WebAuthn: Difference between revisions
promote W3C announcement |
m fix typo |
||
| Line 1: | Line 1: | ||
{{short description|Public-key authentication standard}} | {{short description|Public-key authentication standard}} | ||
'''WebAuthn''' ('''Web Authentication''') is a [[ | '''WebAuthn''' ('''Web Authentication''') is a [[web standard]] by the [[World Wide Web Consortium]] (W3C),<ref name="W3C-WebAuthn">{{cite web |editor1-last=Balfanz |editor1-first=Dirk |editor2-last=Czeskis |editor2-first=Alexei |editor3-last=Hodges |editor3-first=Jeff |editor4-last=Jones |editor4-first=J.C. |editor5-last=Jones |editor5-first=Michael B. |editor6-last=Kumar |editor6-first=Akshay |editor7-last=Liao |editor7-first=Angelo |editor8-last=Lindemann |editor8-first=Rolf |editor9-last=Lundberg |editor9-first=Emil |title=Web Authentication: An API for accessing Public Key Credentials Level 1 |url=https://www.w3.org/TR/2019/REC-webauthn-1-20190304/ |publisher=World Wide Web Consortium (W3C) |date=4 March 2019 |accessdate=4 March 2019}}</ref><ref>{{cite web |url=https://www.w3.org/blog/webauthn/ |title=Web Authentication Working Group |accessdate=2018-05-11 |publisher=W3C}}</ref> with input from the [[FIDO Alliance]],<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|accessdate=2018-05-11}}</ref> to standardize an interface for [[public-key authentication]] of users to web-based applications and services. It implements an extension of the W3C's more general [[Credential Management]] [[application programming interface|API]], which is an attempt to formalize the interaction between websites and [[web browser|web browsers]] when exchanging user credentials. | ||
WebAuthn can be used in a single-factor capacity, whereby the user does not have to provide any additional information, such as username and passwords. However, for additional security, the party asking for authentication can still require those characteristics, effectively making this a [[multi-factor authentication]] scheme. Optionally, this can also be combined with other authentication factors, such as gestures or [[biometric]] verification, which improves overall security, while it is still unnecessary for users to type in long, complex strings of characters. | WebAuthn can be used in a single-factor capacity, whereby the user does not have to provide any additional information, such as username and passwords. However, for additional security, the party asking for authentication can still require those characteristics, effectively making this a [[multi-factor authentication]] scheme. Optionally, this can also be combined with other authentication factors, such as gestures or [[biometric]] verification, which improves overall security, while it is still unnecessary for users to type in long, complex strings of characters. | ||