WebAuthn: Difference between revisions
Rewrote part of the intro to highlight the main purpose of WebAuthn and its key concepts + added the "Unbalanced Section" template to the "In the media" section. |
Added link in the intro + fixed typo. |
||
| Line 42: | Line 42: | ||
'''Web Authentication''' ('''WebAuthn''') is a [[web standard]] published by the [[World Wide Web Consortium]] (W3C).<ref name="W3C-WebAuthn-Level-1"/><ref>{{cite web |url=https://www.w3.org/blog/webauthn/ |title=Web Authentication Working Group |publisher=[[World Wide Web Consortium]] |access-date=2018-05-11}}</ref><ref>{{cite episode |title=What is WebAuthn |series=TechStuff |publisher=[[iHeartMedia]] |series-link=HowStuffWorks#TechStuff |first=Jonathan |last=Strickland |date=18 March 2019 |url=https://www.iheart.com/podcast/105-techstuff-26941194/episode/what-is-webauthn-30705004/ |minutes=20:35 |access-date=20 March 2019}}</ref> | '''Web Authentication''' ('''WebAuthn''') is a [[web standard]] published by the [[World Wide Web Consortium]] (W3C).<ref name="W3C-WebAuthn-Level-1"/><ref>{{cite web |url=https://www.w3.org/blog/webauthn/ |title=Web Authentication Working Group |publisher=[[World Wide Web Consortium]] |access-date=2018-05-11}}</ref><ref>{{cite episode |title=What is WebAuthn |series=TechStuff |publisher=[[iHeartMedia]] |series-link=HowStuffWorks#TechStuff |first=Jonathan |last=Strickland |date=18 March 2019 |url=https://www.iheart.com/podcast/105-techstuff-26941194/episode/what-is-webauthn-30705004/ |minutes=20:35 |access-date=20 March 2019}}</ref> | ||
Its primary purpose is to build a system of authentication for web-based applications that solves or mitigates the issues of traditional password-based authentication.<ref name="imperialviolet-webauthn">{{cite web |url=https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html |title=A Tour of WebAuthn}}</ref> | Its primary purpose is to build a system of authentication for web-based applications that solves or mitigates the issues of traditional password-based authentication.<ref name="imperialviolet-webauthn">{{cite web |url=https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html |title=A Tour of WebAuthn}}</ref> | ||
Zero-knowledge proofs based on [[public-key cryptography|public-key signature schemes]] are used to register and authenticate users without the need to transmit or store private authenticating information (such as passwords) on servers. | [[Zero-knowledge proof|Zero-knowledge proofs]] based on [[public-key cryptography|public-key signature schemes]] are used to register and authenticate users without the need to transmit or store private authenticating information (such as passwords) on servers. | ||
Passwords are replaced by the so-called WebAuthn '''Credentials''' which are generated client-side and stored in so-called '''Authenticators'''. | Passwords are replaced by the so-called WebAuthn '''Credentials''' which are generated client-side and stored in so-called '''Authenticators'''. WebAuthn supports both roaming authenticators (such as physical security keys) and platform authenticators (such as smartphones). While different types of credentials are supported, synced discoverable credentials (also known as '''Passkeys'''<ref>{{cite web |title=White Paper: Multi-Device FIDO Credentials |url=https://fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf |publisher=[[FIDO Alliance]] |access-date=20 May 2024 |page=6 |format=PDF |date=March 2022}}</ref>) are the most common ones. | ||
WebAuthn is a core component of the [[FIDO Alliance#FIDO2|FIDO2 Project]] under the guidance of the [[FIDO Alliance]].<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|access-date=2018-05-11}}</ref> | WebAuthn is a core component of the [[FIDO Alliance#FIDO2|FIDO2 Project]] under the guidance of the [[FIDO Alliance]].<ref name="fido2">{{cite web|url=https://fidoalliance.org/fido2/|title=FIDO2 Project|publisher=FIDO Alliance|access-date=2018-05-11}}</ref> | ||