox version 60, released on May 9, 2018.<ref>{{cite web|url=https://www.cnet.com/news/firefox-moves-browsers-into-the-post-password-future-with-webauthn/|title=Firefox moves browsers into post-password future with WebAuthn tech|first=Stephen|last=Shankland|website=CNET|date=2018-05-09|accessdate=2018-05-11}}</ref> The current [[Windows Insider]] release of [[Microsoft Edge]] implements a version of WebAuthn that works with both [[Windows Hello]] as well as external Security Keys.<ref>{{cite web|url=https://blogs.windows.com/windowsexperience/2018/05/31/announcing-windows-10-insider-preview-build-17682/#oHYCS0GkF95OMzKH.97|title=Announcing Windows 10 Insider Preview Build 17682|author=Sarkar, et. al.|publisher=Microsoft|date=2018-05-23|accessdate=2018-06-25}}</ref> Support that matches the published standard is expected later in 2018.<ref name="chrome-support"/> | ||